au[.]expressparcel[.]com[.]sg

On July 29, 2026, the domain au.expressparcel.com.sg was identified as an active generic phishing infrastructure with an elevated risk rating. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, indicating that it is being used to host malicious phishing content. VirusTotal analysis shows that eight out of ninety‑one participating scanners flagged the domain as malicious, providing additional corroboration of its abusive nature.

No public WHOIS or hosting details were disclosed in the available intelligence, and the page title or any HTTP response data have not been released for analysis, leaving the exact payload and victim‑targeting techniques undetermined. Despite the limited visibility, the convergence of blocklist inclusion, sinkhole blocking, and multi‑vendor detections confirms that the domain is part of a phishing campaign. Defenders should add au.expressparcel.com.sg to their deny lists at network and endpoint layers, ensure that URL filtering solutions reference the blocklist that contains the domain, and monitor for any outbound connections to the host.

Incident response teams should also treat any emails or messages that reference the “expressparcel” brand as potentially malicious, especially if they direct users to this subdomain. Ongoing collection of passive DNS, TLS certificate, and hosting metadata is recommended to enrich the profile and to detect any future infrastructure changes or related domains. The current evidence warrants continued observation and proactive containment.