globalwidecourier[.]com

This domain, globalwidecourier.com, is currently flagged as an active high-risk phishing infrastructure targeting logistics and courier services. Registered on January 3, 2026, through Spaceship, Inc., the domain resolves to IP address 198.251.84.200, hosted on infrastructure associated with FranTech Solutions in Luxembourg. Analysis indicates a 302 HTTP redirect, suggesting the site may be funneling visitors to secondary malicious endpoints. The page title, 'GlobalWide Courier - Professional Logistics,' aligns with courier-themed phishing campaigns, though the exact content and targeted brand remain unconfirmed due to lack of direct analysis. Infrastructure reveals the use of PHP, Tailwind CSS, LiteSpeed web server, and jQuery, alongside modern protocols like HTTP/3. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious sites. The domain appears in two AlienVault OTX threat intelligence pulses and is blocked by at least one security vendor, while five of 91 security engines on VirusTotal flag it as malicious. Gridinsoft assigns a trust score of 1 out of 100, further indicating high suspicion. Defenders should treat this domain as active phishing infrastructure, particularly for courier or logistics fraud. The combination of recent registration, low-cost hosting, and detection by multiple security sources warrants immediate blocking. Additional monitoring of associated IP ranges (198.251.84.0/24) and certificate transparency logs for related domains is recommended. No evidence of takedown or sinkholing has been observed as of July 12, 2026.