corereachdelivery[.]com

The domain corereachdelivery.com was registered on February 21 2026 through Web Commerce Communications Limited. It resolves to a single IPv4 address, 163.61.188.5, which is announced by AS153568 NEW DHAKA HARDWARE and geolocated in the United States. The site presents a valid Let’s Encrypt certificate (R12) and serves content over HTTP/3.

DNS records list four authoritative name servers – dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. An MX record with priority 0 points back to corereachdelivery.com, indicating that mail handling is self‑hosted. The web server identifies as LiteSpeed and the front‑end stack includes Bootstrap, jQuery, SweetAlert, Slick, and prettyPhoto, reflecting a contemporary website framework.

Threat telemetry marks the domain as high‑risk brand impersonation targeting the brand “across” with a cryptocurrency‑drain motive. VirusTotal flags the site with 3 of 95 scanners reporting malicious behavior, and Gridinsoft assigns a trust score of 2 / 100. The domain appears on one public blocklist and has been blocked by the PhishDestroy feed. The page title returned by the server is “CoreReach Delivery – Home”.

Although the exact malicious payload or phishing workflow has not been disclosed, the convergence of low trust scores, multiple vendor detections, and active blocklist inclusion suggests a strong likelihood of fraudulent activity. Defensive actions should include denying network traffic to 163.61.188.5, adding corereachdelivery.com to URL‑filtering and email‑security policies, and monitoring for related indicators of compromise. Continuous inspection of any observed traffic or payloads is advised to fully characterize the campaign’s objectives.