northfieldlogistics[.]com

Analysis of northfieldlogistics.com shows that the domain is actively used for a generic phishing campaign. The site resolves to IP 78.46.40.242, hosted in Germany under AS24940 Hetzner Online GmbH, and was registered on February 21, 2026 via Dynadot LLC. The domain is blocked by PhishDestroy and appears on a single security blocklist, with a Gridinsoft trust score of 0/100, indicating a high likelihood of malicious intent. The TLS certificate is a Let’s Encrypt R13 issuance, and the web server returns HTTP 200 over HTTP/3, powered by LiteSpeed and built with PHP, Leaflet, Bootstrap, Smartsupp, and jQuery. DNS configuration lists four Lytehosting nameservers, and the MX record points to northfieldlogistics.com with priority 0. The page title "NORTHFIELD LOGISTICS" is the only content observed; no additional page analysis is available. AlienVault OTX references the domain in one threat pulse, and VirusTotal flagged it with a single vendor detection out of 93 scans. Defenders should treat the domain as high risk, block network traffic to the associated IP address, add the domain to internal blocklists, and monitor for any related email artifacts using the observed MX record. Continued surveillance is advised, as further infrastructure or payload details may emerge.