skyroute-express[.]com

This domain, skyroute-express.com, is flagged as an elevated-risk credential theft phishing site designed to harvest user login credentials by impersonating express delivery services. Analysis indicates the site employs social engineering tactics, presenting itself as a legitimate same-day delivery provider under the page title 'Same day Express pro' to deceive victims into submitting sensitive account information. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Dynadot Inc, an uncommonly future-dated creation that may indicate an attempt to evade detection or establish long-term malicious operations. It resolves to the IP address 37.49.229.75 and is currently offline. Detection metrics show the domain is flagged by 5 out of 95 security vendors on VirusTotal, with additional listings on two security blocklists: PhishDestroy and OISD. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its malicious classification. Technologies detected on the site include PHP, LiteSpeed, Smartsupp, jQuery, and HTTP/3, which are consistent with modern phishing infrastructure. To mitigate credential theft risks associated with this domain, organizations should immediately block the IP address 37.49.229.75 at the network perimeter and add skyroute-express.com to enterprise-wide blocklists. End-users should be educated on recognizing phishing attempts, particularly those impersonating delivery services, and encouraged to verify domain authenticity before entering credentials. Multi-factor authentication (MFA) should be enforced for all accounts to reduce the impact of stolen credentials. Security teams are advised to monitor for related domains registered through Dynadot Inc or resolving to the same IP, as these may indicate further malicious activity.