go-zeexpresss24h[.]shop

Analysis conducted on August 1, 2026 confirms that go-zeexpresss24h.shop remains an active phishing domain targeting users through a courier or logistics-themed scam. Infrastructure analysis reveals the domain resolves to IP address 88.80.17.231, hosted under nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. At the time of assessment, eight of 91 security vendors on VirusTotal flagged the domain as malicious, indicating moderate detection coverage but sufficient evidence to classify it as high-risk. The domain is currently listed on two security blocklists and is actively blocked by PhishDestroy and OpenPhish, reinforcing its classification as a confirmed phishing threat.

No brand name or specific page content has been confirmed through available metadata, though the domain name suggests an attempt to mimic a legitimate express delivery service. The exact nature of the scam—whether it involves fake delivery notifications, payment interception, or credential harvesting—remains unconfirmed due to the absence of detailed page analysis. Registrar and hosting provider details are not publicly disclosed in available intelligence, limiting attribution efforts. The domain’s continued resolution and active blocklist presence indicate ongoing malicious use, with no evidence of takedown or remediation as of the report date.

Defenders are advised to treat go-zeexpresss24h.shop as a confirmed phishing domain and implement blocking at the DNS, network, and endpoint levels. Security teams should monitor for related domains using the same nameserver infrastructure (dyna-ns.net) or IP range, as these may indicate broader campaign infrastructure. End users should be alerted to avoid interaction with the domain, particularly in contexts involving delivery notifications, shipping updates, or requests for personal or financial information. Further analysis of the site’s content and backend infrastructure is recommended to determine the full scope of the threat.