loyalluisexpress[.]com

Analysis of loyalluisexpress.com identifies it as an active courier-themed phishing domain registered on February 21, 2026, through Cosmotown, Inc. The domain resolves to IP 163.61.188.5, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. Infrastructure analysis reveals the use of four nameservers (dns1.lytehosting.com through dns4.lytehosting.com) and a Let's Encrypt SSL certificate (R13). The site returns an HTTP 200 status, indicating operational status as of July 12, 2026. Technical indicators include detected technologies such as PHP, LiteSpeed, Bootstrap, jQuery, and Google Hosted Libraries, suggesting a structured web framework commonly used in phishing operations. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports 2 of 93 security vendors flagging the domain, though the specific detection context remains unverified. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. The page title 'Home' provides no explicit brand targeting, but the domain name implies a courier or logistics theme, a common tactic in credential harvesting or fraudulent delivery scams. No login forms, tracking pages, or exact content have been analyzed, so the precise phishing mechanism remains uncertain. Defenders should treat this domain as high-risk, block resolution at DNS or network level, and monitor for associated indicators such as the IP, nameservers, and SSL certificate issuer. Further investigation into user interactions with this domain is recommended to assess potential credential exposure or financial fraud.