expressdgl[.]pics

expressdgl.pics is currently active and classified as a high‑risk Google brand‑impersonation campaign. The domain was registered on 2026‑04‑09 through Dynadot LLC and is hosted on Cloudflare infrastructure, using the nameservers byron.ns.cloudflare.com and elle.ns.cloudflare.com. DNS resolution points to IP 188.114.97.3, which is listed as a Cloudflare location in Canada. HTTP requests receive a 302 redirect and the site presents a TLS certificate issued by Let’s Encrypt (identifier E8). VirusTotal records indicate that 5 of 94 scanned engines flag the domain, and AlienVault OTX references it in 22 separate threat‑intel pulses. The Gridinsoft trust score is 0 / 100, and the domain appears on a single external blocklist. PhishDestroy has already added it to its block list. The only observed page title is “Atto – Time Clock & Scheduling – Apps on Google Play”, suggesting the site may be leveraging a legitimate‑looking Google Play listing to lure victims, though the exact page content has not been examined. Defenders should block both the domain and its resolving IP at perimeter and DNS layers, monitor for related redirects, and consider adding the host to threat‑intel feeds. Ongoing observation is recommended to capture any payloads or credential‑harvesting forms that may be deployed behind the redirect.