eniexpress[.]com

This domain, eniexpress.com, is assessed as a courier-themed phishing site targeting users through a fraudulent express delivery service facade. Registered on February 21, 2026, through Global Domain Group LLC, the domain currently resolves to IP address 163.61.188.5, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. The page title, 'EniExpress | Express Delivery, Courier,' aligns with courier or logistics scams, though no specific brand impersonation is confirmed in available data. Infrastructure analysis reveals the use of LiteSpeed web server technology, PHP, Bootstrap, and client-side libraries including jQuery, Popper, Slick, and OWL Carousel, which are common in both legitimate and fraudulent sites. The domain is flagged by one security vendor on a single blocklist and is blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0/100, indicating high suspicion. SSL certification is provided by Let’s Encrypt (R13), a common choice among threat actors due to its low-cost, automated issuance. MX records are configured, which may facilitate phishing email campaigns using the same domain. Nameservers are hosted on dns1.lytehosting.com and dns2.lytehosting.com, a provider previously associated with abusive domains. As of the report date, the domain is offline, though defenders should treat it as a potential resurfacing risk.

No evidence confirms active user compromise or payload delivery, and the exact phishing mechanism remains unanalyzed. Defenders are advised to monitor for re-registration, DNS reactivation, or hosting changes. Blocking the domain and associated IP at network and email security layers is recommended. If the domain reappears, further analysis of HTTP headers, redirects, and payload behavior is necessary to determine the full scope of the threat.