gloexpress[.]icu

This domain, gloexpress.icu, is flagged as an active credential-phishing site. Registered on April 13, 2026, through Global Domain Group LLC, it remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP 163.61.188.7, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. The SSL certificate is issued by Let’s Encrypt (R12), and the site employs technologies including Bootstrap, LiteSpeed, GSAP, Swiper, jQuery, and JivoChat, alongside HTTP/3 support. The page title, 'Home | Page,' provides no explicit brand targeting, though the scam type is classified as credential phishing. MX records point to the domain itself (priority 0), a common tactic to facilitate phishing email campaigns. The domain appears on one security blocklist, and eight of ninety-one security vendors on VirusTotal flag it as malicious. AlienVault OTX includes the domain in four threat intelligence pulses, indicating prior detection in phishing-related activity. Nameservers are hosted under lytehosting.com (dns1.lytehosting.com through dns4.lytehosting.com), a provider frequently associated with phishing infrastructure. While the exact content of the site has not been analyzed, the combination of credential-phishing classification, active hosting, and detection by multiple security vendors suggests a deliberate attempt to harvest user credentials. Defenders should treat this domain as high-risk and consider blocking resolutions to 163.61.188.7, as well as monitoring for related email or web traffic originating from or directed to this infrastructure. No evidence of takedown or mitigation is present as of the report date.