gramsdailyxpress[.]com

Gramsdailyxpress.com was registered on 15 May 2025 through Web Commerce Communications Limited and currently resolves to 107.173.193.235, an address owned by HostPapa (AS36352) in the United States. The site returns HTTP 200 and presents the page title “Home Classic – Grams Daily Xpress Courier”. Technical fingerprints show the use of Bootstrap, LiteSpeed, jQuery, Elfsight and HTTP/3, and the TLS certificate is a Let’s Encrypt issuance (identifier YE2). The domain has a Gridinsoft trust score of 0/100 and is listed on a single security blocklist. PhishDestroy has already blocked the domain, and two of ninety‑five VirusTotal scanners have flagged it as malicious. The infrastructure is explicitly marked as a brand‑impersonation campaign targeting the celer brand. While the exact phishing page content has not been publicly disclosed, the combination of a low trust score, active blocklist entry, and prior vendor detections indicates a high likelihood of credential‑harvesting or malicious redirects. Defenders should add 107.173.193.235 to network‑level deny lists, monitor DNS queries for gramsdailyxpress.com, and enforce email filtering rules that quarantine messages referencing the celer brand and containing links to this domain. Continuous re‑evaluation is advised because the domain remains active and may evolve its payload.