my[.]expresssureexcrow[.]co[.]uk

This domain, my.expresssureexcrow.co.uk, presents a counterfeit login portal mimicking Express Excrow, a legitimate escrow service. Analysis indicates the site is designed to harvest user credentials by impersonating the official Express Excrow interface, as evidenced by the page title 'Login | Express Excrow.' Such infrastructure is commonly deployed in credential theft campaigns targeting users of financial or escrow platforms, where stolen logins may be exploited for unauthorized account access or fraudulent transactions. Infrastructure analysis reveals the domain was registered on September 14, 2025, through Realtime Register BV (tagged as AXIDOMAINS). It resolves to the IP address 198.12.80.250 and currently appears on one security blocklist. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged by automated systems. The domain was taken offline following detection, but its recent registration and low detection rate highlight the risk of similar, undetected infrastructure remaining active. Users who visited my.expresssureexcrow.co.uk should immediately revoke any entered credentials from their Express Excrow accounts or associated services. Monitor linked financial accounts for unauthorized activity and enable multi-factor authentication where available. If login details were submitted, assume they are compromised and avoid reusing them across other platforms. Security teams should review network logs for connections to 198.12.80.250 or related domains registered through the same registrar during the September 2025 timeframe.