expressbooking[.]live

The domain expressbooking.live was identified as a generic phishing site posing an elevated risk for banking-related credential theft. It did not impersonate a specific brand or deploy a known drainer kit. As of the latest verification, expressbooking.live has been taken offline, though it previously operated as an active phishing page targeting financial login details.

Technical indicators confirm the domain's malicious nature. expressbooking.live was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and Gridinsoft, and appeared on 1 security blocklist (PhishDestroy). It was registered through NameCheap, Inc., and resolved to the IP address 163.61.188.92, hosted under AS153568 (NEW DHAKA HARDWARE) in the US. No SSL certificate was present, and the observed page title was 'expressbooking'. The domain's Gridinsoft trust score was 0/100, while Scamadviser assigned a trust score of 11/100. Nameservers were dns1.cupisweb.com and dns2.cupisweb.com.

Individuals who may have interacted with expressbooking.live should immediately change any banking or financial credentials entered on the site. Enable two-factor authentication (2FA) on all relevant accounts to prevent unauthorized access. Monitor bank statements and credit reports for signs of fraudulent activity. Report the domain to local cybersecurity authorities or platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.