c50e278e-195f-4d33-bb9a-5279f9fdd584[.]express[.]conves[.]io

This domain, c50e278e-195f-4d33-bb9a-5279f9fdd584.express.conves.io, is identified as a generic credential phishing threat targeting user login credentials, session tokens, or financial information. The infrastructure mimics legitimate authentication portals to harvest sensitive data, commonly used in large-scale phishing campaigns. Analysis indicates the domain employs obfuscation techniques to evade detection, including dynamic subdomain generation and short-lived hosting patterns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 192.0.79.157, hosted under AS2635 (Automattic, Inc). Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (serial number E8), does not mitigate the threat due to the prevalence of free certificates in phishing operations. Users who accessed or interacted with c50e278e-195f-4d33-bb9a-5279f9fdd584.express.conves.io should immediately revoke any entered credentials, particularly for financial or corporate accounts. Monitor linked accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (192.0.79.157) at the perimeter. If browser sessions were active during the visit, clear cached data and reset stored passwords as a precautionary measure.