expresslineauction[.]com

This domain, expresslineauction.com, is currently flagged as an active phishing infrastructure targeting users of ScreenConnect remote support software. Analysis indicates the domain was registered on April 28, 2026, through Fewmoretaps OU operating under Trustname.com, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 179.43.140.201, hosted by Private Layer Inc in Switzerland, an autonomous system known for harboring malicious activity. The SSL certificate presented by the domain is issued for bosassistance.icu, a mismatch that suggests either misconfiguration or deliberate obfuscation to evade detection. Infrastructure analysis reveals further indicators of compromise. The domain's nameservers, ares.trustname.com and zeus.trustname.com, are consistent with those used by other recently identified phishing campaigns. The page title, 'ScreenConnect Remote Support Software,' directly mimics legitimate remote access tools, increasing the likelihood of successful social engineering attacks. While only one security vendor on VirusTotal currently flags this domain, it appears on at least one security blocklist and has been documented in a threat intelligence pulse on AlienVault OTX, confirming its malicious classification. The HTTP status code 200 indicates the domain is actively serving content, and its continued operation despite detection suggests persistence in targeting unsuspecting users. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its associated IP address. Network-level protections should be implemented to prevent access, and security teams should monitor for any attempts to leverage this domain in phishing emails or malicious redirects. The Gridinsoft trust score of 37 out of 100 further corroborates the domain's suspicious nature, though additional forensic analysis may be required to determine the full scope of its payload or distribution methods.