expressauctionhub[.]com

This domain, expressauctionhub.com, is flagged as an active phishing threat targeting users of ScreenConnect remote support software. Registered on April 28, 2026, through a reseller operating under Fewmoretaps OU, the domain currently resolves to 104.21.8.112 and is proxied behind Cloudflare nameservers alexia.ns.cloudflare.com and yevgen.ns.cloudflare.com. The page title explicitly mimics ScreenConnect branding, a tactic commonly observed in credential harvesting or remote access tool impersonation schemes. Analysis indicates the domain remains operational with an HTTP 200 status, suggesting ongoing malicious activity. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, a pattern frequently exploited to obscure origin servers and evade detection. A single security vendor on VirusTotal has flagged the domain, while AlienVault OTX records it in one threat intelligence pulse, further corroborating its malicious classification. The domain appears on one security blocklist and is actively blocked by at least one anti-phishing service. The SSL certificate, issued by Let's Encrypt with serial number E7, aligns with typical phishing campaigns leveraging free certificates to appear legitimate. The exact phishing kit or payload remains unconfirmed, though the combination of ScreenConnect branding and Cloudflare proxying suggests an intent to deceive users into downloading unauthorized software or divulging credentials. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network layer. Monitoring for related domains registered through the same reseller or utilizing identical nameserver patterns may help identify additional threats in this campaign. Given the domain's recent registration and active status, continued vigilance is warranted.