convexminers[.]pro

On 24 July 2026 the domain convexminers.pro was observed hosting a credential‑phishing page titled “Convex Miners: INVEST AND GROW”. The site was built on an Apache Tomcat / LiteSpeed stack and delivered client‑side components including jQuery, Tiny Slider, Smartsupp, and Skolengo. TLS was provided by a Let’s Encrypt R12 certificate, indicating proper HTTPS configuration at the time of capture. DNS resolution points to IP address 198.12.66.123, which belongs to AS36352 (HostPapa) and is geolocated in the United States. Registration was performed through Hostinger operations, UAB, and the domain uses the authoritative name servers ns1.host‑forest.com and ns2.host‑forest.com.

Reputation services assign the domain a Scamadviser trust score of 1 / 100, and it appears on at least one public security blocklist. PhishDestroy has taken the site offline and the current HTTP status is reported as offline. VirusTotal analysis shows three of ninety‑five scanning engines flagged the domain as malicious, confirming the presence of suspicious activity. The campaign impersonates the brand “across”, although the exact brand context cannot be verified from the available page title alone.

No additional intelligence such as OTX identifiers, Safe Browsing verdicts, or detailed payload samples was provided. Defenders should continue to block the IP 198.12.66.123 and the domain convexminers.pro at DNS and proxy layers, monitor for any re‑registration attempts, and update endpoint detection rules to flag the identified technology stack combined with the observed page title. Organizations should also educate users about unsolicited investment‑related communications that reference “Convex Miners”, as the lure aligns with credential‑phishing tactics. Ongoing surveillance of the hosting provider HostPapa and the registrar Hostinger may reveal further related campaigns.