connexpay-app[.]co[.]com

Analysis of the domain connexpay-app.co.com, observed on July 24, 2026, indicates a high‑risk credential phishing campaign targeting the ConnexPay brand. The site’s page title explicitly advertises a ConnexPay login portal, confirming the intended victim set. The domain resolves to the IP address 144.31.244.50, which is registered to AS213877 U1 DIGITAL SERVICES LTD and geolocated in Germany. Registration data show the domain was created on August 16, 1997 and is serviced by the registrar Moniker Online Services LLC, with a diverse set of nameservers (ns1.nic.co.com, ns2.nic.co.com, ns3.my-ndns.com, ns3.nic.co.com, ns4.my-ndns.com, ns4). No SSL certificate is present, and the site is currently taken offline, limiting immediate access for verification.

VirusTotal records indicate that 16 of 95 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on four public blocklists and is specifically listed by PhishDestroy, Polkadot, Enkrypt, and Codeesura, demonstrating consensus among threat‑intelligence feeds. Reputation services assign extremely low scores: Scamadviser rates it 1 / 100 and Gridinsoft 0 / 100, reflecting a lack of legitimacy. The classification as credential phishing is corroborated by the page title and blocklist tags.

Uncertainties remain regarding the exact phishing kit used and any additional infrastructure that may have been employed before takedown, as no further forensic artifacts are publicly disclosed. Defenders should add the domain, its associated IP, and the full nameserver set to their block and detection rules, monitor for any re‑registration attempts, and enforce strict credential monitoring for ConnexPay accounts. Network traffic to the IP should be flagged, and any inbound connections to the listed nameservers treated as suspicious. Continuous review of blocklist updates is recommended to capture potential resurgence of the infrastructure.