Recently, my PC was flagged by the IT firewall of one of my clients. They reported connections to a malicious address: p8464oxs com, which had been flagged as a threat.
To be sure, I reformatted my PC and installed Portmaster to monitor network activity. What I discovered was alarming: all these connections were DNS requests made by the ExpressVPN app while in standby.
I contacted ExpressVPN’s support team, and their response was even more surprising—they said this is “normal behaviour”.
This is a heads-up for anyone using ExpressVPN on work devices. It seems their app might trigger red flags on IT systems due to these kinds of DNS requests. Be cautious!
Thanks for flagging this. We’d like to clarify that this isn’t a malicious domain—it is one of ours that has been mistakenly flagged as malicious. We’re looking into why this has happened.
To add to what our Support Team mentioned, these random-looking domains are part of our system that ensures the app has the latest servers to connect to. This is sometimes triggered on corporate networks if those networks block our normal domains.
