I ended up formatting the whole OS 
had like 2 years without so I needed a fresh lemon 
See reply on your other comment thread.
this shite is still happening!
MacOS monterey firewall keeps asking me to allow expressvpnd
I DON’T use expressvpn i don’t have it installed, i’ve deleted the effing process and it keeps showing up.
I’ve complained to several congresspeople in search of re-election this year, hopefully that might help put this company and their influencers under the spotligh
We’ll need some more info to troubleshoot why this is happening for you. Please PM with your contact email.
I too have noticed the same network connections on macOS with little snitch. Mostly to captive.apple.com every 15 seconds.
The expressvpnd process seems to be spawned via the ExpressVPN launchagent under the user directory. I have disabled this launchagent since.
Since disabling the launchagent expressvpnd process no longer spawns and as a result does not make network connections to these domains.
I know you said you don’t use express, but I used to and switched to proton vpn, it’s SO MUCH better in every way. and they have an apple ARM native app. express was way too shady, bought by a megacorp, their apps are inferior to proton. and proton is half the price … no brainer.
Thanks, good observation.
Do you manually restart the expressvpnd back up again when you want to use the app to actually start a VPN connection? Or are you just using another VPN protocol with their service?
Yeah, well since I noticed these strange network connections I am now using the tunnelblick app for mac and loading the openvpn configs into tunnelblick to connect to the expressvpn servers.
You can get the config files by logging into your expressvpn account on their website and look for the manual config section.
Since using Tunnelblick I haven’t gone back to the official client app as there hasn’t been a need to (so far).
Secondary to disabling the expressvpn launchagent I have also denied all outgoing connections for the expressvpnd process via littlesnitch. I’m not to sure what impact that will have if I decide to go back to the client app.