forwox[.]pro

Analysis of the domain forwox.pro indicates active credential-theft phishing infrastructure as of July 29, 2026. The domain was registered on April 12, 2026, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.97.3, which has been observed in prior phishing campaigns targeting enterprise credentials. Detection metrics show that 17 of 91 security vendors on VirusTotal classify this domain as malicious, while it also appears on one additional security blocklist, reinforcing its elevated risk classification.

Infrastructure analysis reveals that the domain is currently active and has been blocked by PhishDestroy, a specialized anti-phishing service. The exact content of the phishing page remains unconfirmed, as no brand target or page title was provided in available intelligence. However, the combination of detection counts, blocklist presence, and hosting on a known phishing-associated IP suggests a deliberate attempt to harvest login credentials.

Defenders should treat this domain as hostile and implement blocking at the DNS or network level. Organizations using PhishDestroy or similar services may already have protection in place, but additional verification is recommended to ensure coverage across all security layers. Given the domain's recent registration and active status, continuous monitoring for related infrastructure is advised.