coxsite[.]webflow[.]io

The domain coxsite.webflow.io is currently classified as an active generic phishing infrastructure with an elevated risk rating. VirusTotal analysis shows that 12 of 91 security vendors have flagged the domain, indicating that multiple independent detection engines have identified malicious characteristics. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of hostile intent. The sub‑domain structure reveals reliance on the Webflow hosting platform, a common choice for actors seeking rapid deployment of phishing pages.

No additional intelligence such as registrar details, IP address, ASN, or SSL certificate data is available in the provided dataset, leaving the underlying infrastructure opaque. Consequently, the confidence in attribution is limited to the observed detection signals. Defenders should prioritize immediate mitigation by adding coxsite.webflow.io to URL filtering and DNS block policies across enterprise environments.

Continuous monitoring of threat‑intel feeds for any new indicators—such as additional blocklist listings, expanded vendor detections, or observed hosting changes—is advised. Organizations employing web‑traffic inspection should consider logging attempts to access this domain to support incident response and to refine detection rules. Given the elevated risk label, a precautionary stance is warranted until further forensic evidence clarifies the full scope of the campaign.