coxwexprox[.]com

The domain coxwexprox.com was registered on 21 February 2026 through Dynadot Inc. It resolves to the IPv4 address 173.0.59.2, which is advertised as belonging to the United States and is announced by AS27323 (Wowrack.com). The authoritative nameservers are ns5.pmasteck.com and ns6.pmasteck.com. An SSL certificate with the R12 rating is present, and the web server returns an HTTP 200 response while delivering a page whose title reads “404 Not Found”. This mismatch is a common tactic used to obscure the true nature of the content while keeping the connection encrypted. VirusTotal analysis shows that four out of ninety‑five security vendors have flagged the domain, indicating a low but non‑zero level of detection consensus. The Gridinsoft trust score is 0 out of 100, reinforcing the suspicion that the site is malicious. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed. Intelligence categorizes the activity as a social media phishing campaign, suggesting that the site is likely used to harvest credentials from platforms such as Facebook, Instagram, or Twitter by presenting counterfeit login pages. Defenders should add coxwexprox.com to network deny lists and ensure that any outbound connections to the associated IP address are intercepted or logged. Because the site currently returns a 200 status code, standard content‑filtering signatures may miss it; therefore, URL‑based blocking that matches the exact domain name is recommended. Continuous monitoring of the hosting provider and nameserver infrastructure is advised, as adversaries frequently shift to new IP ranges or change registrar details. Analysts should also watch for related domains that share the same nameserver pattern or resolve to the same IP block, as they may be part of a broader phishing infrastructure.