profx[.]io

Analysis of profx.io, observed as active as of July 27 2026, indicates that the domain is associated with a generic phishing campaign. The domain was registered on September 09 2020 through One.com A/S and continues to resolve to the IPv4 address 147.79.103.91. DNS resolution is delegated to ns1.dns-parking.com and ns2.dns-parking.com, which are typical parking name servers and do not provide insights into the underlying hosting environment. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed has flagged it.

VirusTotal reports that eight of ninety‑one scanned security vendors have generated detections for the domain, reinforcing the suspicion of malicious use. No additional public reputation services, such as Safe Browsing or Open Threat Exchange, are cited in the available intelligence, and no SSL certificate details, HTTP response codes, or page title information have been disclosed. Consequently, the current evidence base consists primarily of registration data, DNS configuration, blocklist presence, and limited vendor detections. Uncertainty remains regarding the specific payload or credential‑harvesting techniques employed, as the site content has not been captured or analysed.

The lack of observed SSL parameters and HTTP status prevents assessment of transport‑layer security or potential redirection behavior. Defenders should therefore treat any traffic to profx.io as hostile. Recommended mitigations include adding the domain to local deny lists, updating proxy and firewall rules to block outbound connections, and ensuring endpoint protection solutions ingest the eight VirusTotal detections. Continuous monitoring of the IP address 147.79.103.91 for anomalous activity is advised, as is periodic re‑query of threat‑intel feeds for any new classifications or increased blocklist presence.