cotrixauvex[.]ink

Analysis of the domain cotrixauvex.ink indicates an active phishing campaign targeting user credentials through deceptive login interfaces. The domain was registered on May 4, 2026, via NameCheap, Inc., a registrar frequently associated with newly created phishing infrastructure. As of July 29, 2026, the domain remains operational and has been flagged by 17 of 91 security vendors on VirusTotal, suggesting moderate detection coverage. Additionally, it appears on one security blocklist, specifically PhishDestroy, which categorizes it as a phishing threat.

Infrastructure analysis reveals no confirmed hosting provider or autonomous system number at this stage, limiting attribution to specific threat actors or bulletproof hosting services. The absence of further blocklist entries or Safe Browsing alerts does not imply safety, as phishing domains often evade detection during initial deployment phases. The exact content and targeted brand of the phishing site are not yet analyzed; however, the detection pattern aligns with credential-harvesting campaigns. Defenders are advised to treat cotrixauvex.ink as an elevated-risk domain.

Network-level blocking is recommended, particularly for organizations with users susceptible to credential theft. Security teams should monitor for connections to this domain in proxy logs and endpoint telemetry, as its recent registration and detection history indicate a likely ongoing threat. Further analysis of HTTP headers, SSL certificates, and page content may provide additional indicators of compromise, though such data is not currently available in public threat feeds.