coxee[.]webflow[.]io

On 2 August 2026, coxee.webflow.io was classified as a generic phishing site with an elevated risk level and remains active. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. VirusTotal scans reveal that 12 of 91 independent security vendors have flagged the domain as malicious, providing a modest but noteworthy detection ratio that suggests the presence of observable malicious behavior.

No registrar information, hosting IP address, SSL certificate details, HTTP status codes, or page title have been published in the current intelligence set, limiting the ability to construct a complete infrastructure profile. The use of the Webflow.io subdomain indicates reliance on a legitimate website‑building platform, a tactic that can obscure the true hosting environment and complicate attribution. Defenders are advised to add coxee.webflow.io to URL filtering, DNS sinkhole, and proxy blocklists, and to generate alerts for any outbound traffic targeting the domain.

Monitoring should include periodic re‑scans with VirusTotal or equivalent services to capture any changes in vendor detection counts, as well as continuous observation of Webflow‑related hosting ranges for potential expansion of the campaign. Given the active blocklist entry and the existing vendor detections, proactive containment and ongoing intelligence gathering are recommended to mitigate exposure to this phishing infrastructure.