croxy[.]com

Analysis of croxy.com indicates that the domain was registered on 16 September 2007 through GoDaddy Online Services Cayman Islands Ltd. The authoritative nameservers are adaline.ns.cloudflare.com and austin.ns.cloudflare.com, and the domain currently resolves to the IP address 104.21.22.88, which is hosted by Cloudflare. The domain is listed as active and has been reported to PhishDestroy, which has placed it on one security blocklist. VirusTotal records show that the site was scanned by 91 antivirus and URL‑reputation vendors, none of which returned a detection at the time of the scan; this lack of detections does not imply safety.

No public information about the site’s SSL certificate, HTTP response codes, page title, or content has been disclosed, so the specific phishing lure and any credential‑harvesting pages remain unverified. The absence of additional blocklist entries and the single listing suggest limited exposure, but the presence of a Cloudflare‑fronted IP means the infrastructure can be leveraged to hide malicious payloads. Defenders should add croxy.com and its resolving IP 104.21.22.88 to network‑level deny lists and DNS filtering policies, monitor outbound connections for TLS handshakes to that address, and correlate any login attempts to corporate services with traffic to the domain.

Because the domain is still active, continuous re‑evaluation is advised; periodic re‑scans on VirusTotal or similar platforms may reveal new detections. Organizations employing email security gateways should treat any messages containing links to croxy.com as malicious and quarantine them. Finally, threat‑intel teams should track any future changes to the domain’s registration, nameserver configuration, or hosting provider, as such modifications often precede campaign escalation.