This domain, toepox.com, was registered on July 11 2026 through the registrar Fewmoretaps OU d/b/a Trustname.com. The domain resolves to the Cloudflare‑owned address 172.67.131.64 and uses the Cloudflare authoritative name servers jose.ns.cloudflare.com and sue.ns.cloudflare.com. Threat intelligence indicates that the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed. A VirusTotal scan performed on the domain was processed by 91 antivirus and URL‑reputation engines; none of the engines returned a detection at the time of analysis.
The absence of detections does not constitute a safety guarantee, and the domain remains classified as a generic phishing site under investigation. The infrastructure suggests reliance on Cloudflare’s global edge network, which can obscure the true origin of the hosting environment. No additional public information such as page title, SSL certificate details, or Safe Browsing verdicts is currently available. Consequently, the confidence in the full scope of the campaign is limited.
Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the 172.67.131.64 address, and add the domain to internal blocklists. Ongoing observation of the PhishDestroy feed and periodic rescans on VirusTotal are recommended to capture any future changes in detection status. Organizations that have observed related phishing attempts should consider user education on the risks associated with newly registered domains and enforce multi‑factor authentication to mitigate credential harvesting.