drenrixford[.]com

This domain, drenrixford.com, is currently identified as an active generic phishing site targeting financial service users. Analysis indicates the domain is designed to mimic legitimate banking or financial portals, potentially harvesting sensitive credentials such as login details, personal identification numbers, or payment information. The site remains operational and poses a high risk to unsuspecting visitors seeking financial services online. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on January 05, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with fraudulent registrations. It resolves to the IP address 163.61.188.7 and is secured with a Let's Encrypt SSL certificate, which while providing encryption, is commonly exploited by threat actors to lend false credibility. The domain appears on one security blocklist and is flagged in two AlienVault OTX threat intelligence pulses. Furthermore, five of ninety-five security vendors on VirusTotal have detected the domain as malicious, while Gridinsoft assigns it a trust score of 1 out of 100, indicating near-universal distrust in its legitimacy. As of the latest assessment, drenrixford.com remains active and continues to pose a significant threat. Users are strongly advised to avoid accessing this domain entirely. Organizations should implement immediate network-level blocking of both the domain and its associated IP address, 163.61.188.7. Financial institutions and security teams are recommended to monitor for credential submissions linked to this domain and issue alerts to customers regarding its fraudulent nature. Proactive measures, including DNS filtering and endpoint protection updates, are essential to mitigate exposure to this ongoing phishing campaign.