trevixprimeservices[.]com

This domain, trevixprimeservices.com, operates as a credential theft platform designed to harvest user login credentials through fraudulent financial service portals. The site presents itself under the title 'TrevixPrime-Service,' employing deceptive branding to trick visitors into submitting sensitive account information. Analysis indicates the infrastructure is optimized for credential capture, with technologies such as jQuery and Bootstrap facilitating dynamic form submissions and responsive design to enhance authenticity. The domain does not exhibit overt cryptocurrency drainer functionality but focuses on traditional credential theft, likely targeting banking or investment account access. Evidence supporting the malicious classification includes detection by 6 out of 95 security vendors on VirusTotal, alongside its presence on one security blocklist. The domain was registered through Dynadot Inc on June 01, 2026, an unusually future-dated creation that may indicate an attempt to evade age-based reputation filters. It resolves to the IP address 163.61.188.5 and employs a Let's Encrypt SSL certificate to simulate legitimacy. Additional technical indicators include the use of LiteSpeed, HTTP/3, and libraries like Select2 and FancyBox, which are consistent with phishing kit deployments designed to mimic legitimate service interfaces. Users who visited trevixprimeservices.com should immediately revoke any credentials entered on the site, particularly those tied to financial or email accounts. Monitor associated accounts for unauthorized transactions or login attempts, and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (163.61.188.5) at the perimeter, and review logs for connections to this address. If browser sessions were active during the visit, clear cached data and run a full antivirus scan to detect potential secondary payloads or tracking scripts.