trixauvexnet[.]ink

Analysis of trixauvexnet.ink shows a newly registered domain (June 13, 2026) that is currently active and serving a placeholder page titled “Trixauvex — Coming Soon”. The site resolves to IP 216.198.79.1, located in the United States, and returns an HTTP 307 redirect response. The TLS certificate is issued by Let’s Encrypt (R12), and the host stack reports Vercel with HTTP Strict Transport Security enabled. The domain was registered through NameCheap, Inc. and is associated with the alias “Lefkoff Industries” in the IP geolocation data. Threat intelligence indicates the site is being used for an investment‑type generic phishing campaign; AlienVault OTX references the domain in four separate pulses, and PhishDestroy has already added it to its blocklist. Gridinsoft assigns a trust score of 0 out of 100, and 17 of 91 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on one additional security blocklist. While the exact content of the landing page has not been examined, the combination of a fresh registration, low trust score, multiple vendor detections, and inclusion in several threat feeds strongly suggests a high‑risk investment scam infrastructure. Defenders should block network traffic to both the domain and its resolving IP, monitor DNS queries for look‑alikes, and add the indicator to internal blocklists. Ongoing collection of payloads and URL paths is recommended to confirm the phishing vector and to update detection signatures.