user[.]wexford-advisory[.]org

Analysis of user.wexford-advisory.org indicates that the domain was registered on 19 January 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on the IP address 188.114.96.3. The authoritative nameservers fay.ns.cloudflare.com and ruben.ns.cloudflare.com point to Cloudflare's DNS service, a common choice for fast‑flux and abuse infrastructure. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that security‑focused aggregators have flagged it as malicious.

A VirusTotal scan performed on the domain was submitted to 91 antivirus and URL‑reputation engines; none of the engines returned a detection at the time of analysis. While the absence of detections does not guarantee safety, it demonstrates that the domain has not yet been catalogued by the majority of commercial scanners. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or page‑title metadata is currently available, leaving the surface‑level behavior of the site unverified.

The combination of recent registration, Cloudflare DNS, presence on a phishing‑specific blocklist, and the generic phishing classification supplied by the reporting source suggests a high likelihood that the domain is being used to host credential‑harvesting or information‑stealing pages. Defenders should continue to block traffic to 188.114.96.3 and to the domain name itself at network perimeter devices, update intrusion‑detection signatures to include the domain, and monitor for any future detections from additional sandbox or URL‑reputation services. Because the site remains active, ongoing observation is recommended to capture any changes in hosting, content, or associated infrastructure.