trivexus-wealth[.]biz

Analysis of trivexus-wealth.biz indicates an active credential harvesting phishing domain registered on November 24, 2025, through Global Domain Group LLC. The domain resolves to IP address 65.98.127.26 and uses nameservers cloud1.listedhosting.net, cloud2.listedhosting.net, and cloud3.listedhosting.net, suggesting shared hosting infrastructure commonly exploited for phishing operations. As of July 27, 2026, the domain remains active and is flagged by 15 of 91 security vendors on VirusTotal, reflecting moderate but concerning detection coverage. It appears on at least one security blocklist and is actively blocked by PhishDestroy, confirming its malicious classification in operational threat feeds. Infrastructure analysis reveals no association with known content delivery networks or enterprise hosting providers, increasing the likelihood of low-cost, high-turnover hosting typical of phishing campaigns.

The domain's creation date, less than eight months prior to the report, aligns with patterns observed in short-lived phishing sites designed to evade detection and takedown efforts. No brand target or specific scam type has been confirmed in available metadata; thus, the exact content of the site remains unanalysed. However, the domain name suggests a financial or investment-themed lure, a common tactic in credential harvesting schemes.

Defenders are advised to treat trivexus-wealth.biz as high-risk and implement blocking at the DNS, IP, and URL levels. Network security teams should monitor for connections to 65.98.127.26 and review logs for any interaction with the domain, particularly in sectors handling sensitive financial or personal data. Given the domain's active status and detection by multiple security vendors, prompt remediation is recommended to mitigate potential exposure.