webtrixhq[.]com

Analysis of the domain webtrixhq.com reveals an active phishing campaign targeting users under the guise of 'Webtrix Digital.' The domain was registered on July 8, 2025, through Porkbun LLC, a registrar frequently utilized for both legitimate and malicious domains. Infrastructure analysis indicates the domain resolves to the IP address 63.250.43.147, hosted on AS22612 (Namecheap, Inc.) in the United States. The domain employs nameservers associated with Porkbun (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com), a configuration consistent with other recently observed phishing operations. The domain currently returns an HTTP 301 redirect, suggesting it may be funneling traffic to another malicious endpoint or preparing for a more sophisticated attack vector. While the exact content of the phishing site remains unanalyzed, the page title 'Webtrix Digital' implies an attempt to impersonate a digital services or technology provider. Two of ninety-five security vendors on VirusTotal have flagged the domain as malicious, and it appears on two security blocklists, including PhishDestroy and ScamSniffer, further corroborating its classification as a high-risk threat. MX records for the domain point to smtp.google.com with a priority of 0, an unusual configuration that may indicate an attempt to spoof email communications or facilitate credential harvesting via fraudulent login portals. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility and short validity periods. Defenders are advised to block the domain and its associated IP address (63.250.43.147) at the network level. Monitoring for outbound connections to this infrastructure, particularly from endpoints that handle sensitive credentials or financial data, is recommended.