What causes this notification. "sync.1rx.io/usersync/bidswitch/0


My wife keeps  getting this notification about a phishing attempt "sync.1rx.io/usersync/bidswitch/0 " 


Is there a way to find out where the attempt is coming from so she can avoid the web site?