spax-official[.]icu

spax-official.icu was registered on 23 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to 104.21.77.31, a Cloudflare edge node located in Canada, and is served over TLS with a certificate issued by Google Trust Services (WE1). HTTP requests return status 200. Intelligence sources list the domain on a single security blocklist and in one AlienVault OTX pulse. VirusTotal records a single positive detection out of 94 scanning engines, and Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of malicious intent. The listed scam type is credential phishing, and the risk level is marked high; the domain remains active as of 12 July 2026. The use of Cloudflare and generic nameservers (gordon.ns.cloudflare.com, heidi.ns.cloudflare.com) is consistent with infrastructure employed by phishing campaigns to obscure hosting details. No public content analysis is available, so the exact phishing payload or target brand cannot be confirmed. Defenders should add spax‑official.icu to URL filtering and DNS block lists, monitor for any resolution to the Cloudflare IP, and enforce credential‑validation controls to mitigate potential credential harvesting. Continuous re‑evaluation is advised as additional detections may emerge.