spax88k[.]net

Analysis of spax88k.net shows an active infrastructure used for a fake airdrop campaign. The domain was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 216.198.79.1, which is geolocated to the United States and associated with Lefkoff Industries. The site is served over HTTPS with a Let’s Encrypt R12 certificate and uses Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com). HTTP requests receive a 307 redirect, and the page title advertises a "SPAX88K Token — AI-Powered Crypto Presale | Up to 200% Early Bonus," matching the reported fake airdrop scam type. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Reputation scoring from Gridinsoft is 0/100, and AlienVault OTX references the domain in one threat pulse. While the site currently shows no detections from the 92 vendors that have scanned it on VirusTotal, the lack of detections does not confirm safety. Uncertainties remain regarding the full payload, user‑interaction flow, and any additional command‑and‑control infrastructure. Defenders should block the domain and its resolving IP at perimeter devices, monitor DNS queries for the Vercel name servers, and enforce email filtering rules that detect the "SPAX88K Token" branding. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.