spx90k[.]space

Analysis of spx90k.space shows a domain that was registered on August 01 2026 and is currently active. The name resolves to the IPv4 address 216.198.79.1 and is served from infrastructure associated with the registrar HOSTINGER operations, UAB. Public parking nameservers horizon.dns-parking.com and orbit.dns-parking.com are configured for the zone, a pattern frequently observed in disposable or quickly‑cycled malicious sites. The domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, providing independent confirmation that it is being used for malicious purposes. VirusTotal indicates that the URL was scanned by 91 different vendors; none of those engines reported a detection at the time of the scan. While the absence of detections does not prove the site is benign, it suggests that the payload or landing page may employ techniques not yet covered by existing signatures.

The available intelligence does not include SSL certificate details, HTTP status codes, page title, or any observed content, so the specific phishing lure, target brand, or credential‑collection method remains unidentified. Likewise, no information from Open Threat Exchange, OTX, or other reputation feeds is present, limiting the ability to correlate this domain with broader campaign activity. The short age of the domain, its placement on a blocklist, and the active block by PhishDestroy collectively support the generic phishing classification provided.

Defenders should treat spx90k.space as a high‑confidence phishing indicator. Immediate mitigation steps include adding the domain to network‑level deny lists, updating DNS‑filtering feeds, and ensuring endpoint URL‑reputation controls are aware of the indicator. Continuous monitoring of the IP address 216.198.79.1 for additional hostnames or related activity is advised, as attackers often reuse infrastructure across multiple campaigns.