spax30t[.]net

spax30t.net is identified as a high‑risk investment‑phishing site. The domain was registered on May 09 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. Its authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, and the site presents a valid TLS certificate issued by Let’s Encrypt (R13). Network analysis shows the domain resolves to IP 216.198.79.65, an address allocated to Cypress Communications, LLC in the United States. HTTP requests return status 200, indicating a live web service. The site is listed on the PhishDestroy blocklist and appears in a single AlienVault OTX pulse, confirming at least one external detection. The landing page is titled “SPAX30T Token — AI‑Powered Crypto Presale | Up to 200% Early Bonus”, a classic lure for crypto investment scams. VirusTotal has flagged the domain in one of ninety‑five scans, and Gridinsoft assigns a trust score of 0 / 100, reflecting a poor reputation across available heuristics. Evidence is limited to the data points above; no additional malware payloads, command‑and‑control infrastructure, or phishing credential harvesters have been observed. The reliance on Vercel DNS and a Let’s Encrypt certificate suggests the operators are leveraging legitimate cloud services to mask malicious intent, a pattern common in recent phishing campaigns. Defenders should deny outbound connections to 216.198.79.65, add spax30t.net to URL filtering and email security policies, and monitor for similar domains registered by NICENIC INTERNATIONAL GROUP CO., LIMITED. Continuous threat‑intel feeds should be consulted for any new detections, and incident response teams should treat any user‑submitted credentials related to the “SPAX30T Token” presale as compromised.