spax40b-fxempire[.]com

Analysis indicates that spax40b-fxempire.com is an active phishing domain targeting cryptocurrency users through a fraudulent token presale scheme. The domain was registered on April 20, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 172.67.140.15, hosted behind Cloudflare infrastructure in Canada. The page title, 'SPAX40B Token — AI-Blockchain Presale Gaining Momentum | FXEmpire,' suggests an attempt to impersonate or leverage the reputation of a financial media brand to promote a fake airdrop or presale, aligning with the classified scam type of 'Fake Airdrop.' Technical indicators reveal the use of Cloudflare services, including nameservers armfazh.ns.cloudflare.com and blair.ns.cloudflare.com, as well as Cloudflare Browser Insights and HTTP/3. Google Tag Manager is also detected, which may be employed for tracking or analytics purposes. The domain holds a valid SSL certificate issued by Google Trust Services (WE1), a common tactic to appear legitimate. As of July 12, 2026, the domain returns an HTTP 200 status, confirming it is operational and accessible. Security vendors have flagged the domain, with 3 out of 94 detections on VirusTotal, and it appears on at least one security blocklist. AlienVault OTX has also recorded the domain in a threat intelligence pulse, further corroborating its malicious classification. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment. Defenders should treat this domain as a confirmed phishing threat. Network-level blocking of the IP 172.67.140.15 and domain spax40b-fxempire.com is recommended. Organizations should monitor for connections to this domain or associated infrastructure and investigate any user interactions, particularly in relation to cryptocurrency transactions or credential input. The exact content and functionality of the site remain unanalyzed, but the available indicators align with known fake airdrop and presale scams targeting crypto investors.