spx19k-coinprwire[.]com

Analysis of the domain spx19k-coinprwire.com indicates an active high‑risk phishing operation. The domain was registered on August 5, 2026 through Ultahost, Inc. and resolves to the IPv4 address 188.114.96.3. DNS resolution is served by two Cloudflare nameservers, annalise.ns.cloudflare.com and donald.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure to provide redundancy and possibly to obscure the true hosting provider.

The domain appears on three external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intel feeds have identified it as malicious. VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation engines; none of the vendors raised a detection at the time of scanning, but the absence of a flag does not constitute proof of safety, especially given the corroborating blocklist evidence. No public page title, SSL certificate details, HTTP response codes, or trust‑score metrics are currently available, limiting the depth of surface‑web attribution.

The lack of a disclosed brand target or page content means that the specific impersonated entity cannot be confirmed at this stage. Defenders should continue to block the domain at network egress points, enforce DNS‑sink‑holing for the associated IP address, and monitor traffic to the Cloudflare nameservers for anomalous patterns. Ongoing observation of the domain’s activity on threat‑intel platforms and periodic re‑scanning with URL reputation services are recommended to capture any evolution of the payload or hosting changes.