Analysis of spx28d-coinpwire.com shows a newly registered domain (creation date July 28, 2026) that is actively serving a generic phishing campaign. The domain is registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is hosted on Cloudflare’s network as indicated by the authoritative nameservers amos.ns.cloudflare.com and celeste.ns.cloudflare.com. VirusTotal reports that the domain has been scanned by 91 vendors; at the time of review no vendor has raised a detection, but the absence of detections does not constitute a safety assurance.
The domain is already listed on two security blocklists, specifically PhishDestroy and SEAL, confirming that external threat‑intel sources consider it malicious. No additional intelligence such as Safe Browsing status, OTX entries, SSL certificate details, HTTP response codes, trust‑score metrics, page title, or evidence URLs is currently available, leaving the content and exact phishing vector unverified. Defenders should immediately add 188.114.96.3 and the domain spx28d-coinpwire.com to network‑level deny lists and URL filtering policies.
Monitoring of DNS queries for the domain and its associated Cloudflare nameservers is advised to detect any later‑stage activity. Given the recent registration date and blocklist inclusion, continuous re‑evaluation of the domain’s status is recommended, and any observed traffic should be logged for forensic analysis to support attribution and potential takedown efforts.