spx33k-coinprwire[.]com

Analysis of spx33k-coinprwire.com indicates an active, high‑risk phishing infrastructure. The domain was registered on August 05, 2026 through Ultahost, Inc. and is currently delegated to arvind.ns.cloudflare.com and iris.ns.cloudflare.com, suggesting the use of Cloudflare's DNS service. DNS resolution points to the IP address 188.114.96.3, an address owned by Cloudflare, a common hosting choice for malicious actors seeking anonymity and rapid deployment.

The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that defensive products have identified it as malicious. VirusTotal has processed the domain with 91 vendor engines, yet none have raised a detection; this absence of detections is not evidence of benign behavior and may reflect the limited exposure time of the site. The short lifespan—registered only two days prior to the report date—combined with the high‑risk classification underscores a rapid‑launch phishing campaign targeting users who may be lured by the "coinprwire" substring, a pattern often associated with cryptocurrency‑related scams.

Defenders should immediately add spx33k-coinprwire.com to URL filtering and firewall deny lists, monitor DNS queries for the domain and its associated Cloudflare nameservers, and enforce strict outbound traffic controls to the resolving IP. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise linked to this infrastructure, and incident response teams should be prepared to investigate any user interactions or credential submissions that may have occurred before the blocklists were updated.