This domain, spx55k-coinpwire.com, was registered through Ultahost, Inc. on July 09, 2026 and is currently resolving to the IP address 104.21.83.209. The authoritative name servers are martin.ns.cloudflare.com and thea.ns.cloudflare.com, indicating Cloudflare DNS hosting. Threat intelligence sources have classified the site as a high-risk generic phishing operation. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that defensive feeds are already ingesting the indicator.
VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain as malicious, providing early corroboration of its malicious intent. No additional public scans or Safe Browsing verdicts are presently available, and the page title and SSL certificate details have not been disclosed. The limited detection coverage suggests that the infrastructure may be newly deployed, consistent with the recent creation date. Analysis indicates that the primary risk vector is credential harvesting, typical of generic phishing campaigns.
Defenders should add the domain and its resolving IP address to blocklists, monitor DNS queries for the two Cloudflare name servers, and ensure that any outbound connections to 104.21.83.209 are denied or logged for further investigation. Continuous re‑query of VirusTotal and other reputation services is recommended, as additional vendor detections may emerge. Organizations using email filters should also update phishing signatures to include this indicator. Until further evidence such as page content or SSL fingerprints becomes available, the domain should be treated as active and high-severity.