Analysis of spx99x-cointelegraph.com shows a newly registered domain created on July 02, 2026 and currently active. The domain resolves to the IPv4 address 75.2.60.5 and is served through Cloudflare nameservers keira.ns.cloudflare.com and rayden.ns.cloudflare.com. Registration was performed via Ultahost, Inc., a provider often leveraged for fast‑turnaround registrations.
The domain has been added to a single security blocklist and is flagged by the PhishDestroy service, indicating that at least one external mitigation platform has identified it as malicious. VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the scans produced a detection, but the absence of a flag does not constitute a safety assurance. No additional data such as SSL certificate details, HTTP response codes, page titles, or brand targeting is currently available, leaving the exact phishing lure and payload unknown.
Defenders should treat the domain as a potential generic phishing infrastructure, enforce network‑level blocking of the domain and its resolving IP, and monitor DNS queries for related Cloudflare nameserver patterns. Adding the domain to local blocklists, enhancing email gateway heuristics for similar domain structures, and reviewing outbound traffic for connections to 75.2.60.5 are recommended immediate actions. Continuous re‑assessment is advised as further intelligence, such as page content or victim reports, becomes available.