spx99x-fxempire[.]com

The domain spx99x-fxempire.com was registered on July 02, 2026 through Ultahost, Inc. and is currently resolving to the IPv4 address 75.2.60.5. The authoritative name servers are keira.ns.cloudflare.com and rayden.ns.cloudflare.com, indicating the use of Cloudflare DNS services. Automated scanning on VirusTotal shows that the domain has been examined by 91 antivirus and URL‑reputation engines; at the time of analysis no engine reported a detection. The same domain appears on a single public blocklist and has been flagged by the PhishDestroy feed, confirming that at least one security provider has observed malicious use.

The domain remains active as of the report date, July 30, 2026, and no evidence of takedown or sink‑hole redirection has been observed. Available intelligence does not include a Safe Browsing verdict, Open Threat Exchange (OTX) indicators, SSL certificate details, HTTP response codes, trust‑score metrics, or the page title returned by the web server. Consequently, the presence or absence of HTTPS, the content served, and any additional host‑based indicators cannot be confirmed at this time. The lack of detections on VirusTotal should not be interpreted as an indication of benign behavior; many phishing infrastructures evade static analysis and rely on dynamic payload delivery.

Analysts should continue to monitor the IP address 75.2.60.5 for any changes in reputation and watch for new sightings of the domain in phishing‑related blocklists or threat‑intel feeds. Network defenders are advised to block DNS resolution to spx99x-fxempire.com, add the IP to outbound traffic deny lists, and instrument proxy logs for any HTTP requests to the domain. Additional investigation, such as retrieving the page title, examining SSL certificates, and performing active probing, will be required to fully characterize the malicious payload and confirm the phishing kit employed.