# PhishDestroy threat dossier — spx88k.org ================================================================ Fetched: 2026-07-23 02:16:22 UTC Canonical: https://phishdestroy.io/domain/spx88k.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Fake Airdrop Phishing kit: Token Presale ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 75.2.60.5 (US, Seattle) ASN: AS16509 Amazon.com, Inc. Hosting org: AWS Global Accelerator (GLOBAL) Registrar: Ultahost, Inc. Nameservers: delilah.ns.cloudflare.com, mark.ns.cloudflare.com Registered: 2026-07-06 Expires: 2027-07-06 Page title: The SPX88K Token Official Token Presale Is Live HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-10-05 Status: INVALID chain Fingerprint: 877178d85ebad249e017caeaf78871e21ccfe49a88e82b79fe9179bd1cf2e51d Subject Alternative Names (related infrastructure — often same operator): - www.spx88k.org ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-08 03:39:21 UTC (by PhishDestroy tracker) Last verified: 2026-07-23 04:05:49 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f3f60-4d11-7508-a282-38f58e2248d2/ URLQuery: https://urlquery.net/report/9ae4e6f1-8062-4542-9b3c-89445e01117e Wayback Machine: https://web.archive.org/web/*/spx88k.org crt.sh CT logs: https://crt.sh/?q=%25.spx88k.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=spx88k.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/spx88k.org URLhaus: https://urlhaus.abuse.ch/host/spx88k.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-08 03:44:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] spx88k.org Fake SPX88K Token Presale Crypto Scam Alert This domain, spx88k.org, is flagged as an active crypto drainer operation targeting users of the SPX88K token presale. Analysis indicates the site is designed to deceive visitors into connecting cryptocurrency wallets to malicious smart contracts, enabling unauthorized fund transfers. The domain remains operational as of the latest verification, with no prior compromise of user funds reported yet. Infrastructure analysis reveals the domain was registered on July 06, 2026, through Ultahost, Inc., and currently resolves to the IP address 75.2.60.5. No detections were recorded by any of the 95 VirusTotal vendors, and no blocklist entries or trust score downgrades have been observed. The site employs a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy while lacking substantive security validations. The page title, 'The SPX88K Token Official Token Presale Is Live,' explicitly mimics promotional language used in legitimate token sales, increasing the likelihood of successful social engineering. Current risk assessment categorizes this domain as high-potential for financial loss due to its targeted crypto drainer functionality and absence of prior detection. Users are advised to avoid interacting with spx88k.org or any associated links. Wallet providers and security teams should prioritize monitoring for connections to this domain or its IP address, particularly in transactions involving SPX88K or similarly named tokens. Immediate reporting to relevant cryptocurrency platforms and domain registrars is recommended to facilitate takedown procedures. Network administrators should consider blocking the IP 75.2.60.5 and implementing DNS-based restrictions to prevent internal access. [Updates since narrative was generated:] - Public blocklists: now listed on 1 feed ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 877178d85ebad249e017caeaf78871e21ccfe49a88e82b79fe9179bd1cf2e51d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/spx88k.org/ JSON API: https://api.destroy.tools/v1/check?domain=spx88k.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,589 domains (58,686 alive under monitoring, 128,278 confirmed takedowns/dead). Site: https://phishdestroy.io