spxpresale-fxempire[.]com

The domain spxpresale-fxempire.com was registered on July 14, 2026 through Ultahost, Inc. and resolves to the IPv4 address 192.142.10.5. The authoritative nameservers are kareem.ns.cloudflare.com and kinsley.ns.cloudflare.com, indicating Cloudflare DNS services are in use. The domain remains active as of the report date (July 30, 2026) and is listed on a single security blocklist, with PhishDestroy already blocking it. VirusTotal records show that the domain has been scanned by 91 anti‑malware engines, none of which currently raise a detection; this absence of flags does not constitute confirmation of benign intent.

No public SSL certificate details, HTTP response codes, or page title information are available at this time, limiting the ability to assess the surface‑level behavior of the site. The lack of a recorded Safe Browsing or OTX entry suggests that the domain has not yet been catalogued by those feeds, but defenders should treat the presence on a phishing‑specific blocklist as an indicator of malicious use. Given the recent creation date, the use of Cloudflare DNS, and the single‑blocklist listing, the infrastructure appears consistent with fast‑flux or short‑lived phishing campaigns.

Defensive recommendations include adding spxpresale-fxempire.com and its IP address 192.142.10.5 to inbound and outbound URL filtering rules, monitoring DNS queries for the associated nameservers, and initiating deeper content analysis if the site becomes reachable. Organizations employing email security gateways should continue to flag messages containing this domain as suspicious, and incident response teams should collect any related phishing emails for forensic correlation. Ongoing observation of threat‑intel feeds for new detections or reputation changes is advised, as the current evidence is limited but sufficient to warrant precautionary blocking.