spx49k-cointelegraph[.]com

Analysis conducted on July 21, 2026 identifies the newly registered domain spx49k-cointelegraph.com as part of an active generic phishing operation. The domain was created on July 19, 2026 and is hosted on the IP address 188.114.97.3. Its authoritative name servers are dayana.ns.cloudflare.com and sonny.ns.cloudflare.com, indicating the use of Cloudflare DNS infrastructure. Registration was performed through Ultahost, Inc., a registrar often seen in malicious registrations. The domain appears on a single security blocklist and is currently blocked by PhishDestroy, suggesting that at least one anti‑phishing feed has flagged it. VirusTotal records show that the domain was submitted to 95 scanning engines, none of which returned a detection; this absence of detections does not constitute evidence of benign behavior. No public SSL certificate details, HTTP response codes, Safe Browsing verdicts, or OTX references are presently available, limiting the visibility into transport‑layer security and broader threat‑intel correlation. Defenders should treat the domain as hostile, update perimeter controls to deny or quarantine traffic to 188.114.97.3, and add spx49k-cointelegraph.com to internal blocklists. Monitoring of DNS queries for the two Cloudflare name servers is advisable, as they may be used for rapid relocation of malicious payloads. Given the domain’s recent creation date and lack of publicly visible defensive signals, rapid response—such as sink‑holing or containment—will reduce exposure while additional intelligence is gathered.