spx80k[.]icu

Analysis of spx80k.icu indicates that the domain was registered on July 21 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are gordon.ns.cloudflare.com and heidi.ns.cloudflare.com, and the domain resolves to the IP address 188.114.97.3, a Cloudflare‑owned host that is commonly leveraged for fast‑flux and proxy services. The domain appears on a single security blocklist and is currently blocked by the PhishDestroy feed, confirming that at least one external mitigation platform has observed malicious activity associated with it. VirusTotal records show that the domain was submitted to 95 scanning engines, none of which raised a detection at the time of analysis; the absence of a detection does not constitute evidence of benign behavior.

The domain is still active as of the report date, July 22 2026, and no public HTTP response codes, SSL certificate details, or page‑title information are available in the supplied intelligence. Consequently, the exact content served by the site, including any credential‑collection pages or brand impersonation, remains unverified. The infrastructure profile—recent creation, Cloudflare front‑end, and immediate inclusion on a phishing blocklist—matches patterns observed in short‑lived phishing campaigns that rely on reputable CDN providers to gain trust and evade simple IP‑based blocking. Defenders should therefore treat spx80k.icu as a high‑confidence indicator of a potential phishing operation, even though the specific target brand is not disclosed.

Recommended mitigation steps include adding the domain to outbound web‑filter deny lists, monitoring DNS queries for the domain and its associated name servers, and correlating any authentication attempts that originate from the IP 188.114.97.3 with user activity logs. Continuous re‑scanning on VirusTotal or similar platforms is advisable to capture any future detections.