spacexminestocks[.]xyz

This domain, spacexminestocks.xyz, is flagged as an active phishing infrastructure targeting users through a fraudulent currency trading platform. Registered on June 30, 2025, via UPPERLINK LIMITED, the domain resolves to IP address 198.38.92.102, hosted on AS51713 (WHG Hosting Services Ltd) in the United Kingdom. Analysis indicates the use of Nginx and OpenResty web technologies, with a Let's Encrypt SSL certificate (R12) deployed for HTTPS encryption. The page title, 'Te Currency Online - Homepage,' suggests an attempt to impersonate a financial or trading service, though no specific brand impersonation is confirmed from available data. The domain is currently active, returning an HTTP 302 redirect status, which may indicate dynamic routing to evade detection or direct users to malicious endpoints. Security vendors have flagged the domain, with 11 out of 95 detections on VirusTotal, and it appears on at least one security blocklist. Nameservers (ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com) are consistent with bulletproof hosting patterns observed in other phishing campaigns. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where financial or cryptocurrency-related services are accessed. The use of a 302 redirect and Let's Encrypt certificate suggests an attempt to appear legitimate while maintaining operational flexibility. Further investigation into associated IP ranges and nameserver infrastructure may reveal additional linked phishing domains. The exact content or functionality of the site remains unanalyzed, but the combination of financial-themed branding and active security detections warrants immediate mitigation.