spax40r-fxempire[.]com

The domain spax40r-fxempire.com has been identified with the threat type of generic_phishing and is currently under investigation with its status marked as offline. The domain appears to impersonate the brand FXEmpire, as indicated by the page title 'SPAX40R Token — AI-Blockchain Presale Gaining Momentum | FXEmpire'. This suggests potential deceptive practices aimed at misleading users into thinking they are interacting with or investing in a legitimate financial service.

The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on May 25, 2026. It is not yet flagged by any of the 95 vendors on VirusTotal, indicating it might be a new or lesser-known threat. The domain resolves to the IP address 216.198.79.1 and is currently included on one security blocklist. The SSL certificate is issued by Let's Encrypt, denoted as R12, which is a common practice for websites to encrypt traffic; however, this does not guarantee legitimacy. The lack of detection by VirusTotal suggests the domain might be in the early stages of malicious activity or is cleverly avoiding detection.

Given its offline status, the immediate threat is reduced; however, caution is advised. Users are recommended to monitor for any further updates or changes in the status of this domain. Security teams should continue to track its inclusion in blocklists and any changes in threat intelligence sources. It is advisable to avoid interacting with or disseminating this domain until more information is available and verified through trusted channels. Enhanced vigilance and network security measures should be considered to mitigate any potential risks from similar domains or threats.