spx40k[.]com

spx40k.com has been confirmed as a high-risk phishing domain based on several technical indicators and security vendor detections. The domain was registered on August 04, 2026, through Internet Domain Service BS Corp., a registrar frequently associated with rapid domain provisioning used in abuse campaigns. Current DNS resolution points to IP address 192.142.10.5, and nameserver hosting is provided by Cloudflare via michael.ns.cloudflare.com and raphaela.ns.cloudflare.com, a common setup for sites attempting to mask their infrastructure origins.

Security analysis reveals that 2 out of 91 antivirus engines on VirusTotal currently flag the domain as malicious. Additionally, the domain is actively blocked by PhishDestroy and appears on at least one other security blocklist, confirming actionable intelligence of its use in phishing operations. No additional brand targeting, specific scam kit, or web content details have been identified at this time, so the precise nature of the phishing content hosted on this site remains unknown.

Given the domain's immediate appearance on security blocklists within 24 hours of its registration and its ongoing active status, defenders should treat access to this domain as high risk. Organizations are strongly advised to update network blocklists to include spx40k.com and monitor for any related network or email-based traffic. Security teams should also consider the potential for continued infrastructure changes, given the use of Cloudflare services which are frequently leveraged by threat actors to obfuscate origin servers. Ongoing monitoring for further detection updates and any evidence of brand targeting or kit deployment is also recommended. As of this report, the domain remains active and poses an ongoing threat.