spxpresale-cryptoslate[.]com

Analysis as of July 30 2026 indicates that the domain spxpresale-cryptoslate.com was registered on July 14 2026 through Ultahost, Inc. The authoritative nameservers are kareem.ns.cloudflare.com and kinsley.ns.cloudflare.com, and DNS resolution returns the IPv4 address 192.142.10.5. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, suggesting that it is being used for malicious activity. VirusTotal reports that the domain has been scanned by 91 AV engines, none of which have raised a detection at the time of analysis.

While the lack of detections does not confirm benign intent, it indicates that no known signatures have yet identified the payload. No public SSL/TLS certificate details, HTTP response codes, or page title information are currently available, limiting visibility into the service that is being hosted. The short age of the domain (registered only 16 days prior to this report) and the use of Cloudflare DNS are typical of rapidly deployed phishing campaigns.

Because the domain is classified as a generic phishing threat, defenders should continue to enforce existing URL filtering policies, add the domain to local deny lists, and monitor network traffic for connections to 192.142.10.5. Additional investigation, such as requesting a live page capture or analyzing any observed traffic, is recommended to confirm the phishing payload and to identify any associated command‑and‑control infrastructure. Until further evidence is gathered, the domain should be treated as malicious and blocked wherever possible.