spx10k-coinprwire[.]com

Analysis as of July 31, 2026 indicates that the domain spx10k-coinprwire.com was registered on July 28, 2026 through Ultahost, Inc. The domain resolves to the IPv4 address 192.142.10.5 and is served by Cloudflare nameservers dale.ns.cloudflare.com and savanna.ns.cloudflare.com. The short registration window and the use of a reputable DNS provider are consistent with infrastructure patterns observed in recent phishing campaigns. The domain is currently listed on two public security blocklists and has been actively blocked by the PhishDestroy and SEAL sinkhole feeds, confirming that threat‑intelligence sources consider it malicious.

A VirusTotal scan performed by 91 AV vendors returned no detections; however, the lack of a flag does not imply the site is benign, especially given the corroborating blocklist and sinkhole evidence. No additional metadata such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are publicly available, leaving the exact content and targeted brand of the site unknown. The combination of a newly‑created domain, a single IP address, and active blocklist entries suggests an infrastructure that is still being leveraged for credential‑harvesting or fraudulent activities.

Defenders should add spx10k-coinprwire.com to URL filtering rules, monitor DNS queries for the domain and its associated IP, and consider network‑level blocking. Continuous re‑evaluation is advised, as the domain remains active and could be employed in future phishing attempts.