spcxon-ondo-finance[.]com

Analysis of spcxon-ondo-finance.com shows a high‑risk phishing infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on June 12, 2026 through the registrar Gransy, s.r.o., and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The site employed Cloudflare services, as evidenced by the presence of Cloudflare Browser Insights, Cloudflare headers, and HTTP/3 support. DNS resolution used the Cloudflare nameservers eloise.ns.cloudflare.com and guss.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the WE1 root was observed, confirming the use of a valid TLS layer despite the malicious intent.

The page title returned by the server was "SPCXon Token Price & Chart," suggesting an attempt to lure victims interested in cryptocurrency pricing. Threat intelligence sources corroborate the malicious nature: AlienVault OTX listed the domain in three separate pulses, and VirusTotal recorded detections by 11 of 91 security vendors. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on three security blocklists. Additional blocking actions were taken by PhishDestroy, MetaMask, and SEAL.

While the site is currently offline, the combination of recent registration, low trust score, multiple vendor detections, and inclusion on blocklists indicates a deliberate phishing campaign targeting cryptocurrency users. Uncertainty remains regarding the exact content served before takedown, as no visual analysis is available. Defenders should continue to block the domain at network perimeters, update URL filtering and threat intelligence feeds, and monitor the associated IP range for any re‑use of the infrastructure. Continuous observation of Cloudflare‑hosted assets linked to this IP is recommended to detect potential re‑deployment of phishing pages.