spx33k-cryptoslate[.]com

Analysis of spx33k-cryptoslate.com shows the domain was registered on August 05, 2026 through Ultahost, Inc. and is served by Cloudflare nameservers arvind.ns.cloudflare.com and iris.ns.cloudflare.com. DNS resolution points to the IP address 172.67.139.166, a host commonly used for content delivery and also observed in other malicious campaigns. The domain appears on three external security blocklists and is presently blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intelligence feeds have identified it as a phishing vector. VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation engines, none of which raised a detection at the time of scanning; this lack of detection does not imply benign behavior and should be interpreted as a potential gap in current signatures.

The threat classification supplied is “generic phishing” with a high risk rating, and the operational status is listed as active. No public SSL certificate details, HTTP response codes, page title, or content snapshots are available in the current intelligence set, leaving the exact phishing lure and targeted brand undefined. Consequently, defenders cannot confirm the specific credential‑harvesting technique or victim profile.

The presence of Cloudflare infrastructure and rapid domain creation suggests a short‑lived, throwaway deployment designed to evade attribution. Given the high‑risk label, the confirmed blocklist entries, and the active status, security teams should enforce network‑level denial of the domain, add it to internal URL filtering lists, and monitor outbound connections to the associated IP address for any anomalous traffic. Continuous re‑scanning with multi‑engine services is recommended to capture any future malicious payloads that may be associated with the domain.