spx40k[.]net

Analysis of the domain spx40k.net indicates it is currently under investigation for phishing activity as of August 05, 2026. The domain was registered on August 04, 2026, through SOLLUTIUM LLC, a registrar that has previously been associated with newly created domains used in phishing campaigns. Infrastructure analysis reveals the domain is hosted on Cloudflare nameservers (michael.ns.cloudflare.com and raphaela.ns.cloudflare.com) and resolves to the IP address 192.142.10.5. While Cloudflare is a legitimate service provider, its infrastructure is frequently leveraged by threat actors to obscure the origin of malicious domains and evade detection. The domain appears on one security blocklist, specifically PhishDestroy, which flags it as potentially malicious.

However, as of the most recent scan, 91 vendors on VirusTotal did not detect any malicious activity associated with spx40k.net. It is critical to note that the absence of detections does not confirm the domain is safe, particularly given its recent registration and presence on a blocklist. The exact nature of the phishing content hosted on this domain remains unconfirmed, as no specific brand target, scam type, or page title has been identified in available intelligence. Defenders are advised to treat this domain with caution.

Given its recent creation, Cloudflare hosting, and blocklist inclusion, it is prudent to monitor for further indicators of compromise or additional detections. Network-level blocking or alerting for connections to 192.142.10.5 and spx40k.net is recommended until the domain’s status is clarified. Organizations should also review logs for any interactions with this domain, particularly from endpoints that may have bypassed existing security controls. Further analysis, including sandboxing or manual inspection of the site’s content, is necessary to determine the specific threat posed by this infrastructure.