spx88k-fxempire[.]com

Analysis of spx88k-fxempire.com shows a newly registered domain (creation date July 06 2026) that resolves to the Cloudflare‑fronted address 104.21.58.140. The domain is delegated to the Cloudflare name servers delilah.ns.cloudflare.com and mark.ns.cloudflare.com, indicating that the operator is leveraging Cloudflare’s CDN and DNS protection services to obscure the true hosting location. Registration was performed through Ultahost, Inc., a registrar that frequently appears in bulk‑registration campaigns.

The domain has been added to a single security blocklist and is currently flagged by the PhishDestroy feed, confirming that at least one external sinkhole has identified it as malicious. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation engines; none of the vendors reported a detection at the time of the scan, but the absence of detections does not constitute a safety assurance. No public evidence of SSL certificate details, HTTP response codes, page title, or content analysis is present in the available intelligence, leaving those vectors unverified.

The lack of additional blocklist entries or reputation scores suggests limited exposure, yet the domain’s recent registration, Cloudflare infrastructure, and inclusion on a phishing‑specific blocklist collectively point to a likely phishing operation. Defenders should block DNS resolution to 104.21.58.140 for the domain, add spx88k-fxempire.com to web‑filter deny lists, monitor outbound traffic for connections to the associated Cloudflare edge IPs, and continue to gather page‑level artifacts should the site become reachable. Ongoing observation is recommended to capture any future changes in detection vendor scores, blocklist status, or content that could clarify the threat’s intent.