spacecitytax[.]com

The domain spacecitytax.com has been identified as part of a generic phishing campaign. This domain does not appear to be targeting a specific brand directly, nor is there evidence of the use of a drainer kit. The page associated with this domain is titled 'Wellcome', suggesting a potentially low-effort attempt to mimic legitimate service communications.

Technical analysis reveals several indicators of malicious activity. The domain spacecitytax.com was created on January 17, 2025, and was registered through GoDaddy.com, LLC. Examination of the domain's reputation scores shows it has been flagged by 12 out of 95 security vendors on VirusTotal, emphasizing a significant level of threat detection among cybersecurity solutions. The domain resolves to the IP address 5.9.215.6, which is located in Germany under the network AS24940, operated by Hetzner Online GmbH. Additionally, this domain appears on two security blocklists, specifically blocked by PhishDestroy and PhishingDB, further confirming its nefarious purpose.

The current status of spacecitytax.com is offline, indicating that immediate threat levels might be reduced. However, the previous existence of this domain poses an elevated risk level due to potential cached copies and possible reactivation by malicious actors. Organizations and individuals are advised to ensure that email filters and web security defenses are updated to block similar domains and IP addresses proactively. Continuous monitoring of associated IPs and registrars for similar patterns of malicious activity is recommended to prevent future incidents. Furthermore, training employees and users to recognize phishing attempts remains a critical preventive measure.