spx21k-cryptoslate[.]com

Analysis of spx21k-cryptoslate.com shows a newly registered domain (creation date July 15, 2026) that is actively serving a generic phishing campaign. The domain is registered through Ultahost, Inc. and uses Cloudflare name servers (dayana.ns.cloudflare.com, sonny.ns.cloudflare.com). DNS resolution points to the IP address 104.21.12.43, which is currently hosted on a Cloudflare network. Threat intelligence platforms have flagged the domain as high‑risk; one of ninety‑five security vendors on VirusTotal reports a detection, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, indicating that at least one protective service considers it malicious. The domain’s current status is listed as active, confirming that the phishing infrastructure remains online. No additional data such as SSL certificate details, HTTP response codes, page title, or content analysis is available, leaving the exact phishing payload and target brand unconfirmed. Defenders should treat spx21k-cryptoslate.com as a confirmed phishing indicator and enforce blocking at network perimeter and endpoint layers. Monitoring of DNS queries for the associated IP and name servers is advised, as well as periodic re‑scanning to capture any changes in payload or additional detections. Organizations should also update internal URL filtering policies to include the domain and consider sharing the indicator with threat‑sharing communities to broaden collective protection.