info-spx6900[.]live

This domain, info-spx6900.live, has been identified as an active credential theft operation targeting users of financial platforms. Analysis indicates the site employs realistic login interfaces to harvest usernames, passwords, and multi-factor authentication codes. While no specific brand impersonation has been confirmed, the infrastructure and content patterns align with known credential harvesting campaigns observed in recent months. The domain shows no direct association with cryptocurrency drainer kits or wallet interception scripts at this time. Infrastructure analysis reveals the domain was registered on June 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently utilized by threat actors for short-lived phishing domains. The site resolves to IP address 104.21.14.96, a Cloudflare-protected endpoint that obscures the true origin of the malicious content. As of the latest scan, the domain has received 0 detections out of 95 security engines on VirusTotal, indicating it remains undetected by most commercial security products. AlienVault OTX records the domain in a single threat intelligence pulse, suggesting limited but confirmed malicious activity. Google Safe Browsing currently lists the domain as unflagged, and no additional blocklist entries have been identified. Current status confirms the domain remains active and operational, serving credential theft content to unsuspecting visitors. No takedown actions have been observed, and the hosting infrastructure shows no signs of disruption. Users are advised to implement network-level blocking for the domain and associated IP address. Organizations should monitor for authentication attempts originating from this domain, particularly those targeting financial or corporate credentials. Given the domain's recent registration and low detection rate, continued evasion of security controls is likely until broader threat intelligence sharing occurs.