spax28p[.]com

This domain, spax28p.com, is flagged as a generic phishing site targeting cryptocurrency investors under the guise of a token presale. The page title, 'SPAX28P Token Presale — Up to 200% Early Access Bonus | AI-Powered Crypto,' suggests an attempt to lure victims with unrealistic financial incentives, a common tactic in fraudulent investment schemes. No legitimate brand association or known drainer kit signature has been identified, though the use of particles.js and Cloudflare may indicate an effort to mimic professional crypto project infrastructure while obscuring malicious intent. Analysis indicates spax28p.com was registered on May 13, 2026, through NameSilo, LLC, a registrar frequently exploited for short-lived phishing domains. The domain resolves to IP address 188.114.96.3, a Cloudflare-protected endpoint, and employs HTTP/3 for performance optimization. It holds a Gridinsoft trust score of 0/100 and appears on one security blocklist, with four out of ninety-five security vendors on VirusTotal flagging it as malicious. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and fraudulent sites due to its free and automated issuance process. Currently, spax28p.com is offline, likely taken down following detection by PhishDestroy or similar monitoring systems. Despite its inactive status, the domain remains a residual risk due to potential re-activation or migration to a new infrastructure. Users who interacted with the site should assume credential or wallet compromise and take immediate action, including revoking token approvals, rotating passwords, and monitoring for unauthorized transactions. The elevated risk level is justified by the domain’s targeted deception of cryptocurrency investors, use of evasion techniques, and prior detection by multiple security mechanisms.