spx21k-fxempire[.]com

The domain spx21k-fxempire.com was registered on July 15, 2026 through Ultahost, Inc. and is currently active. DNS resolution points to the IP address 104.21.72.17 and the authoritative name servers are dayana.ns.cloudflare.com and sonny.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. Threat intelligence platforms have flagged the domain as a high‑risk generic phishing site; it is listed on one public blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that 2 of 95 security vendors have marked the domain as malicious, providing limited but notable corroboration of its malicious intent. The available data confirms the domain’s role in phishing campaigns, but no public page content, landing page screenshots, or targeted brand information have been disclosed, leaving the exact lure and credential‑stealing mechanisms uncertain. Defenders should immediately add spx21k-fxempire.com and its resolving IP 104.21.72.17 to network block lists, enforce DNS sink‑holing for the associated Cloudflare name servers, and monitor outbound traffic for connections to the IP. Continuous re‑scanning on VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations should also audit email filters for messages referencing the domain and educate users about unsolicited requests that may reference this URL.