contentstatus-x[.]click

Analysis of the domain contentstatus-x.click shows that it was registered on 23 February 2026 through Atak Domain Bilgi Teknolojileri AS and is serviced by the nameservers p1.atakdomain.com and p2.atakdomain.com. The domain resolves to IP address 185.46.40.240, which belongs to the Turkish AS211401 network owned by Atak Domain Bilgi Teknolojileri A.S. The IP location is identified as Turkey. The site presents a page title “contentstatus-x.click | Domain Parked”, indicating that the web server currently returns a generic parked page.

The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, which is typical for domains lacking a dedicated certificate. Infrastructure assessments reveal a Gridinsoft trust score of 0 out of 100, and the domain appears on three independent blocklists – PhishDestroy, MetaMask, and SEAL – confirming its abuse classification. VirusTotal reports that two of ninety‑three scanned scanners flagged the domain, providing additional vendor corroboration. The domain is presently offline, consistent with the “taken offline” status in the intelligence feed.

While the collected data substantiate a phishing‑related threat, no payload or specific phishing page content has been captured, leaving the exact attack vector and targeted brand undefined. Defenders should immediately add the resolved IP 185.46.40.240 to network blocklists, enforce DNS filtering for contentstatus-x.click, and monitor any future DNS or SSL changes that could indicate re‑activation. Continuous re‑scanning with multi‑engine services such as VirusTotal is recommended to capture any evolution of the site’s malicious content. Organizations employing web‑gateway or endpoint protection should ensure signatures that incorporate the observed blocklist identifiers are deployed to mitigate potential user exposure.