spx260k-centurylink[.]com

spx260k-centurylink.com is currently listed on a public security blocklist and has been actively blocked by the PhishDestroy feed. The domain was submitted to VirusTotal where it was examined by 91 antivirus and URL‑reputation engines; none of the scanners raised a detection. While the lack of detections may indicate that the payload or landing page has not yet been fingerprinted by the participating vendors, the presence on a blocklist confirms that the domain is being used in malicious campaigns.

No additional intelligence such as registrar details, hosting IP, SSL certificate data, Safe Browsing status, or page title has been released publicly, so the infrastructure surrounding the domain remains opaque. Analysts should treat the domain as hostile and incorporate it into deny‑list controls across perimeter firewalls, secure web gateways, and endpoint web filters. Automated threat‑intel feeds that ingest blocklist entries should be updated to include spx260k‑centurylink.com.

Incident responders encountering traffic to this host should capture HTTP request/response metadata, DNS query logs, and any associated payloads for further sandbox analysis. Continuous monitoring of the domain’s reputation across multiple scanners is advised, as future detections may emerge once the malicious content is catalogued. Until the domain is definitively taken down, it should be considered an active phishing vector.