spx15k-centurylink[.]com

Analysis of spx15k-centurylink.com indicates that the domain is currently active and has been classified as a generic phishing site. The domain was submitted to VirusTotal where it was examined by 91 antivirus and URL‑reputation engines; none of the engines returned a detection. While the absence of detections does not guarantee benign behavior, the lack of a positive verdict is noted. Independent threat‑intelligence feeds have flagged the domain: it is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service.

No additional infrastructure details such as registrar information, hosting IP, ASN, or SSL certificate data have been disclosed in the available intelligence. Consequently, the underlying hosting environment and any potential command‑and‑control infrastructure remain unidentified. The observable evidence is limited to the blocklist entries and the VT scan result, which together provide a baseline indication of malicious intent.

Defenders should continue to block the domain at perimeter and DNS layers, monitor network traffic for any outbound connections to the domain, and consider adding the domain to internal blocklists. Ongoing surveillance is recommended to capture any future changes in the domain’s hosting attributes, detection status, or inclusion in additional threat feeds. Until further evidence emerges, the domain should be treated as a confirmed phishing vector.