spx99x[.]icu

This domain, spx99x.icu, is actively flagged as a high-risk brand impersonation threat targeting Google. Registered on July 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 142.251.156.119 and presents a page titled 'Google,' directly aligning with its confirmed impersonation of Google services. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3, alongside detected technologies such as particles.js, reCAPTCHA, and jsDelivr, which may be leveraged to enhance legitimacy or evade detection. The domain is secured with an SSL certificate issued by Google Trust Services, a tactic commonly observed in phishing operations to create a false sense of authenticity. As of July 12, 2026, the domain remains active and is blocked by at least one security vendor, with seven out of 95 security engines on VirusTotal flagging it as malicious. It appears on a single security blocklist and has been referenced in four threat intelligence pulses on AlienVault OTX, indicating moderate but consistent detection across threat-sharing platforms. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. While the exact content and functionality of the site have not been analyzed, the combination of brand impersonation, recent registration, and active blocking by security tools confirms its malicious intent. Defenders are advised to treat this domain as a confirmed phishing threat, prioritize blocking at the network and endpoint levels, and monitor for related indicators of compromise. Additional scrutiny of associated infrastructure, such as the resolving IP and SSL certificate, may reveal further connections to ongoing campaigns.