spx99x-centurylink[.]com

Analysis of the domain spx99x-centurylink.com indicates potential phishing activity targeting CenturyLink users, though specific page content remains unverified. The domain was registered on July 02, 2026, through Ultahost, Inc., and currently resolves to IP address 75.2.60.5. Infrastructure analysis reveals Cloudflare nameservers (keira.ns.cloudflare.com and rayden.ns.cloudflare.com), a common configuration for both legitimate services and malicious campaigns seeking resilience or anonymity. As of July 30, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy, suggesting prior detection by at least one vendor.

VirusTotal scans by 91 vendors show no current detections, though this absence does not confirm safety and may reflect delayed or incomplete coverage. The domain remains active, and its recent creation—less than 30 days prior to this report—aligns with patterns observed in short-lived phishing campaigns. No additional context is available regarding the exact phishing kit, targeted brand elements, or user interaction mechanics, as the site’s content has not been analyzed.

Defenders should treat this domain as a potential threat, particularly in environments where CenturyLink services are used. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to 75.2.60.5, and reviewing logs for any prior exposure. Further investigation into associated infrastructure, such as hosting providers or linked domains, may clarify the scope of this campaign.