esdeekid[.]life

The domain esdeekid.life was registered on May 22, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on an IP address (158.94.211.169) that resolves to a US location identified as Omegatech LTD. The authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, indicating use of the DNSPod service. The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8), which validates the encryption layer but does not provide any assurance about the underlying content. The HTTP response delivers a page titled "Your IP is blocked — SilkGuard," a generic block notice that does not disclose the nature of the hosted content.

VirusTotal reports that the domain has been scanned by 91 AV vendors, with none currently flagging the host, yet the absence of detections is not evidence of benign behavior. AlienVault OTX lists the domain in two separate threat pulses, and it appears on a single external security blocklist. Additionally, the domain is actively blocked by the PhishDestroy filtering service, suggesting that other anti‑phishing platforms have identified it as malicious.

Taken together, the registration timing, the use of DNSPod, the Let’s Encrypt certificate, and the block page title are consistent with a freshly deployed phishing infrastructure. However, the exact phishing payload, targeted brand, and victim interaction flow remain unknown because no page content beyond the title has been captured. Defenders should continue to monitor DNS queries for esdeekid.life, enforce blocklist updates that include this domain, and consider sinkholing the associated IP address to disrupt potential command‑and‑control traffic. Network sensors should flag any outbound connections to 158.94.211.169, and endpoint security solutions should incorporate the domain in URL filtering rules.