07d9ft0uvf61li75z[.]comvdwrsutl[.]affiliate-token[.]com

Analysis indicates that the fully qualified domain 07d9ft0uvf61li75z.comvdwrsutl.affiliate-token.com is currently listed on a single public security blocklist and is actively blocked by the PhishDestroy feed. The domain has been submitted to VirusTotal where it was evaluated by 91 antivirus and URL‑reputation engines; none of the scanners raised a detection at the time of analysis. The report explicitly notes that the lack of detections does not constitute evidence of benign intent, especially given the blocklist entry.

No additional infrastructure details such as registrar, hosting IP address, autonomous system number, SSL certificate information, or HTTP response codes have been disclosed in the available intelligence, limiting the depth of technical profiling. Consequently, the threat posture remains uncertain beyond the confirmed blocklist presence. Defenders should prioritize immediate containment by adding the domain to DNS and proxy deny lists, ensuring that outbound requests to the domain are dropped.

Monitoring for any future resolution of the domain, changes in its hosting attributes, or appearance on additional blocklists is recommended. Because the domain appears in a phishing‑specific feed, security teams should also consider correlating internal logs for attempted user interactions with the domain and alerting on any credential‑submission events. Continuous re‑evaluation is advised as new telemetry becomes available.