sdlx777[.]cn

Analysis of sdlx777.cn confirms its classification as an active phishing domain, operational as of July 12, 2026. The domain was registered on March 13, 2026, through a Chinese registrar and currently resolves to IP address 172.247.129.174, hosted on a network owned by a US-based provider. Infrastructure analysis reveals the use of Nginx as the web server, alongside front-end technologies including Bootstrap, jQuery, and Slick, which are commonly employed in both legitimate and malicious sites. The presence of HSTS and HTTP/3 suggests an attempt to appear technically legitimate, though these features do not mitigate the underlying threat. The domain is flagged by four security vendors and appears on at least one blocklist, with a trust score of 0/100, indicating high confidence in its malicious nature. The page title 'Home' provides no specific indication of the targeted brand or service, and no further content analysis has been conducted to determine the exact phishing lure. The domain's nameservers (ns1.judns.com, ns2.judns.com, ns1.julydns.com, ns2.julydns.com) are consistent with those used by other recently observed phishing campaigns, though attribution to a specific threat actor remains unconfirmed. Defenders should treat this domain as a high-risk asset. The SSL certificate, issued by Let's Encrypt, does not validate the site's legitimacy, as certificates are routinely obtained for malicious domains. Network-level blocking of 172.247.129.174 and monitoring of associated nameservers are recommended to disrupt potential credential harvesting or malware distribution. Further investigation into the domain's hosting provider may reveal additional related infrastructure. The domain remains active, and users encountering it should avoid interaction until its removal or takedown.