ck[.]saibadns[.]com

The domain ck.saibadns.com was registered on March 27, 2026 through GoDaddy.com, LLC and resolves to the IPv4 address 97.74.82.51, which is hosted in Singapore by GoDaddy.com, LLC. DNS resolution is served by ns1.saibadns.com and ns2.saibadns.com. An HTTPS endpoint is present, secured with a Let's Encrypt R12 certificate, and the web server reports Nginx as the underlying technology. The site returns HTTP status code 200 and presents the page title "Ghost Mining Pool," suggesting an attempt to masquerade as a cryptocurrency mining pool. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, indicating partial detection across the threat‑intelligence ecosystem.

The domain appears on a single public blocklist and is actively listed by PhishDestroy, reinforcing its classification as a high‑risk phishing resource. Gridinsoft assigns a trust score of 0 out of 100, reflecting a severely negative reputation. No additional intelligence such as Safe Browsing, OTX, or specific brand impersonation is available, and the page content has not been publicly disclosed.

The combination of recent registration, low‑reputation certificate, minimal vendor detections, and blocklist presence suggests a deliberately crafted infrastructure designed for fraudulent activity. Defenders should incorporate ck.saibadns.com into URL filtering policies, block the associated IP address, monitor DNS queries for the domain and its nameservers, and consider sharing the indicator set with upstream threat‑sharing communities to improve detection coverage. Continuous re‑evaluation is advised to capture any future changes in detection status or observed malicious behavior.