sdnssmdf-js[.]beer

Analysis of sdnssmdf-js.beer shows that the domain is actively used in a phishing campaign. The domain was registered via Dynadot Inc and resolves to the IP address 178.16.52.101, which is geolocated to Germany and attributed to Omegatech LTD. DNS resolution is handled by the Cloudflare nameservers venkat.ns.cloudflare.com and candy.ns.cloudflare.com, and the site presents a TLS certificate issued by Let’s Encrypt (YR1). HTTP requests return a 403 Forbidden status and the page title mirrors that status. VirusTotal records indicate that 21 of 91 scanned security vendors have flagged the domain, and AlienVault OTX lists the indicator in 20 threat‑intelligence pulses. The domain is presently listed on three public blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. The evidence collectively confirms that the infrastructure is being leveraged for malicious phishing activity, though the specific lure or credential‑capture page has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for connections to 178.16.52.101, and add the indicator to internal threat‑intel feeds. Ongoing observation is recommended to capture any payload or victim interaction that may clarify the campaign’s targeting.