ns-server-jscdn[.]beer

The domain ns-server-jscdn.beer is currently active and resolves to the IP address 178.16.52.101, which is geolocated to Germany and attributed to Omegatech LTD. Registration was completed through Dynadot Inc, and the authoritative nameservers are clyde.ns.cloudflare.com and kelly.ns.cloudflare.com, indicating Cloudflare DNS hosting. The site presents a 403 Forbidden page title, suggesting that direct content is not publicly accessible at the time of analysis. TLS is provided by a valid Let's Encrypt certificate (YR1), confirming that HTTPS connections are established without certificate errors.

Threat intelligence sources provide multiple corroborating indicators: VirusTotal recorded detections from 21 of 91 scanned security vendors, and AlienVault OTX references the domain in 11 separate threat pulses. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk phishing infrastructure. Despite these signals, no specific brand or credential‑harvesting page has been captured; the exact phishing payload remains unknown.

Defenders should immediately block ns-server-jscdn.beer and its associated IP address in perimeter firewalls and DNS filtering solutions. Continuous monitoring of the IP for changes in HTTP response codes is advised, as a 403 status may be a temporary evasion tactic. Organizations employing TLS inspection should ensure the Let's Encrypt certificate is allowed to pass to avoid disruption of legitimate traffic while still flagging the domain. Given the active status and multi‑vendor detections, inclusion of the domain in internal threat feeds and security information and event management (SIEM) correlation rules is recommended to capture any future malicious activity originating from this infrastructure.