htadmin1454[.]sdlrkixdr[.]com

This domain, htadmin1454.sdlrkixdr.com, is currently flagged as a high‑risk generic phishing site. VirusTotal scans have returned detections from seven of ninety‑one AV engines, indicating that multiple security products recognize malicious behavior associated with the host. The domain is listed on a public blocklist and has been actively blocked by the PhishDestroy filtering service, yet the HTTP endpoint continues to return a 200 OK response, confirming that the malicious payload remains reachable. Infrastructure analysis shows the domain is served by the Chinese DNS provider AliDNS, using nameservers ns7.alidns.com and ns8.alidns.com.

Registration was performed through Dominet (HK) Limited, a registrar that is frequently leveraged for short‑lived malicious domains. No SSL certificate details or IP address information were disclosed in the available data set, and the page title has not been publicly released, limiting insight into the exact content served to victims. The combination of active status, positive detections, and inclusion on blocklists suggests the site is being used in ongoing phishing campaigns. Defenders should add htadmin1454.sdlrkixdr.com to outbound and inbound deny lists across firewalls, proxy devices, and email gateways.

Continuous monitoring of DNS queries for the associated AliDNS nameservers is recommended to detect any rapid re‑registration or pivoting to new hostnames. Organizations employing threat‑intel feeds should ensure that the domain is ingested from both the blocklist entry and the PhishDestroy feed to maintain up‑to‑date coverage. Because the site still returns HTTP 200, any automated URL‑based detection rules should be tuned to inspect the response body for typical phishing indicators, even in the absence of a known page title.