sandns[.]com

Analysis of www.sandns.com indicates that the domain was registered on March 12, 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network (AS13335, United States). The authoritative nameservers are laila.ns.cloudflare.com and roman.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site resolves to the IP address 172.67.178.121, which belongs to Cloudflare’s edge infrastructure and is covered by a Google Trust Services / WE1 SSL certificate. An HTTP request to the domain returns a 503 Service Unavailable response and the page title presented by the server is “Attention Required!

| Cloudflare”, a generic Cloudflare error page rather than a content‑specific landing page. The domain is currently listed as offline, yet it appears on at least one public security blocklist and has been flagged by PhishDestroy. VirusTotal scans show that 4 of 94 security vendors have identified the domain as malicious, which aligns with its classification as a generic phishing site. The limited detection history, combined with the recent creation date, suggests a short‑lived campaign that leveraged Cloudflare’s free services to obscure the true hosting location.

Because the site is presently offline, active probing may be limited, but defenders should continue to monitor the associated IP range and Cloudflare nameservers for any re‑activation. Recommendations include adding the domain to internal blocklists, enforcing DNS sink‑hole rules for the IP 172.67.178.121, and reviewing any recent authentication attempts that may have involved the domain. Further investigation is needed to determine the exact phishing payload or targeted brand, as the only visible artifact is the generic Cloudflare title. Until the infrastructure reappears, the elevated risk rating remains justified based on the observed indicators.