cpcontacts[.]20-40-57-175[.]cprapid[.]com

Analysis of the domain cpcontacts.20-40-57-175.cprapid.com indicates a high-risk credential phishing campaign that has since been taken offline. The domain, registered through TUCOWS.COM, CO. on May 16, 2019, resolves to the IP address 20.40.57.175, which is hosted on Microsoft Corporation’s infrastructure (AS8075) in India. Infrastructure analysis reveals the use of nameservers ns1.pdns.tech, ns2.pdns.tech, and ns3.pdns.tech, a configuration commonly observed in rapidly deployed phishing operations.

The SSL certificate, issued by Let’s Encrypt (YR1), does not provide additional indicators of compromise beyond its routine use in both legitimate and malicious domains. Detection data from July 23, 2026, shows that 16 of 91 security vendors on VirusTotal flagged the domain as malicious, a detection rate consistent with confirmed phishing infrastructure. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting targeting of both general web users and cryptocurrency-related credentials. Gridinsoft’s trust score of 0/100 further corroborates the domain’s malicious classification.

While the specific content of the phishing page remains unanalyzed, the combination of detection vendor flags, blocklist presence, and hosting patterns aligns with credential harvesting campaigns. Defenders are advised to treat this domain as compromised and maintain blocks in web gateways, email filters, and endpoint protection systems. Given the domain’s current offline status, no live threat is present, but historical indicators should be retained for retrospective detection and forensic analysis.