sap24365mf[.]cc

The domain sap24365mf.cc is identified as a generic_phishing site impersonating Apple. As of the latest assessment, the domain is offline and no longer active. This domain poses an elevated risk to users who may inadvertently access it, believing it to be a legitimate Apple website.

Infrastructure analysis reveals that sap24365mf.cc resolves to the IP address 38.182.168.147, which is located in the United States and is part of the AS40065 CNSERVERS LLC network. The domain was created on July 26, 2025, and is registered through GoDaddy.com, LLC. Notably, the domain does not have an SSL certificate, which is a common indicator of a non-secure and potentially malicious site. VirusTotal reports that 15 out of 95 security vendors have flagged this domain as malicious. Additionally, sap24365mf.cc appears on 2 security blocklists, further confirming its malicious nature. These blocklists include PhishDestroy and PhishingDB, which are reputable sources for identifying phishing sites.

Given that the domain is currently offline, the immediate threat has been mitigated. However, it is recommended that all users who may have visited this site before it was taken down change their Apple account passwords immediately and monitor their accounts for any unusual activity. IT administrators should ensure that their network's DNS settings and security policies are updated to block this domain and its associated IP address to prevent any residual access. Continuous monitoring and education of users on recognizing phishing attempts are also crucial to maintaining network security.