tap4094y5e[.]cc

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

Analysis indicates that tap4094y5e.cc was registered on June 30, 2025 through GoDaddy.com, LLC and currently resolves to IP address 38.182.168.147 located in the United States under AS40065. The domain uses nameservers ali.ns.cloudflare.com and piers.ns.cloudflare.com along with an SSL certificate issued by ZeroSSL ECC Domain Secure Site CA. HTTP responses return status 200 and the server advertises HSTS. The page title found is 苹果, directly indicating targeting of Apple. The domain remains active as of the July 12, 2026 report date and is listed on two security blocklists including PhishDestroy and PhishingDB.

VirusTotal reports detections from 17 out of 95 vendors while AlienVault OTX references the domain in 15 threat intelligence pulses. Gridinsoft assigns a trust score of 0 out of 100. These metrics align with the assigned generic_phishing classification and high risk level. Infrastructure details such as the CNSERVERS LLC origin and Cloudflare nameservers are consistent with patterns observed in other flagged domains but do not by themselves confirm malicious intent without additional context.

Exact page content and any login forms or redirection logic have not been retrieved in this assessment, leaving the precise impersonation technique uncertain beyond the recorded page title. Defenders should incorporate the domain and its resolving IP 38.182.168.147 into blocklists and monitoring rules while reviewing logs for connections from internal hosts. Continued observation of the listed nameservers and certificate issuer can support correlation with newly registered domains sharing similar infrastructure. Regular updates from the cited blocklists and OTX pulses provide the most direct means to track persistence or migration of this asset.