tap4194lsb[.]cc

Analysis of the domain tap4194lsb.cc indicates it is an active phishing site targeting users with an Apple-themed fraudulent page. The domain was registered on July 26, 2025, through GoDaddy.com, LLC, and remains operational as of July 12, 2026. The page title, '苹果' (translating to 'Apple'), suggests an attempt to impersonate the Apple brand, though the exact content and mechanics of the phishing scheme have not been fully analyzed. The domain resolves to the IP address 154.38.99.2, hosted on AS140224 (Nebula Global LLC) in Hong Kong, and is served via Cloudflare nameservers (ali.ns.cloudflare.com, piers.ns.cloudflare.com). Infrastructure review reveals the domain lacks an SSL certificate, increasing the likelihood of unencrypted credential harvesting. It is flagged by 15 of 95 security vendors on VirusTotal, though this detection rate does not confirm the full scope of malicious activity. The domain appears in 17 threat intelligence pulses on AlienVault OTX and is listed on two security blocklists, including PhishDestroy and PhishingDB. No legitimate use case has been identified. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Given its recent registration and active status, monitoring for related infrastructure (e.g., newly registered domains under the same ASN or nameservers) may help identify further threats. Additional analysis of the page content is recommended to determine the precise phishing methodology, though current indicators align with credential theft or fraudulent transaction schemes.