tap4411dnk[.]cc

This domain, tap4411dnk.cc, is flagged as an active high-risk phishing site targeting users through an Apple-themed lure. Analysis of available data shows the page title is explicitly '苹果,' the Chinese term for Apple, indicating the domain likely impersonates Apple services or branding. The domain was registered on September 14, 2025, through GoDaddy.com, LLC, and currently resolves to the IP address 38.182.168.147, hosted on AS40065 under CNSERVERS LLC in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (ali.ns.cloudflare.com and piers.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The domain appears on two security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal, with specific detections from PhishDestroy and PhishingDB. AlienVault OTX records show the domain in 16 threat intelligence pulses, suggesting repeated malicious activity or campaigns. The site employs HSTS, a security feature that enforces HTTPS connections, which may be used to lend a false sense of legitimacy to potential victims. The SSL certificate is issued by ZeroSSL, a provider frequently used by both legitimate and malicious domains, and does not provide conclusive evidence of intent on its own. While the exact content and mechanics of the phishing scheme remain unconfirmed due to lack of direct analysis, the combination of the page title, blocklist presence, and vendor detections strongly indicates a targeted phishing operation. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or proxy level. Network security teams are advised to monitor for connections to 38.182.168.147 and the associated domain, particularly in environments where Apple-related services are in use. Given the domain's recent creation and active status as of July 12, 2026, continued monitoring for related infrastructure or newly registered lookalike domains is recommended.