194-164-59-27[.]cprapid[.]com

Analysis of 194-164-59-27.cprapid.com indicates the domain is currently offline but retains multiple indicators of malicious use. The domain resolves to IP address 194.164.59.27, an address hosted in Germany under ASN 8560 (IONOS SE). Registration data shows the domain was created on May 16, 2019 through Tucows Domains Inc., and its authoritative name servers are ns1.pdns.tech, ns2.pdns.tech, and ns3.pdns.tech. No TLS certificate is presented, and an HTTP request returns a 404 status with the page title "Page Suspended," suggesting the site has been taken down or is deliberately presenting a placeholder page.

VirusTotal reports that 14 of 95 scanned security vendors flag the domain, reinforcing the suspicion of abuse. Independent threat‑intel feeds have added the domain to at least one blocklist, and it is explicitly listed as blocked by the PhishDestroy service. Reputation scoring services assign extremely low trust values: Gridinsoft scores the domain 0/100 and Scamadviser rates it 1/100. These combined signals point to a high likelihood that the domain was used for phishing, although the exact payload, targeted brand, or campaign details remain unknown because no content was captured.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor for any resurgence of the IP address, and consider adding the domain to internal blacklists. Because the site is offline, further forensic collection is limited; however, analysts should retain the registration and hosting details for correlation with other observed phishing infrastructure. Continuous re‑scanning is recommended in case the domain is re‑activated, and any future traffic should be inspected for credential‑stealing attempts.