sap-hiring[.]com

Analysis of sap-hiring.com indicates active malicious use consistent with a generic phishing campaign. The domain was registered through Squarespace Domains II LLC on April 30, 2026, suggesting a recent creation timeline that aligns with the rapid deployment often observed in phishing operations. DNS resolution points to the IPv4 address 198.185.159.144, which is the sole hosting endpoint identified for this domain. The address has not been publicly associated with known benign services, and no additional IP aliases were observed during the lookup.

The domain currently appears on one security blocklist and is specifically listed by PhishDestroy, confirming that at least one reputable anti‑phishing feed has flagged it as malicious. VirusTotal corroborates this assessment: five out of ninety‑one scanned security vendors returned a positive detection for the domain, providing independent confirmation of its suspicious nature. No further evidence such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts were available in the collected intelligence, leaving those vectors unverified at this time.

Given the confirmed registration details, blocklist inclusion, and multi‑vendor detections, defenders should treat sap-hiring.com as a high‑confidence phishing indicator. Recommended mitigations include adding the domain to outbound web‑proxy deny lists, updating DNS‑sinkhole policies to redirect queries to a null route, and ensuring endpoint protection suites are configured to block any URL or payload associated with the domain. Continuous monitoring for any changes in the hosting IP, additional blocklist listings, or new vendor detections is advised to maintain situational awareness as the campaign evolves.