20-215-200-29[.]cprapid[.]com

Analysis of 20-215-200-29.cprapid.com shows a short‑lived phishing infrastructure that was registered on February 23, 2026 through Tucows Domains Inc. The site presented the default IIS page title “Default Web Site Page” and did not serve an SSL certificate, indicating plain‑HTTP delivery. DNS resolution points to the address 20.215.200.29, an IP owned by Microsoft Corporation (AS8075) located in Poland. The domain’s authoritative name servers are ns1.pdns.tech, ns2.pdns.tech, and ns3.pdns.tech.

Independent threat‑blocking services have taken action: PhishDestroy listed the domain as blocked, and it appears on one external security blocklist. VirusTotal scans recorded eight positive detections out of ninety‑three participating security vendors, reinforcing the malicious classification. The site’s status is currently offline, which limits immediate exploitation but suggests the operators have either ceased activity or are rotating infrastructure.

Defenders should continue to monitor for residual artifacts such as residual URLs, email templates, or credential‑stealing payloads that may reference this domain. Network sensors should be configured to block traffic to 20.215.200.29 and the associated name servers, and security information and event management (SIEM) rules should be updated to flag any future DNS queries for this domain. Historical logs should be reviewed for any connections to the IP or domain during the active window between February 23, 2026 and the takedown date, as compromised credentials may have been harvested during that period.