163-5-109-112[.]cprapid[.]com

This domain, 163-5-109-112.cprapid.com, has been observed as part of a generic phishing campaign and is currently taken offline. The site was registered through Tucows Domains Inc. on May 16 2019 and resolves to the IPv4 address 163.5.109.112, which is hosted in France under AS834 IPXO LLC. The authoritative name servers are ns1.pdns.tech, ns2.pdns.tech, and ns3.pdns.tech. No TLS certificate is presented, indicating the service operates only over HTTP. The only visible page title returned by the web server is “Default Web Site Page,” a generic identifier that provides no insight into the targeted brand or credential‑harvesting methodology. Reputation services have flagged the domain.

VirusTotal reports that 19 of 95 scanners label the host as malicious, and the domain appears on a single external blocklist. PhishDestroy has also listed the address as blocked. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme suspicion. The low trust score, combined with the lack of SSL and the generic page title, aligns with the observed phishing classification. For defenders, the immediate mitigation step is to ensure that the domain and its associated IP address (163.5.109.112) are added to outbound and inbound deny lists on firewalls, DNS resolvers, and proxy devices.

Because the hosting provider uses the pdns.tech name servers, additional domains that share the same name server set should be monitored for similar behavior. Continuous monitoring of the IP block assigned to AS834 may reveal new malicious registrations. While the site is offline, threat intelligence feeds should retain the indicator to prevent re‑use, and security teams should educate users that any emails referencing this domain are likely fraudulent. Further analysis of any captured network traffic or email artifacts referencing the domain can help confirm the phishing vector and may uncover credential‑stealing payloads or supporting infrastructure.