cpcalendars[.]20-40-57-175[.]cprapid[.]com

The domain cpcalendars.20-40-57-175.cprapid.com was observed hosting a generic phishing infrastructure and has been taken offline as of the report date. Registration data show the domain was created on 16 May 2019 through the registrar TUCOWS.COM in Colombia and is served by the authoritative name servers ns1.pdns.tech, ns2.pdns.tech and ns3.pdns.tech. DNS resolution maps the name to the IPv4 address 20.40.57.175, which belongs to AS8075, identified as Microsoft Corporation, and is geolocated in India. The web service presented a TLS certificate issued by Let’s Encrypt with a two‑year validity period, confirming that HTTPS was active at the time of analysis.

Threat intelligence aggregators flagged the host on three independent blocklists, and it appears on the PhishDestroy, MetaMask and SEAL blocklists. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious use. VirusTotal recorded 16 detections out of 91 scanned engines, reinforcing the suspicion of phishing activity.

The combination of a low‑reputation certificate, an IP owned by a major cloud provider, and the presence on multiple anti‑phishing feeds suggests the domain was leveraged to lure victims into credential‑stealing or session‑hijacking flows. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for similar patterns, and incorporate the observed indicators—such as the specific nameserver set, the Let’s Encrypt certificate fingerprint, and the VirusTotal detection count—into detection rules. Ongoing surveillance of the AS8075 block and periodic re‑query of the domain’s status are recommended, as the infrastructure could be re‑activated on a different host or sub‑domain.