sap2637uii[.]cc

The domain sap2637uii.cc is currently classified as a high‑risk generic phishing site. It was created on July 26, 2025 and remains active as of the report date, July 12, 2026. The site returns HTTP 200 responses and does not present a TLS certificate, indicating that communications are unencrypted. Infrastructure analysis shows the domain is registered through GoDaddy.com, LLC and uses Cloudflare nameservers (ali.ns.cloudflare.com and piers.ns.cloudflare.com). DNS resolution points to the IPv4 address 38.182.168.147, which belongs to AS40065 CNSERVERS LLC located in the United States. The host appears on two public phishing blocklists, PhishDestroy and PhishingDB, and has been referenced in fifteen AlienVault OTX threat‑intel pulses. VirusTotal scans have flagged the domain in 16 out of 95 security engines, and Gridinsoft assigns it a trust score of 0 / 100. Publicly available data does not include a detailed content analysis of the landing page; the only visible metadata is the page title, which repeats the domain name. The absence of an SSL certificate, combined with the low trust score and multiple blocklist listings, suggests a deliberate attempt to harvest credentials or other sensitive information, but the exact payload or targeted brand cannot be confirmed without further inspection. Defenders should prioritize blocking network traffic to 38.182.168.147 and to the domain sap2637uii.cc at perimeter firewalls and DNS filtering solutions. Continuous monitoring of DNS queries for the associated Cloudflare nameservers can help detect any future re‑use of the infrastructure. Incident response teams should consider sinkholing the domain to disrupt potential phishing campaigns and gather additional telemetry for attribution.