sap2708kam[.]cc

Analysis of sap2708kam.cc confirms its classification as an active phishing domain targeting Apple users, as indicated by the page title '苹果' (Chinese for 'Apple'). The domain was registered on July 26, 2025, through a registrar known for hosting high-risk domains, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 38.182.168.147, hosted under AS40065 and located in the United States. The absence of an SSL certificate further aligns with common phishing infrastructure patterns, where encryption is often omitted to avoid detection or reduce operational complexity. The domain is flagged by 15 out of 95 security vendors on a widely used threat intelligence platform, and appears on at least two security blocklists, including PhishDestroy and PhishingDB. Additionally, the domain is referenced in 17 threat intelligence pulses, indicating its active use in phishing campaigns. Nameservers ali.ns.cloudflare.com and piers.ns.cloudflare.com suggest the use of a content delivery network, which is frequently leveraged by threat actors to obscure hosting origins and improve site availability. While the exact content and functionality of the site remain unconfirmed due to lack of direct analysis, the combination of the page title, registration details, and security vendor detections strongly supports its classification as an Apple-themed phishing resource. Defenders are advised to block the domain at the DNS or network level, monitor for connections to the associated IP address, and review logs for any interactions with this infrastructure. The domain's continued activity despite multiple detections underscores the need for proactive mitigation, particularly in environments where Apple-related services are in use.