sappy3d[.]top

Analysis of the domain sappy3d.top shows a short‑lived infrastructure that was actively used for a generic phishing campaign before being taken offline. The site’s HTML title reads “Nur einen Moment…”, which is the only visible content indicator available from the collected intelligence. The domain was registered on February 21 2026 and resolves to the IP address 172.67.155.33, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States.

The TLS certificate presented is issued by GTS CA 1P5, a public certificate authority commonly used by Cloudflare‑hosted services. VirusTotal scans recorded three positive detections out of ninety‑one submitted security vendors, confirming that multiple antivirus or URL‑reputation engines have identified malicious behavior associated with the domain. Additionally, the domain appears on a single security blocklist and is explicitly listed by the PhishDestroy blocklist provider, indicating that at least one external threat‑intel source has flagged it as a phishing resource.

Current network checks show the site is offline, with no active HTTP response, which aligns with the reported “taken offline” status. Defenders should continue to block the domain and its associated IP address at perimeter and DNS filtering layers, monitor for any re‑hosting of the same payload on other Cloudflare‑served hosts, and consider adding the domain to internal threat‑intel feeds. Because the underlying content has not been publicly archived, further forensic detail about the phishing lure or credential‑capture mechanisms remains unknown, and any future re‑use of the domain or IP should trigger renewed investigation.