uaid[.]tap39792qk[.]cc

This domain, uaid.tap39792qk.cc, operates as a fraudulent Apple login portal designed to harvest user credentials. The page title "苹果" (Chinese for "Apple") and the absence of an SSL certificate indicate a deliberate attempt to mimic legitimate Apple services while evading basic security checks. The infrastructure is optimized for credential theft, likely targeting users through deceptive emails or SMS messages directing them to the fake login interface. Analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 16 out of 95 security vendors on VirusTotal, appears on two independent blocklists (PhishDestroy and PhishingDB), and was registered on June 30, 2025, through GoDaddy.com, LLC. It resolves to the IP address 38.182.168.147, hosted under AS40065 (CNSERVERS LLC) in the United States. The combination of a recent registration date, lack of encryption, and confirmed blocklist presence strongly suggests a short-lived, high-impact phishing campaign. Users who visited uaid.tap39792qk.cc should immediately reset any credentials entered on the site, particularly Apple IDs or financial information. Enable multi-factor authentication on all accounts as a precautionary measure. Monitor accounts for unauthorized activity and report any suspicious transactions to the relevant service providers. Given the domain's current offline status, further interaction is unlikely, but users should remain vigilant for similar phishing attempts using comparable infrastructure or branding.