sap3284kfz[.]cc

Analysis indicates that the domain sap3284kfz.cc is actively engaged in phishing operations targeting user credentials. Registered on August 20, 2025, through a major registrar, the domain resolves to IP address 38.182.168.153, hosted under autonomous system AS40065 (CNSERVERS LLC) in the United States. The domain currently returns an HTTP 200 status, confirming it is live and accessible as of July 12, 2026. No SSL certificate is present, increasing the risk of unencrypted data transmission. Infrastructure analysis reveals the use of Cloudflare nameservers (ali.ns.cloudflare.com and piers.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain appears on two security blocklists and is flagged in 15 threat intelligence pulses on a major open-source threat exchange platform, indicating repeated detection by security researchers. While the exact content of the site has not been analyzed, the page title (sap3284kfz.cc) provides no clear indication of a legitimate brand or service, consistent with generic phishing infrastructure. Security vendors have identified this domain as malicious, with 16 out of 95 engines detecting it as a threat. The domain’s trust score is rated at 0/100, reflecting high confidence in its malicious classification. Defenders should treat this domain as a confirmed phishing threat, block access at the network level, and monitor for credential submissions or outbound connections to the IP address 38.182.168.153. Given the lack of SSL encryption and active blocklist presence, user interaction with this domain should be considered high-risk.