cpcontacts[.]20-124-36-87[.]cprapid[.]com

Analysis as of July 29 2026 shows that the domain cpcontacts.20-124-36-87.cprapid.com is currently active and classified as a generic phishing resource. The domain was registered through Tucows Domains Inc. on 16 May 2019, indicating a long‑standing registration that predates recent activity. VirusTotal reports six of ninety‑one scanned security vendors flagging the domain, confirming a modest but non‑trivial detection rate. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple threat‑intelligence feeds have observed malicious use.

No additional infrastructure details such as IP address, ASN, or SSL characteristics are provided in the current intelligence set, leaving the hosting environment uncharacterized. The lack of public page‑title or content analysis means the exact phishing lure has not been confirmed, and the specific credential‑stealing campaign or targeted brand remains unknown. Defenders should therefore treat any inbound traffic to this host as hostile.

Recommended actions include adding the domain to outbound‑allow lists, updating DNS sink‑hole rules, enabling web‑proxy blocks, and monitoring for attempted connections from internal clients. Continuous re‑scanning on VirusTotal and periodic checks of blocklist feeds are advised to capture any escalation in detection counts or new vendor classifications. Given the elevated risk rating and active status, organisations should assume compromise potential until the domain is fully mitigated.