sap2062785[.]cc

Analysis of sap2062785.cc indicates a high-risk phishing domain targeting users with Apple-themed content, as evidenced by the page title '苹果' (Apple). The domain was registered on June 30, 2025, through GoDaddy.com, LLC, and remains active as of July 24, 2026. Infrastructure analysis reveals the domain resolves to IP 38.182.168.147, hosted under AS40065 (CNSERVERS LLC) in the United States. Nameservers ali.ns.cloudflare.com and piers.ns.cloudflare.com suggest Cloudflare protection, though no SSL certificate is present. The domain returns an HTTP 200 status, confirming operational status.

Detection data shows the domain is flagged by 16 of 95 security vendors on VirusTotal, appears on one security blocklist, and is blocked by PhishDestroy. AlienVault OTX records the domain in 15 threat intelligence pulses, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment. The absence of SSL and the use of a newly registered domain align with common phishing tactics to evade initial scrutiny.

Defenders should treat this domain as confirmed malicious infrastructure. Recommended actions include blocking the domain and IP at perimeter defenses, monitoring for connections to 38.182.168.147, and alerting users to potential Apple-themed phishing attempts. Given the domain's persistence and detection history, it is likely part of an ongoing campaign. Further analysis of the site's content and payloads is warranted to determine specific attack vectors, though current evidence does not provide details on the phishing kit or exact user interaction flow.