sapein[.]pro

Analysis of sapein.pro as of July 22, 2026 confirms that the domain is actively used for generic phishing. The site presents the page title “Nur einen Moment…”, but no further content has been disclosed. Infrastructure is fully hosted behind Cloudflare, Inc., using the nameservers fonzie.ns.cloudflare.com and luciana.ns.cloudflare.com. The resolved address 172.67.144.236 belongs to Cloudflare’s AS13335 network and is located in the United States. TLS termination is performed by Google Trust Services under the WE1 certificate, indicating a legitimate certificate chain but offering no guarantee of benign intent.

HTTP requests receive a 403 response, which may be a deliberate block or a misconfiguration. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on a single security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in 22 separate threat pulses, reinforcing its association with malicious activity. VirusTotal scans show seven out of ninety‑five security vendors flagging the host, providing additional corroboration of risk.

The combination of a generic phishing classification, low trust score, multiple threat‑intel mentions, and active blocklist inclusion elevates the risk to a high level. Uncertainty remains regarding the exact phishing payload, target audience, and whether the 403 status reflects a defensive measure or a temporary outage. Defenders should block all network traffic to sapein.pro at the firewall or proxy level, monitor DNS queries for the domain, and consider adding it to internal threat‑intel feeds. Continuous re‑evaluation is advised in case the hosting configuration changes or additional detections emerge.