216-126-236-157[.]cprapid[.]com

The domain 216-126-236-157.cprapid.com was registered on May 16, 2019 through Tucows Domains Inc. and resolves to the IPv4 address 216.126.236.157, which is owned by AS14956 RouterHosting LLC in the United States. The authoritative name servers for the zone are ns1.pdns.tech, ns2.pdns.tech, and ns3.pdns.tech. No TLS certificate is presented for the host, indicating that the site does not support HTTPS. An HTTP request to the root URL returns a page whose title is "Default Web Site Page," a generic label that provides no indication of legitimate content.

Independent trust‑rating services assign extremely low scores: Gridinsoft reports a 0 out of 100 rating and Scamadviser a 1 out of 100 rating, both suggesting a high likelihood of malicious use. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing platform has taken action against it. VirusTotal analysis shows that 12 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. Current operational status is offline; the site has been taken down, which limits immediate observation of payloads or credential‑harvesting forms.

However, the combination of low trust scores, lack of encryption, a default page title, and multiple vendor detections strongly indicates that the domain was employed for generic phishing campaigns. Uncertainty remains regarding the exact content that was served while the site was active, as no detailed page capture or malware sample is available. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of the host or related IP ranges, and consider adding the IP address 216.126.236.157 to threat‑intel feeds. Ongoing observation of the associated name servers (pdns.tech) is advised, as they may host additional malicious zones.