3guq[.]sap2062785[.]cc

Analysis of 3guq.sap2062785.cc shows that the domain was registered through GoDaddy.com, LLC on 30 June 2025 and points to IP 38.182.168.153, which belongs to AS40065 CNSERVERS LLC in the United States. The domain resolves without an SSL certificate, indicating that the site was served over plain HTTP before being taken offline. The page title returned from the host is the Chinese word “苹果”, providing no further context about the intended victim audience. Reputation services give the domain extremely low trust scores: Gridinsoft assigns 0 out of 100, Scamadviser 1 out of 100, and the domain appears on a single security blocklist.

VirusTotal records 14 of 95 antivirus engines flagging the domain as malicious, and PhishDestroy lists it as blocked. Nameserver records are ali.ns.cloudflare.com and piers.ns.cloudflare.com, confirming that the domain leveraged Cloudflare’s DNS infrastructure. The elevated risk rating aligns with the observed indicators, but the site’s current offline status limits immediate threat exposure.

Uncertainty remains regarding the specific phishing template or credential harvesting method, as no content analysis beyond the title is available. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑hosting on other IP ranges, and add the IP address 38.182.168.153 to threat‑intel feeds. Ongoing observation of Cloudflare name‑server activity and periodic re‑scans on VirusTotal are recommended to capture any future changes.