app[.]sunwsap[.]ink

PhishDestroy identifies app.sunwsap.ink as an active malware-dropper posing as a legitimate SAP login portal to harvest corporate credentials and deliver malicious payloads. The domain leverages a Let’s Encrypt SSL certificate to appear trustworthy while hosting content designed to trick SAP users into entering their work credentials. Threat actors commonly use such impersonation to gain initial access to enterprise networks, then pivot to data theft or ransomware deployment. This campaign specifically targets SAP users through deceptive URLs, aiming to capture valid credentials that provide direct entry into business-critical systems. This domain was flagged through PhishDestroy’s automated pipeline, which detected the impersonation of a major enterprise application. Intelligence shows the domain was registered on March 26, 2026, only days ago, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and currently shows 0 detections on VirusTotal (95 engines scanned as of latest check). The lack of detection suggests this campaign is either very new or using evasion techniques to bypass initial filters. The combination of recent registration, low detection rate, and spoofed SAP branding indicates a high-risk, likely targeted operation. If you visited app.sunwsap.ink, immediately close the browser tab and disconnect from any corporate network or VPN. Do not enter any credentials or download files. Scan your device with updated antivirus software, especially if you used work credentials. Report the incident to your IT or security team and provide the full URL. If you entered SAP credentials, change your password immediately via the official SAP portal and enable multi-factor authentication. Monitor for unusual login attempts or system access. This domain is under active investigation, but proactive action can prevent credential compromise and potential lateral movement in your organization.