cpcalendars[.]20-124-36-87[.]cprapid[.]com

On July 29, 2026 the domain cpcalendars.20-124-36-87.cprapid.com was evaluated as an active generic phishing infrastructure with an elevated risk rating. The domain was registered on May 16, 2019 through Tucows Domains Inc., indicating a long‑standing registration that predates the observed malicious activity. VirusTotal records show that 8 of 91 security scanners flagged the domain, confirming that multiple independent engines have identified malicious characteristics. The domain is listed on three public security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, demonstrating that it is already being intercepted by a range of defensive products.

No public SSL certificate data, HTTP response codes, or page‑title information are currently available, so the surface‑level characteristics of the hosted page remain unknown. At present no evidence has been disclosed regarding the specific phishing lure or target brand, and the exact content served by the site has not been captured by public analysis tools. Given the absence of a known page title or brand reference, the precise social engineering vector remains unconfirmed. The lack of additional telemetry such as OTX references, ASN or geolocation data further limits the ability to map the full hosting infrastructure.

Analysts should therefore prioritize immediate blocking of the domain at perimeter and DNS layers, add it to internal watchlists, and monitor for any new resolution or hosting changes. Continuous re‑scanning with multi‑engine services is advised to capture any evolution in the payload or hosting environment. Defenders should also verify that endpoint and browser protections are updated to include the listed blocklists, and consider manual inspection of any traffic that appears to resolve to the cprapid.com sub‑domain space, as it may be leveraged for future phishing campaigns.