sap2392017[.]cc

This domain, sap2392017.cc, is identified as a credential theft phishing site. The page title '苹果' suggests a potential impersonation of the Apple brand, a common tactic in phishing campaigns to lure unsuspecting users. The domain does not utilize an SSL certificate, which is a red flag for security-conscious users.

Infrastructure analysis reveals that sap2392017.cc resolves to the IP address 38.182.168.147, which is located in the United States and is part of the AS40065 CNSERVERS LLC network. The domain was registered through GoDaddy.com, LLC on July 26, 2025. According to VirusTotal, 15 out of 95 security vendors flag this domain as malicious. The domain is currently marked as offline in the Google Safe Browsing (GSB) status and appears on 2 security blocklists, including PhishDestroy and PhishingDB.

The domain is currently offline, indicating that the phishing campaign may have been disrupted or taken down. However, the infrastructure remains in place, and the domain could be reactivated at any time. Organizations and individuals are advised to ensure that their security systems are up to date and to educate users about the risks of credential theft phishing. Despite the domain's offline status, the remaining risk is elevated due to the potential for reactivation and the lack of SSL protection, which could make it easier for attackers to launch a similar campaign in the future.