sap37199yd[.]cc

The domain sap37199yd.cc is currently active and resolves to the IPv4 address 38.182.168.147, hosted by AS40065 CNSERVERS LLC in the United States. The domain was registered on September 14, 2025 through GoDaddy.com, LLC and is served over HTTPS with a ZeroSSL ECC Domain Secure Site CA certificate. The site returns HTTP 200 responses and advertises HSTS, indicating that transport security is enforced.

Threat intelligence shows that the domain is associated with a high‑risk generic phishing campaign. VirusTotal has flagged the site by 18 of 95 scanned security vendors. It appears on two public blocklists, specifically PhishDestroy and PhishingDB, and has been cited in fifteen AlienVault OTX pulses. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on two additional security blocklists. The page title observed is “苹果”, which translates to “Apple”, suggesting the campaign may be attempting to impersonate the Apple brand.

While the underlying page content has not been examined, the available metadata confirms the presence of a phishing infrastructure. The use of Cloudflare nameservers (ali.ns.cloudflare.com, piers.ns.cloudflare.com) masks the origin of the hosting server, a common technique for evading takedown. No additional information about the phishing kit, credential harvesting method, or targeted user base is disclosed in the current intelligence, leaving the exact attack vector uncertain.

Defenders should incorporate sap37199yd.cc into network and endpoint blocklists and monitor DNS queries for the associated IP address 38.182.168.147. TLS inspection should be enabled to capture any credential submission that may be transmitted over HTTPS. Because the site presents a legitimate‑looking SSL certificate, user education campaigns should emphasize verification of URLs and caution against unexpected prompts referencing Apple services. Continuous monitoring of threat feeds for new indicators related to this domain is recommended.