webmail[.]74-225-254-182[.]cprapid[.]com

On 29 July 2026 the domain webmail.74-225-254-182.cprapid.com was observed as active and associated with a generic phishing campaign. The infrastructure resolves to the single IPv4 address 74.225.254.182. The host is provisioned through the cPanel Rapid hosting service, and the domain’s authoritative nameserver information is not publicly resolvable (NS_NOT_FOUND). The site appears on one external blocklist, PhishDestroy, indicating that at least one consumer‑facing security product has flagged it.

VirusTotal records show that the URL was submitted to 91 scanners, none of which reported a detection, but the absence of detections does not confirm the absence of malicious payloads. No SSL/TLS certificate details, HTTP status codes, page titles, or Safe Browsing verdicts are presently available, limiting the ability to assess content‑level risk. The lack of additional blocklist listings, limited vendor scans, and missing DNS metadata create uncertainty about the full scope of the campaign and potential target brands.

Analysts should continue to monitor the domain for changes in DNS resolution, addition of TLS certificates, or emergence of page‑title evidence. Defensive teams are advised to block traffic to the IP address 74.225.254.182 and add the domain to web‑filter deny lists, while also correlating any internal phishing‑related alerts against this indicator. Ongoing collection of HTTP response headers, certificate chains, and any observed credential‑capture forms will improve detection accuracy and support mitigation efforts.