tap3793ywk[.]cc

Analysis of tap3793ywk.cc indicates a high‑risk, active generic phishing operation. The domain was registered on June 30, 2025 through GoDaddy.com, LLC and has no TLS certificate, returning HTTP 200 for the root request. The page title returned by the server is the Chinese term "苹果", but no further content has been publicly disclosed, leaving the specific luring technique uncertain.

Infrastructure inspection shows that tap3793ywk.cc resolves to the IPv4 address 38.182.168.147, which belongs to AS40065 (CNSERVERS LLC) and is geolocated in the United States. The domain is serviced by Cloudflare DNS, using ali.ns.cloudflare.com and piers.ns.cloudflare.com as its authoritative nameservers, a pattern commonly observed in fast‑flux phishing deployments.

Reputation data reinforces the malicious classification: the domain is listed on two public blocklists (PhishDestroy and PhishingDB), appears in fifteen AlienVault OTX threat‑intel pulses, and has been flagged by fourteen of ninety‑five VirusTotal security vendors. Additional scoring systems assign a zero out of one hundred trust rating (Gridinsoft) and a high‑risk posture (risk level: high). These signals collectively confirm that the infrastructure is being actively leveraged for credential‑stealing or other fraudulent activity.

Defenders should immediately block tap3793ywk.cc at perimeter firewalls and DNS resolvers, and consider sink‑holing the associated IP address 38.182.168.147 to disrupt further command‑and‑control traffic. Continuous monitoring for DNS queries or HTTP requests to this domain is advised, as well as updating email security gateways with the latest phishing signatures. End‑user education campaigns should warn users that any unsolicited communications referencing "苹果" may be part of this campaign, even though the exact page content has not been publicly verified.