9-160-165-249[.]cprapid[.]com

The domain 9-160-165-249.cprapid.com is currently active and resolves to the IPv4 address 9.160.165.249. Infrastructure analysis shows the domain was provisioned through the cPanel Rapid hosting platform, and its authoritative nameserver records are unavailable (NS_NOT_FOUND), suggesting a possible misconfiguration or rapid‑deployment environment that does not publish standard DNS delegation data. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious.

VirusTotal scans have returned detections from two of ninety‑one participating security vendors, confirming that the domain has been observed by multiple independent detection engines, though the majority of scanners have not flagged it. No additional intelligence such as Safe Browsing status, OTX references, SSL certificate details, HTTP response codes, trust scores, or page title information is available in the current dataset, leaving those vectors unverified. The limited visibility means that while the observed indicators (IP address, hosting provider, blocklist inclusion, and partial VirusTotal detections) provide sufficient grounds for a high‑risk classification, the full scope of the phishing campaign – including targeted brand, content, and victim interaction flow – remains uncertain.

Defensive recommendations include immediate DNS‑level blocking of the domain and its associated IP address, inclusion of the domain in email gateway and web proxy deny lists, and continuous monitoring for any new resolution or hosting changes. Organizations should also correlate internal logs for any outbound connections to the IP 9.160.165.249 and consider threat‑intel enrichment of related indicators to detect potential lateral use of the same hosting infrastructure in future phishing attempts.