tapir328qnc[.]sbs

This domain tapir328qnc.sbs is currently active and classified as a high‑risk credential‑phishing site. The domain was registered on 27 May 2026 through Namecheap Inc. and resolves to the Cloudflare‑protected IP address 104.21.13.213, which is associated with AS13335 (Cloudflare, Inc.) and geolocated to the United States. Authoritative nameservers daisy.ns.cloudflare.com and jonah.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The site serves content over HTTPS with a Let’s Encrypt certificate (profile E8) and returns HTTP 200 responses. Automated analysis detected AMP, Lightbox, Cloudflare, and HTTP/3 technologies, and the page title reads “TAPIR328QNC Tawarkan Pengalaman Modern dengan Sistem Praktis”. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded 13 detections out of 91 scanners. The domain appears on three public blocklists and is listed as blocked by PhishDestroy, MetaMask, and SEAL. The specific threat vector is credential phishing, but no additional details about the lure or target audience have been disclosed. Uncertainty remains regarding the exact phishing campaign infrastructure, such as whether the site hosts a credential‑capture form or forwards traffic to a secondary landing page. Defenders should block the domain at the DNS level, monitor outbound connections to the associated IP, and consider adding the host to intrusion‑prevention signatures. Continuous re‑evaluation is advised, as the infrastructure may evolve or be leveraged for further malicious activity.