152-42-252-251[.]cprapid[.]com

This domain, 152-42-252-251.cprapid.com, is assessed as an elevated-risk credential harvesting phishing site. Analysis indicates it was designed to impersonate legitimate services, tricking users into submitting login credentials, financial details, or other sensitive information. The absence of SSL encryption (HTTPS) further increases the risk of data interception during transmission, making it a significant threat to both individual and organizational security. Infrastructure analysis reveals the domain resolves to the IP address 152.42.252.251, hosted by DigitalOcean, LLC in Singapore. It is registered through Tucows Domains Inc., though no creation date is provided. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection. It was previously blocked by security systems and is now offline, though its infrastructure remains a potential vector for future malicious activity. No SSL certificate was present, a common red flag for phishing sites aiming to avoid certificate transparency logs. Mitigation requires immediate action from network administrators and security teams. Block the domain 152-42-252-251.cprapid.com and its associated IP 152.42.252.251 at the firewall and DNS levels to prevent access. Conduct a retrospective analysis of network logs to identify any prior connections to this domain or IP, particularly focusing on endpoints that may have transmitted credentials or sensitive data. Educate users on recognizing phishing indicators, such as missing SSL certificates, suspicious subdomains, and unsolicited requests for credentials. Monitor for similar domains registered through Tucows or hosted on DigitalOcean infrastructure, as these may indicate follow-up campaigns. Given the domain's offline status, remain vigilant for reactivation or rebranding attempts under new subdomains or IPs.