sap27521th[.]cc

The domain sap27521th.cc is flagged for an elevated risk of generic phishing, primarily targeting Apple users. No specific brand or drainer kit has been identified in association with this domain. The threat poses a significant risk to unsuspecting users who may be lured into providing sensitive information such as login credentials or financial details.

Analysis indicates that sap27521th.cc has a VirusTotal score of 16/95, suggesting a moderate level of consensus among security vendors regarding its malicious nature. The domain is registered through GoDaddy.com, LLC, and resolves to the IP address 38.182.168.147, which is located in the United States and is part of the AS40065 CNSERVERS LLC network. The domain was created on July 26, 2025, and currently appears on 2 security blocklists, including PhishDestroy and PhishingDB. It does not have an SSL certificate, which is a common indicator of a legitimate website, further raising suspicions.

The domain is currently offline, which may indicate that it has been taken down by security measures or abandoned by the threat actors. Despite this, the risk remains elevated as the domain could be reactivated at any time. Users are advised to avoid clicking on any links or entering information on web pages that resolve to this domain. Security teams should monitor for any signs of reactivation and ensure that network defenses are updated to block access to this domain if it becomes active again.