cardano-zendesk[.]firebaseapp[.]com

The domain cardano-zendesk.firebaseapp.com is identified as a high-risk brand impersonation threat, specifically targeting Apple. The domain's page title, 'Cardano Support,' is misleading, as it purports to offer support for Apple products or services, which can deceive users into believing they are interacting with a legitimate Apple support page. No specific crypto drainer kit has been identified in this analysis.

Infrastructure analysis reveals that the domain resolves to the IP address 199.36.158.100, which is located in the United States and is associated with AS54113 Fastly, Inc. The domain is registered through Google LLC and is protected by an SSL certificate issued by Google Trust Services / WR4. The domain has been flagged on 4 security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. However, it has not yet been detected by VirusTotal, with a score of 0/95. The creation date of the domain is not provided in the known intelligence.

The domain is currently active and poses a significant risk to users who may fall for the impersonation. Immediate response actions should include reporting the domain to Apple's security team and to additional threat intelligence platforms to ensure broader awareness and potential blocking. Users are advised to verify the URL and domain name before entering any sensitive information and to avoid clicking on links or downloading files from this domain. Despite the domain's current status, the risk remains high due to its ability to deceive and the potential for rapid changes in the threat landscape.