# PhishDestroy threat dossier — appleexpo.eu ================================================================ Fetched: 2026-07-29 17:54:10 UTC Canonical: https://phishdestroy.io/domain/appleexpo.eu/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation Targeted brand: Apple Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: bot_redirect_safe) (score: 4/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 8/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, G-Data, Lionic, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 17.253.142.4 (US, Cupertino) ASN: AS714 Apple Inc. Hosting org: Apple Inc Registrar: Com Laude (Nom IQ Ltd, trading as) Nameservers: ["a.ns.apple.com", "d.ns.apple.com", "b.ns.apple.com", "c.ns.apple.com"] Registered: 2026-05-06 Page title: Apple HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Apple Inc. / Apple Public Server RSA CA 1 - G1 Expires: 2026-07-01 Status: INVALID chain Fingerprint: a80e54a0187361232a00b880fed8acca8d8c6af823aa9823279784c57deb2288 Subject Alternative Names (related infrastructure — often same operator): - 12diasderegalosdeitunes.com.es - airport.eu - apple-expo.eu - apple.ee - apple.eu - applecare.eu - applesports.es - applesports.eu - applestore.com.ee - applestore.com.eg - applestore.ee - applestore.eu - applestorepro.eu - appstore.com.eg - icloud.ee ... +44 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-06 19:30:14 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-07-29 16:20:45 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLQuery: https://urlquery.net/report/5eb5d28e-82aa-4acb-a40f-7a554d6009a2 Wayback Machine: https://web.archive.org/web/*/appleexpo.eu crt.sh CT logs: https://crt.sh/?q=%25.appleexpo.eu Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=appleexpo.eu AlienVault OTX: https://otx.alienvault.com/indicator/domain/appleexpo.eu URLhaus: https://urlhaus.abuse.ch/host/appleexpo.eu/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:37:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Apple brand impersonation site appleexpo.eu – high risk The domain appleexpo.eu was registered on May 06, 2026 through the registrar Com Laude (Nom IQ Ltd, trading as). The zone is delegated to four Apple‑owned name servers – a.ns.apple.com, b.ns.apple.com, c.ns.apple.com and d.ns.apple.com – which suggests the attacker is leveraging legitimate Apple DNS infrastructure to increase credibility. The domain resolves to the IP address 17.253.142.4, an address that belongs to Apple Inc. in the United States. Web traffic to the site returns an HTTP 301 redirect and the TLS certificate presented is issued to “Apple Inc.” by the Apple Public Server RSA CA 1 – G1. The page title displayed in the response is simply “Apple”, matching the target brand. These characteristics make the site appear indistinguishable from official Apple services at a cursory glance, especially when combined with the legitimate Apple name servers. Threat intelligence sources have begun to flag the domain. It appears on one security blocklist and has been listed by PhishDestroy as an active malicious site. VirusTotal analysis shows that 3 of 95 scanned security vendors have identified the domain as malicious. AlienVault OTX records two separate threat‑intel pulses that reference the same indicator. The Gridinsoft trust score is 0 out of 100, reinforcing the conclusion that the site is highly untrusted. Defenders should prioritize immediate containment. The domain should be added to outbound and inbound web filters, DNS sinkhole rules, and any existing URL reputation controls. Continuous monitoring of the IP address 17.253.142.4 for unexpected traffic patterns is advised, as the address is shared with legitimate Apple services and may be used for collateral damage. Incident response teams should also educate users about the brand‑impersonation technique and advise verification of URLs before credential entry. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: a80e54a0187361232a00b880fed8acca8d8c6af823aa9823279784c57deb2288 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/appleexpo.eu/ JSON API: https://api.destroy.tools/v1/check?domain=appleexpo.eu Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,499 domains (83,266 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io