buff[.]163[.]complete[.]hotclassicrock[.]com

The domain buff.163.complete.hotclassicrock.com is currently offline but was observed resolving to the Amazon‑owned address 34.250.16.241 located in Ireland. Registration was performed through the RIPE NCC registrar, indicating a legitimate regional internet registry entry, yet the infrastructure choice of an AWS hosting provider is common for rapidly deployed malicious sites. The site presented the page title “BUFF163 skin trading platform, DOTA2 skin trade, CS2 skin trade”, which does not reference the targeted brand, but the intelligence file classifies the operation as an Apple impersonation campaign, suggesting that the underlying content likely included Apple‑related lures not captured in the title snapshot. No SSL certificate was deployed, leaving the site accessible only over HTTP, a characteristic often seen in short‑lived phishing deployments.

The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, confirming that at least one external remediation platform recognized it as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low reputation assessment. VirusTotal scanned the domain with 95 antivirus engines, none of which raised a detection at the time of analysis; however, the absence of detections does not imply safety, especially given the targeted brand claim and the presence on a blocklist. For defenders, the immediate recommendation is to add the domain and its resolved IP address 34.250.16.241 to network‑level deny lists and to monitor for any re‑registration or similar sub‑domain patterns under the hotclassicrock.com parent zone.

Because the registrar is RIPE NCC, future registrations may reuse the same registrar, so alerts on new domains created by the same registrant could provide early warning. Endpoint protection solutions should be updated to include the domain in URL filtering policies, even though current URL reputation services may not yet flag it.