apple-authenticator[.]com

The domain www.apple-authenticator.com was registered on 21 February 2026 and is currently taken offline. The site presented the page title “Apple Authenticator – Secure Your Digital Wallet” and claimed to target Apple users, aligning with a brand‑impersonation technique. The TLS certificate was issued by ZeroSSL under the RSA Domain Secure Site CA, indicating a freely‑issued certificate often used by malicious actors. DNS resolution points to IP 132.148.183.248, which belongs to AS26496 operated by GoDaddy.com, LLC and geolocates to the United States. The host has been placed on a single security blocklist and was actively blocked by the PhishDestroy service.

Reputation scoring from Gridinsoft recorded a trust score of 0 / 100, reflecting an extremely low confidence rating. VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, confirming at least one detection of malicious behavior. The identified scam type is a “Tech Support Scam,” suggesting that attackers may have attempted to lure victims into providing remote‑access credentials or payment for bogus support. No additional public indicators such as Safe Browsing, OTX, or further vendor detections were observed.

Because the site is offline, immediate traffic to the domain is unlikely, but the infrastructure—particularly the hosting IP and the SSL certificate—could be reused for future campaigns. Defenders should continue to monitor the IP address 132.148.183.248 for new activity, enforce blocklisting of the domain in web filters, and beware of similar Apple‑themed URLs that employ free TLS certificates. Organizations should educate users about unsolicited tech‑support calls and the risk of credential harvesting from impostor authentication portals. Further investigation is required to determine whether the single VirusTotal flag corresponds to a known payload or merely a heuristic detection.