fdghsa[.]top

Analysis of the domain fdghsa.top indicates a high-risk brand impersonation campaign targeting Apple users, now offline as of July 23, 2026. The domain was registered on October 22, 2025, through NameSilo, LLC, and resolved to the IP address 118.107.59.220, hosted under AS152194 (CTG Server Limited) in Japan. No SSL certificate was present, increasing susceptibility to interception. The page title 'GOMALLO' does not match Apple’s branding, though the domain was explicitly classified as an Apple impersonation scam.

Detection data reveals moderate but consistent flagging: 14 of 95 security vendors on VirusTotal marked the domain as malicious, while Google Safe Browsing categorized it as social engineering. The domain appeared on a single security blocklist (PhishDestroy) and was included in 17 threat intelligence pulses on AlienVault OTX, suggesting prior reconnaissance by defenders. Trust scores from Gridinsoft and Scamadviser were both at the minimum (0/100 and 1/100, respectively), reinforcing its malicious classification. Infrastructure analysis shows Cloudflare nameservers (becky.ns.cloudflare.com and conrad.ns.cloudflare.com), a common tactic to obscure hosting origins and complicate takedowns.

The domain’s rapid detection and subsequent offline status indicate successful mitigation, though defenders should monitor for re-registration or related infrastructure reuse. Organizations are advised to block the domain and IP, review logs for prior connections, and alert users to potential credential exposure from this campaign. The exact phishing kit or payload remains unconfirmed, as no forensic artifacts were provided in the available intelligence.