findlapple[.]us

This domain, findlapple.us, is flagged as an active credential theft phishing infrastructure targeting Apple users. Analysis indicates the domain is designed to impersonate Apple’s official login portals, likely to harvest user credentials, payment details, or other sensitive information. The use of a deceptive domain name combining "find" and "apple" suggests an attempt to exploit users searching for Apple support or services, a common tactic in brand impersonation campaigns. No evidence of a crypto drainer kit was observed, but the domain’s structure aligns with credential harvesting operations. Infrastructure analysis reveals the following technical indicators: the domain is detected by 6 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. It resolves to the IP address 162.144.180.56, a host that may be shared with other malicious domains. The domain’s SSL certificate is issued by Let’s Encrypt, a common choice for phishing sites due to its free and automated issuance process. Registration details, including the registrar and creation date, were not provided in the initial data, but the domain’s active status suggests recent deployment. Google Safe Browsing (GSB) status is not specified, though the 6/95 detection rate implies partial blocklisting across security platforms. Current status of findlapple.us remains active, with no evidence of takedown or mitigation at this time. The elevated risk level is justified by the domain’s operational status, brand impersonation tactics, and partial detection by security vendors. Users are advised to block the domain at the network level and monitor for associated indicators, including the IP 162.144.180.56. Organizations should update endpoint protection rules to include this domain and educate users on recognizing brand impersonation attempts. Given the domain’s active status, continued monitoring is recommended to assess further developments or shifts in infrastructure.