wolfandapples[.]com

On 22 July 2026, the domain wolfandapples.com was observed in an elevated‑risk brand‑impersonation campaign targeting Apple users. The domain was registered on 06 March 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the IPv4 address 172.67.169.237 located in the United States. DNS resolution points to the Cloudflare nameservers merlin.ns.cloudflare.com and sima.ns.cloudflare.com. No TLS certificate was presented at the time of analysis, indicating that the site was served over plain HTTP.

The page title returned by the server is “Wolf and Apples”, which does not contain overt Apple branding but the campaign metadata classifies the activity as a tech‑support scam that impersonates Apple, suggesting that social‑engineering scripts may have been used to convince victims that they require assistance with Apple products. The domain appears on a single security blocklist, specifically PhishDestroy, and was flagged by one of ninety‑four VirusTotal scanners, confirming limited but non‑trivial detection across the security ecosystem. The site’s current HTTP status is offline, which may indicate that the operators have taken the infrastructure down or are rotating assets. Because the infrastructure relies on a shared Cloudflare IP, the address may be reused by unrelated legitimate services, and therefore blocking the IP alone could generate false positives.

Defensive recommendations include adding wolfandapples.com to domain‑based blocklists, monitoring for future resolution to the same IP or nameserver pair, and employing URL filtering that checks for the known page title “Wolf and Apples”. Organizations should also educate end‑users about unsolicited Apple‑related tech‑support calls, as the observed threat vector aligns with classic tech‑support social engineering. Continuous re‑evaluation is advised in case the actors reactivate the domain or deploy similar domains using the same registrar or hosting provider.