workhomeseller[.]com

This domain is flagged for elevated-risk brand impersonation targeting Apple users. Analysis indicates the infrastructure was designed to deceive victims into believing they were interacting with legitimate Apple services, likely through credential harvesting or fraudulent transaction prompts. The page title 'Shopee' suggests an attempt to mimic regional e-commerce platforms, potentially to exploit user familiarity with such interfaces while redirecting to Apple-themed fraudulent content. Infrastructure analysis reveals the domain workhomeseller.com was registered on November 06, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolves to IP address 172.67.217.165, hosted on Cloudflare's network (AS13335), a common obfuscation tactic to mask origin servers. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of unencrypted traffic. Security vendors on VirusTotal flagged the domain at 18/95 detections, indicating moderate consensus on its malicious nature. It appears on one security blocklist and was proactively taken offline, though historical resolution data confirms its prior operational status. Mitigation for this specific threat type involves immediate blocking of the domain and its associated IP across network security controls. Organizations should monitor for internal traffic to workhomeseller.com or similar Apple-themed impersonation domains, particularly those using Cloudflare IPs or registered through high-risk registrars like Gname.com. End-users should be educated on verifying domain legitimacy, especially for login or payment pages, and encouraged to inspect page titles and SSL certificates for inconsistencies. Given the domain's recent creation date, threat hunters should prioritize monitoring for newly registered domains with similar characteristics, including Apple-related keywords and Cloudflare hosting.