napdealin-shop3[.]top

This domain, napdealin-shop3.top, is identified as a brand impersonation threat targeting Apple. Analysis indicates the site was designed to mimic legitimate Apple services, likely to harvest credentials or distribute fraudulent offers. The page title, FacebookShop, suggests an attempt to blend into social commerce traffic while exploiting Apple’s brand reputation to lower user defenses. Infrastructure analysis reveals the domain was registered on December 16, 2025, through NameSilo, LLC. It resolves to the IP address 156.238.246.111, hosted under AS137899 (I LAYER LIMITED) in Hong Kong. Security vendors on VirusTotal flagged the domain with a detection score of 19/95, and it appears on one security blocklist. The SSL certificate is classified as R13, a common indicator in low-reputation or ephemeral phishing infrastructure. No association with known crypto drainer kits or Google Safe Browsing (GSB) listings was observed at the time of analysis. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated. Users who interacted with the site should assume potential exposure of credentials or personal data. Organizations are advised to monitor for related domains under the same registrar or hosting provider, as threat actors often reuse infrastructure. If credentials were entered, affected parties should rotate passwords and enable multi-factor authentication on all associated accounts.