trustdshvdxv.on-forge.com is a phishing page that impersonates Apple. It presents itself as an Apple support contact page under the title "Contact - Official Apple" and targets Apple customers looking for help with their accounts or devices. PhishDestroy first detected it on 2026-10-07. When last checked on 2026-10-19, the site was still online and serving its phishing content.
How the scam works
Fake "contact Apple" pages target people who already have a problem, such as a locked Apple ID, a suspicious charge or a lost device. Those visitors are primed to hand over whatever a support form asks for. Pages like this typically collect the victim's name, email, phone number and Apple ID credentials, and sometimes payment details under the pretext of verification. The stolen data lets attackers take over the Apple account, reach iCloud data and linked payment methods, or follow up with convincing fake-support calls and messages.
Evidence
On 2026-10-11, 19 of 92 VirusTotal engines flagged the site. They include BitDefender, ESET, Emsisoft, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and Chong Lua Dao. That spread across independent vendors shows the detection is not a one-off. urlscan.io independently returned a malicious verdict and identified Apple as the imitated brand, which matches the page title. Among blocklists, PhishDestroy currently lists it.
Infrastructure
The page sits on a randomly named subdomain of on-forge.com. The parent domain was registered through NameCheap, Inc. on 2024-10-13, nearly two years before this subdomain was caught. The meaningless "trustdshvdxv" label suggests a throwaway host created for a single campaign. Traffic is served through Cloudflare, Inc. from an address located in Canada, so the real origin server is hidden behind the network's proxy.
What to do
If you entered your Apple ID or password on this page, change the password immediately from Apple's official settings. Make sure two-factor authentication is on, and remove any trusted devices or phone numbers you don't recognise. If you submitted card details, contact your bank to block the card and dispute unfamiliar charges. Treat any later call, text or email claiming to be Apple support as suspect, and never share verification codes. Defenders should block the full hostname trustdshvdxv.on-forge.com at the DNS and proxy layer and watch for similar random subdomains under on-forge.com.
DOM Analysisanalyzed 2026年10月9日score 88/1002 brand signals
Submitted URLhttp://trustdshvdxv.on-forge.com/
Favicon Hash
Observed page title
Contact - Official Apple
Automated brand references
AppleApple Id
TLS証明書
発行者 Google Trust Services / WE1· stored validity ends in 62 days
Network & certificates
Stored technical evidence
Network & DNS
Shared CDN edge
Resolved IP
104.18.11.251
Network ASN
AS13335
Organization
Cloudflare, Inc.
Observed location
Toronto, CA
Server header
cloudflare
Edge-IP の評判はこのドメインに起因しません。
ネームサーバー 1
jay.ns.cloudflare.com
Location describes the IP network.
TLS証明書
Issuer
Google Trust Services / WE1
Valid from
2026-09-23 05:31:51
Valid until
2026-12-22 06:31:37
Hostname coverage
Certificate hostname mismatch
Validity
Within stored validity dates
Collection time
2026-10-07 10:02:03 UTC
Collection source
PhishDestroy collector
Certificate fingerprint5fae202ca6d0b7e1234bb466cc41a9a552b3df0a186edb61611c2900106a664eCertificate names · 1 SANs
on-forge.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-19 22:32:43 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:35:39 UTClast content: 2026-10-19 22:32:43 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
