sosovelue-com[.]homes

The domain sosovelue-com.homes was registered through Dynadot LLC on 20 November 2025 and is currently taken offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:3033::ac43:b762, which is owned by AS13335 Cloudflare, Inc., placing the host in the United States. Both authoritative nameservers, algin.ns.cloudflare.com and meiling.ns.cloudflare.com, are Cloudflare‑operated, indicating the attacker leveraged a reputable CDN to hide the true origin of the site. No TLS certificate was observed; the lack of SSL suggests the site either never served HTTPS or was deliberately removed when the domain was shut down.

The page title returned by the server, "Koç Oto Filo Kurumsal Filo Araç Kiralama | Rent A Car Hizmetleri," bears no relevance to the claimed Apple impersonation and provides no further insight into the malicious payload. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Apple, and it has been listed on two security blocklists. Detection vendors have identified the domain, with PhishDestroy and ScamSniffer actively blocking it. VirusTotal scans show two of ninety‑five security engines flagging the domain, reinforcing the suspicion of malicious intent.

A Gridinsoft trust score of 0 / 100 further confirms the low reputation. Because the site is offline, content‑level indicators such as login forms or credential‑harvesting scripts cannot be confirmed, leaving the exact phishing vector uncertain. Defenders should continue to enforce blocking of the domain at perimeter filters, ensure that any cached DNS entries are purged, and monitor for re‑registration or the appearance of similar sub‑domains hosted on the same Cloudflare IP range. Ongoing vigilance is advised, especially for email gateways and web proxies that may still reference the domain in legacy phishing campaigns targeting Apple users.