ilanrubinmusic[.]com

The domain ilanrubinmusic.com was identified as part of a brand impersonation phishing campaign specifically targeting Apple users. The domain is currently offline, but during its active period it posed a significant threat by mimicking legitimate Apple services to steal credentials or personal information. The site was hosted at IP address 35.209.20.5 and used an SSL certificate from Let's Encrypt (R13), a common choice for low-cost phishing infrastructure.

Analysis of the domain reveals several red flags. VirusTotal flagged it with 16 out of 95 security vendors marking it as malicious. The domain appears on two security blocklists and was found in 20 threat intelligence pulses on AlienVault OTX, indicating widespread recognition among threat researchers. Registered through GoDaddy.com, LLC on February 5, 2021, the domain’s title, "Welcome - ILAN RUBIN MUSIC," is unrelated to Apple, suggesting the phishing page was likely hosted on a subdirectory or hidden behind the legitimate-looking front. The use of a seemingly unrelated domain name is a common tactic to evade initial suspicion.

Though ilanrubinmusic.com has been taken offline, users should remain vigilant. Anyone who visited the site and entered credentials or personal data should change their Apple account passwords immediately and enable two-factor authentication. Organizations should ensure their security tools block the domain and the associated IP address. PhishDestroy recommends monitoring for similar domains registered via GoDaddy and using threat intelligence feeds to stay ahead of evolving phishing campaigns.