ipay-apple[.]com

Analysis of ipay-apple.com shows a newly registered domain created on 24 December 2025 that is currently taken offline. The domain resolves to the Amazon‑owned IP address 3.151.190.139 located in the United States and is advertised under ASN 16509. No TLS certificate is presented, indicating that HTTPS connections are unavailable. The authoritative name servers are ns71.cloudns.net, ns72.cloudns.com, ns73.cloudns.net and ns74.cloudns.uk, all belonging to the CloudNS service provider. The page title observed in prior captures, “Apple Pay Transaktion überprüfen - Binance”, explicitly references the Binance brand, confirming a brand‑impersonation campaign aimed at cryptocurrency users.

The scam type is identified as a crypto scam. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist. VirusTotal analysis recorded detections from 18 of 93 scanning engines, reinforcing the malicious classification. Additionally, AlienVault OTX has linked the domain in three threat‑intel pulses, and PhishDestroy has already blocked it.

Uncertainties remain regarding the exact phishing payload, as no page content beyond the title has been disclosed, and the HTTP response status is not available. The lack of SSL may limit credential capture but does not preclude other malicious actions such as redirecting victims to malicious wallets. Defenders should add ipay-apple.com to domain blocklists, monitor traffic to the associated IP 3.151.190.139, and enforce TLS inspection rules to detect any future attempts to serve content over HTTPS. Network and email filtering should be updated to flag references to “Apple Pay” alongside the Binance brand. Continuous monitoring of CloudNS name servers for new subdomains is advised, as the infrastructure could be reused for subsequent campaigns.