nerdlimited[.]com

The domain nerdlimited.com was observed by multiple threat‑intelligence feeds as a brand‑impersonation site targeting Apple users. The site was registered on July 03 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare edge address 104.21.3.77, which is associated with ASN 13335 in the United States. DNS resolution is served by the Cloudflare name servers kellen.ns.cloudflare.com and paislee.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating a valid TLS handshake despite the malicious intent. The HTTP response returned a 503 Service Unavailable status and the page title reported by scanners is “Welcome to nginx!”. No content beyond the default nginx placeholder was captured, and the site is currently taken offline.

Technical analysis shows the presence of Zoho services, Cloudflare Browser Insights, and HTTP/3 support, suggesting the use of legitimate SaaS components to lend credibility to the infrastructure. VirusTotal scans recorded 13 detections out of 95 security vendors, and AlienVault OTX listed the domain in one pulse. PhishDestroy has blocked the domain and it appears on a single security blocklist. The listed scam type is “Tech Support Scam”, and the domain is explicitly noted to impersonate Apple, indicating that any support‑related communications are likely fraudulent. While the available data confirms the domain’s association with a tech‑support impersonation campaign, the exact payload, phishing pages, or victim interaction flow have not been publicly disclosed.

The limited number of blocklist entries and the recent creation date suggest the operation may be in an early deployment stage, but the presence of multiple vendor detections implies active distribution. Defenders should continue to monitor DNS queries for nerdlimited.com and enforce deny‑list rules at the network perimeter. Blocking the associated IP 104.21.3.77 at the firewall or proxy level can prevent accidental access.