fin[.]tedfullwood[.]com

Analysis of fin.tedfullwood.com indicates that the site was registered on June 10, 2005 through GoDaddy.com, LLC. The domain resolves to the IPv4 address 2.56.173.6, which is assigned to AS209847 (WorkTitans B.V.) and geolocated in Finland. The hosting infrastructure uses three nameservers operated by afraid.org (ns1.afraid.org, ns2.afraid.org, ns3.afraid.org). An SSL certificate presented by the server is issued to PhishDestroy / botadmin.destroy.tools, confirming a known phishing‑related kit. HTTP requests receive a 200 OK response and the page title reported by crawlers is “Apple”, matching the declared brand target of Apple. The site is classified as a tech support scam, a subcategory of brand impersonation.

Reputation services flag the domain heavily: Scamadviser assigns a trust score of 1/100, Gridinsoft a score of 0/100, and the domain appears on one security blocklist. VirusTotal scans show that 15 of 95 antivirus engines label the host as malicious. PhishDestroy has already blocked the domain, and the current operational status is reported as offline. The available evidence confirms that the domain was used to impersonate Apple in a tech‑support fraud campaign.

However, the exact content served to victims, such as specific scripts or social engineering text, is not observable because the site is offline. Defenders should continue to block traffic to 2.56.173.6 and to fin.tedfullwood.com at network perimeter, update URL filtering lists with the domain, and monitor for any future re‑registration that may reuse the same infrastructure or certificate attributes. Additional hunting can focus on other subdomains under the same registrar and nameserver set, as well as any newly observed certificates that reference PhishDestroy or botadmin.destroy.tools. Continuous ingestion of detection feeds that reference the 15 VirusTotal positives will help maintain coverage against this campaign.