iver[.]info

The domain iver.info was observed as part of a brand‑impersonation campaign targeting Apple. The site was registered on 16 August 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the OpenProvider name‑server set ns2.openprovider.be, ns3.openprovider.eu, ns1.openprovider.nl. DNS resolution points to IP 203.161.63.11, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. The HTTPS service is protected by a Let’s Encrypt R13 certificate, indicating the presence of a valid TLS handshake but offering no assurance of legitimacy.

VirusTotal analysis recorded 16 detections out of 95 scanned engines, and the domain appears on one public blocklist. Gridinsoft assigned a trust score of 0 / 100, and PhishDestroy has listed the site as blocked. AlienVault OTX references the domain in sixteen separate threat‑intel pulses, all classifying it as a brand‑impersonation vector. The only publicly visible page title returned by the HTTP response is “iVer | Marketing”, which does not directly reference Apple, and no further page content has been disclosed.

As of the report date (23 July 2026) the host is reported offline, limiting active verification of the payload. Content of the landing page, credential‑collection mechanisms, and any associated malware have not been publicly released, so the exact attack flow remains unknown. Defenders should add 203.161.63.11 to network deny lists, block iver.info at DNS or proxy layers, and monitor for any future re‑registration of the domain or similar OpenProvider name‑servers. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection posture, and correlation with other Apple‑related phishing indicators may help identify broader campaign infrastructure.