applive-en-us[.]pages[.]dev

PhishDestroy identifies applive-en-us.pages.dev as an active Apple brand impersonation phishing domain designed for credential theft. The threat actor is leveraging Cloudflare Pages to host a spoofed Apple login portal, likely intended to harvest user credentials for Apple accounts. While no crypto-drainer kit has been confirmed in this configuration, the domain’s structure mirrors known credential harvesting templates used in recent Apple-themed phishing campaigns across iOS, macOS, and web environments. The domain’s rapid deployment via Cloudflare’s Pages service suggests an attempt to evade traditional domain-based detection while leveraging reputable infrastructure for initial legitimacy.

Technical indicators for applive-en-us.pages.dev reveal a highly suspicious profile despite low immediate detection. The domain resolves to IP 188.114.97.3, hosted on Cloudflare infrastructure, and is registered through Cloudflare, Inc., obscuring true ownership. A Google Trust Services SSL certificate adds superficial legitimacy, common in phishing campaigns to bypass browser warnings. Currently, VirusTotal reports 8/95 detection engines flagging the domain or its IP, indicating that signature-based defenses have not yet identified the threat. Given the use of Cloudflare Pages, historical creation date remains challenging to verify, but the domain’s active status and SSL issuance suggest deployment within the past 30 days. Google Safe Browsing (GSB) has not yet added this domain to its blocklist, and public blocklist aggregators show no record, leaving users vulnerable to first-contact exposure.

The current status of applive-en-us.pages.dev remains active and under investigation by threat intelligence teams. Despite the absence of detections, the domain’s Apple-themed structure, Cloudflare Pages hosting, and SSL certificate form a clear pattern of brand impersonation phishing. Immediate defensive actions include adding this domain to enterprise and personal blocklists, reporting to Google Safe Browsing via their submission portal, and increasing user awareness around Apple-branded login prompts outside of verified domains like apple.com or icloud.com. While the risk remains investigatory, the combination of low detection, active hosting, and high-fidelity imitation places this domain in the high-risk category until further analysis or takedown occurs. Users are advised to avoid entering credentials on any page linked to this domain and report it via phishing reporting channels for further takedown action.