by[.]shangheju[.]com

This domain, by.shangheju.com, is identified as a high-risk brand impersonation threat specifically targeting Apple customers. The infrastructure was designed to mimic legitimate Apple services, likely aiming to harvest credentials, payment details, or other sensitive user information. The page title 'TikTok Wholesale' suggests an attempt to disguise the true intent of the domain, potentially to evade automated detection systems or mislead users into believing they are interacting with a legitimate platform unrelated to Apple. Analysis indicates that by.shangheju.com resolves to the IP address 154.82.90.78, hosted on a server located in Singapore under AS399077 Tcloudnet. The domain was registered on August 31, 2017, through Gname.com Pte. Ltd., and is currently flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and is explicitly flagged for phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services, specifically under the WE1 intermediate, which may lend a false sense of legitimacy to unsuspecting users. Users who visited by.shangheju.com should take immediate action to mitigate potential risks. If any credentials or payment information were entered, affected individuals should change their passwords for Apple and any other accounts where the same credentials may have been reused. It is also recommended to monitor financial statements for unauthorized transactions and enable multi-factor authentication on all sensitive accounts. Given the domain's current offline status, users should remain vigilant for similar threats, as infrastructure associated with such campaigns may be reactivated or repurposed under different domains.