appleallpay[.]github[.]io

The domain appleallpay[.]github[.]io is currently active and serves a page titled "Apple Customer Service". Registration occurred on 21 February 2025 through GitHub, Inc., and the site presents a valid Let’s Encrypt R12 certificate. DNS resolution points to IP 185.199.109.153, which belongs to the Fastly network (AS54113) located in the United States. An HTTP 200 response is returned, indicating the web server is reachable. Threat intelligence classifies the site as a tech‑support scam that impersonates Apple, falling under the brand‑impersonation category with a high risk rating. Reputation services reflect extreme distrust: Gridinsoft assigns a 10/100 score and Scamadviser a 10/100 score. VirusTotal analysis shows 19 of 93 security vendors flag the domain, and two independent blocklists – PhishDestroy and PhishingDB – already list it as malicious. Given the combination of a trusted hosting provider, a legitimate TLS certificate, and the use of a Fastly CDN, the malicious content is likely hosted on a compromised or abused account rather than a dedicated malicious infrastructure. The precise content of the page has not been examined, so the exact tactics employed remain unknown. However, the presence of a brand‑impersonating title and the tech‑support scam label suggest that users may be prompted to grant remote access or provide credentials. Defenders should immediately block the domain at network perimeter and endpoint filters, add the associated IP address to deny lists, and monitor for similar subdomains created through GitHub pages. Users should be warned not to engage with unsolicited Apple‑related support requests and to verify official Apple communication channels. Continuous feed updates from blocklist providers and periodic re‑scans are recommended to track any changes in the domain’s reputation.