bootstrap-app-clone[.]netlify[.]app

bootstrap-app-clone.netlify.app is a tenant hostname on Netlify, not a separately registered domain. PhishDestroy first recorded this hostname on Feb 11, 2026. Stored content metadata identifies Apple as the apparent target. The captured page title is “Apple Website- Naol”. Content analysis also recorded brand signals for Apple id, Icloud, Near, T-mobile, and Verizon. The stored content classification is tech support scam. Evidence score: 95/100 (critical).

Positive sources (3): VirusTotal, Cloudflare Radar, and URLScan. VirusTotal recorded 19 detections among 93 engines: ADMINUSLabs, Criminal IP, BitDefender, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, OpenPhish, Sophos, Trustwave, VIPRE, Webroot on Jul 18, 2026 at 14:45 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100 on Mar 26, 2026 at 12:47 UTC. Other stored checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. PhishStats returned no feed match on Mar 1, 2026 at 10:05 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:01 UTC; content was unavailable. Netlify is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 54.253.94.210 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The associated network metadata labels the endpoint as AS16509 Amazon.com, Inc. in Frankfurt am Main, DE. This is shared platform infrastructure; the IP and ASN are hosting context, not attribution to unrelated tenants. The stored server header is Netlify. DOM analysis completed on Jul 29, 2026 at 04:11 UTC without a scored DOM indicator (0/100); the source-based findings remained positive. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 2, 2026 at 04:12 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. The platform TLS certificate was issued by DigiCert Inc / DigiCert Global G2 TLS RSA SHA256 2020 CA1 with validity through Mar 19, 2027; checked Mar 15, 2026 at 05:56 UTC.

Content indicators and positive source findings support a Apple-themed tech support scam classification.