11-icloud[.]com

Analysis of the domain 11-icloud.com indicates a recent brand‑impersonation campaign targeting Apple. The domain was registered on 31 May 2026 through Sav.com, LLC and resolves to the IPv4 address 162.251.80.247, which belongs to AS46606 (Unified Layer) located in the United States. Both authoritative name servers, ns1.md-79.webhostbox.net and ns2.md-79.webhostbox.net, are hosted on the same provider, suggesting a single‑tenant hosting environment. No TLS certificate is presented for the host, and the current HTTP status is reported as offline, meaning the site is not reachable at the time of assessment. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation.

VirusTotal scans show that 14 of 91 security engines flagged the domain, reinforcing the malicious classification. The domain appears on one public blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one anti‑phishing community has taken mitigation action. The listed scam type is “Brand Impersonation” and the intelligence explicitly notes that the domain impersonates Apple, although no page title or content has been captured for further verification. The evidence base therefore consists of registration data, hosting infrastructure, reputation scores, and blocklist inclusion.

Uncertainty remains around the exact payload or credential‑harvesting mechanisms because the site is offline and no page content has been archived. Defenders should continue to block DNS resolution for 11‑icloud.com, add the address 162.251.80.247 to network‑level deny lists, and monitor for any future re‑activation. Additional scrutiny of traffic to the associated name servers may reveal related infrastructure used in other Apple‑focused campaigns. Organizations that enforce strict outbound filtering to known Apple endpoints should treat any attempt to contact this domain as suspicious and trigger alerts.