encontratmiiphone[.]us

Analysis of encontratmiiphone.us, created on 2026-06-03 and currently offline, shows it was used for brand impersonation of Apple. The domain resolves to IP 162.251.80.247, which belongs to AS46606 Unified Layer in the United States. Hosting is provided by the nameservers ns1.md-79.webhostbox.net and ns2.md-79.webhostbox.net. The site employed a Let’s Encrypt TLS certificate (YR2) indicating encryption was active at the time of observation.

Email services were provisioned through a single MX record pointing to mail.encontratmiiphone.us with priority 0. Reputation data are uniformly negative: Gridinsoft assigns a trust score of 0/100, and the domain appears on one external blocklist. VirusTotal recorded 15 detections out of 91 scanners, and PhishDestroy has listed the domain as blocked. Registration was performed via Dynadot Inc. The combination of a recent registration date, low‑trust score, active TLS, and multiple detections aligns with typical brand‑impersonation infrastructure.

Because the domain is now taken offline, active mitigation is limited, but defenders should continue to block the associated IP range and monitor for re‑use of the same nameservers or MX host. Automated filtering of outbound traffic to 162.251.80.247 and inclusion of encontratmiiphone.us in internal blocklists are recommended. Further investigation should focus on any residual DNS records or subdomains that may remain active, and on correlating the observed detections with other Apple‑related phishing campaigns to assess possible campaign overlap.