icloudoficial[.]com

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation, specifically targeting Apple users. The threat involves a fraudulent iCloud login portal designed to harvest credentials by mimicking Apple's official authentication interface. Analysis indicates the site employs social engineering tactics to deceive victims into entering sensitive account details, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the domain icloudoficial.com was registered on February 18, 2026, through Gransy, s.r.o. It resolves to the IP address 31.148.99.121 and uses an SSL certificate issued by Let's Encrypt (R12). VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while it appears on 2 security blocklists. The page title explicitly displays 'iCloud,' reinforcing the impersonation of Apple's legitimate service. The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Mitigation requires immediate action from organizations and individuals potentially exposed. Apple users who accessed the domain should reset their iCloud credentials via Apple's official channels and enable multi-factor authentication. Network administrators should block the domain and its associated IP (31.148.99.121) at the perimeter, while monitoring for indicators of credential theft or unauthorized access. Security teams should review logs for connections to the domain or IP, particularly from endpoints with Apple-related services. User awareness training should emphasize verifying domain authenticity before entering credentials, especially for cloud services.