mail[.]idcloud-lost[.]us

mail.idcloud-lost.us is a subdomain of idcloud-lost.us. PhishDestroy first observed the hostname on Jun 22, 2026. Stored page analysis classifies the content as generic phishing. Current evidence score: 98/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and URLQuery. VirusTotal recorded 9 detections among 91 engines: alphaMountain.ai, Cluster25, CRDF, Fortinet, G-Data, Gridinsoft, MalwareURL, Sophos, Webroot on Jul 6, 2026 at 22:02 UTC. URLQuery recorded 2 threat-system alerts on Jun 22, 2026 at 10:22 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Jun 22, 2026 at 10:30 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:02 UTC.

Cloaking was recorded with HTTP 502 on Aug 7, 2026 at 01:20 UTC. The cloaking probe recorded content divergence conditional delivery at 1/100 on Aug 7, 2026 at 01:20 UTC: dead_http: raw=http_502; http=502; via=http_proxy. Registration records for the registrable domain idcloud-lost.us list Dynadot Inc as the registrar and Jun 16, 2026 as the creation date. Registration preceded first observation by 6 days. At collection time, the hostname resolved to 207.174.215.249 on AS46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US). The recorded endpoint location is Provo, US. The stored server header is Apache. DOM analysis on Jun 22, 2026 at 14:20 UTC returned 98/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt / YR2 as the certificate issuer with validity through Sep 18, 2026; checked Jun 22, 2026 at 13:00 UTC.

The content indicators and 2 positive source findings support the current generic phishing classification.