This domain, 1f-icloud.com, was registered on July 29, 2026 through Sav.com, LLC and is currently active. Infrastructure analysis shows the domain resolves to the IP address 96.125.163.17 and uses the authoritative name servers cns59.webhostbox.net and cns60.webhostbox.net. The IP is hosted by a provider that is not publicly identified in the supplied data, and no ASN or country information is available, limiting geographic attribution. VirusTotal has flagged the domain in five out of ninety‑one scanned security vendors, indicating a non‑trivial detection rate for malicious activity.
The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, reinforcing the assessment that it is being used for phishing. No additional evidence such as SSL certificate details, HTTP response codes, Safe Browsing status, or page title has been provided, so the content and exact phishing vector remain unverified. Defenders should treat any traffic to 1f-icloud.com as malicious and block resolve-to IP 96.125.163.17 at the network perimeter.
Monitoring of DNS queries for the two Webhostbox name servers is recommended to detect potential internal resolution attempts. Because the domain is newly created, its short lifespan suggests a throwaway operation typical of phishing campaigns, and rapid takedown requests to the registrar Sav.com, LLC may be effective. Continuous re‑evaluation is advised as additional intelligence, such as content analysis or further blocklist listings, becomes available.