347182-icloud[.]com

347182-icloud.com was registered on June 15 2026 through the registrar CNOBIN INFORMATION TECHNOLOGY LIMITED. The domain resolves to the single IPv4 address 178.16.54.253 and is delegated to the authoritative name servers ns1.virtualine.org and ns2.virtualine.org. Within days of creation the domain appeared on at least one public security blocklist and has been actively listed by the PhishDestroy feed, indicating that community‑based defenses have already identified it as malicious. VirusTotal scans report that seven of ninety‑one anti‑malware engines currently flag the domain as malicious, providing modest but consistent automated detection evidence.

The domain’s current status is “active,” and no public SSL certificate, HTTP status code, or page title has been disclosed, so the exact content served by the site remains unverified. The observable infrastructure—recent registration, a dedicated hosting IP, and rapid blocklist inclusion—is consistent with a generic phishing operation that typically exploits short‑lived domains to host credential‑harvesting pages. Absence of additional context such as a targeted brand, observed phishing landing page, or known malware payload prevents a deeper classification of the campaign.

Nevertheless, the combination of registrar information, DNS configuration, and vendor detections warrants a high‑risk rating. Defensive recommendations include immediately adding 347182-icloud.com and its resolving IP 178.16.54.253 to network deny lists, configuring DNS firewalls to block queries to ns1.virtualine.org and ns2.virtualine.org, and continuing to monitor the domain for changes in TLS configuration or HTTP response. Analysts should also submit the domain to sandbox environments to capture any payloads if the site becomes reachable, and update detection signatures as new technical artifacts become available.