# PhishDestroy threat dossier — 347182-icloud.com ================================================================ Fetched: 2026-07-26 00:11:34 UTC Canonical: https://phishdestroy.io/domain/347182-icloud.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Apple ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, ESET, Fortinet, G-Data, Gridinsoft Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 178.16.54.253 Registrar: CNOBIN INFORMATION TECHNOLOGY LIMITED Nameservers: ns1.virtualine.org, ns2.virtualine.org Registered: 2026-06-15 Expires: 2027-06-15 Page title: iCloud ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-26 00:29:14 UTC (by PhishDestroy tracker) First reported: 2026-07-25 22:30:20 UTC (abuse notice filed) Last verified: 2026-07-26 02:00:24 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f9b64-ed93-75b9-a22a-7fd59ec74dc2/ URLQuery: https://urlquery.net/report/d80c93cf-3c2d-46ad-b93f-cfb6fd43cdae Wayback Machine: https://web.archive.org/web/*/347182-icloud.com crt.sh CT logs: https://crt.sh/?q=%25.347182-icloud.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=347182-icloud.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/347182-icloud.com URLhaus: https://urlhaus.abuse.ch/host/347182-icloud.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 00:29:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 347182-icloud.com — Generic Phishing Investigation 347182-icloud.com was registered on June 15 2026 through the registrar CNOBIN INFORMATION TECHNOLOGY LIMITED. The domain resolves to the single IPv4 address 178.16.54.253 and is delegated to the authoritative name servers ns1.virtualine.org and ns2.virtualine.org. Within days of creation the domain appeared on at least one public security blocklist and has been actively listed by the PhishDestroy feed, indicating that community‑based defenses have already identified it as malicious. VirusTotal scans report that seven of ninety‑one anti‑malware engines currently flag the domain as malicious, providing modest but consistent automated detection evidence. The domain’s current status is “active,” and no public SSL certificate, HTTP status code, or page title has been disclosed, so the exact content served by the site remains unverified. The observable infrastructure—recent registration, a dedicated hosting IP, and rapid blocklist inclusion—is consistent with a generic phishing operation that typically exploits short‑lived domains to host credential‑harvesting pages. Absence of additional context such as a targeted brand, observed phishing landing page, or known malware payload prevents a deeper classification of the campaign. Nevertheless, the combination of registrar information, DNS configuration, and vendor detections warrants a high‑risk rating. Defensive recommendations include immediately adding 347182-icloud.com and its resolving IP 178.16.54.253 to network deny lists, configuring DNS firewalls to block queries to ns1.virtualine.org and ns2.virtualine.org, and continuing to monitor the domain for changes in TLS configuration or HTTP response. Analysts should also submit the domain to sandbox environments to capture any payloads if the site becomes reachable, and update detection signatures as new technical artifacts become available. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260725-567478 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/347182-icloud.com/ JSON API: https://api.destroy.tools/v1/check?domain=347182-icloud.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 193,953 domains (63,587 alive under monitoring, 128,816 confirmed takedowns/dead). Site: https://phishdestroy.io