# PhishDestroy threat dossier — icloud-longin.com ================================================================ Fetched: 2026-06-22 17:16:16 UTC Canonical: https://phishdestroy.io/domain/icloud-longin.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Apple Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/91 security vendors flagged this domain Flagging vendors: SOCRadar Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 207.174.215.249 (US, Provo) Hosting org: AS46606 Unified Layer Registrar: DYNADOT LLC Nameservers: ns1.md-35.webhostbox.net, ns2.md-35.webhostbox.net Registered: 2026-06-18 Expires: 2027-06-18 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-18 Status: INVALID chain Fingerprint: 281549c186a9ed06047561491ac2e61742b79ac9ca1c7ccb464c8399c93ae8e7 Subject Alternative Names (related infrastructure — often same operator): - 22-icloud.com - 33-icloud.com - cloud-lostdevice.us - device-detect.us - device-ifind.us - device-iphone.life - devicelocate.us - encontrar-my-iphone.us - find-phone-location.us - findmy-2.com - findmy-support1.com - findmy-supportjl.us - findmy2.support - flndme-com.info - flndmeapple.info ... +18 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-18 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-21 14:35:50 UTC (by PhishDestroy tracker) First reported: 2026-06-21 12:37:43 UTC (abuse notice filed) Last verified: 2026-06-22 18:40:12 UTC Neutralised: 2026-06-22 00:02:43 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eea2d-6724-72cd-99cd-aee85fb995cd/ URLQuery: https://urlquery.net/report/a5cdf062-9c6a-454a-936b-13394d17c800 Wayback Machine: https://web.archive.org/web/*/icloud-longin.com crt.sh CT logs: https://crt.sh/?q=%25.icloud-longin.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=icloud-longin.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/icloud-longin.com URLhaus: https://urlhaus.abuse.ch/host/icloud-longin.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-21 22:44:11 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Apple's iCloud service is being imitated by icloud-longin[.]com, a site that is actively evading security scanners with a cloaking score of 1/10. This generic scam is hosted on the IP 207.174.215.249 in Provo, US, by Unified Layer with the ASN AS46606, and was registered through DYNADOT LLC on 2026-06-18. The site is currently active and serves benign content to crawlers and bots, while serving malicious content to real visitors, with 1 of 91 vendors on VirusTotal flagging it as malicious and listed on 3 public blocklists including PhishDestroy, OpenPhish, and Phishunt. icloud-longin[.]com has an SSL certificate issued by Let's Encrypt. Defenders should update their blocklists to include icloud-longin[.]com. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260621-FFE65C TLS cert SHA-256: 281549c186a9ed06047561491ac2e61742b79ac9ca1c7ccb464c8399c93ae8e7 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/icloud-longin.com/ JSON API: https://api.destroy.tools/v1/check?domain=icloud-longin.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 167,758 domains (12,323 alive under monitoring, 155,117 confirmed takedowns/dead). Site: https://phishdestroy.io