qoq[.]pfz[.]mybluehost[.]me

This domain is flagged as an elevated-risk brand impersonation threat targeting Apple iCloud users. Analysis indicates the site was designed to harvest credentials by mimicking the legitimate iCloud login interface, as evidenced by the page title 'iCloud' and confirmed brand impersonation classification. Infrastructure analysis reveals the domain qoq.pfz.mybluehost.me was registered on October 05, 2016, through Domain.com - Network Solutions, LLC. It resolves to the IP address 50.6.34.21, hosted on AS31898 (Oracle Corporation) in Germany. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two additional security blocklists. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain. The domain has since been taken offline, though it was previously blocked by multiple threat intelligence feeds. Mitigation against this specific threat type involves implementing domain-based email filtering rules to quarantine messages containing references to qoq.pfz.mybluehost.me or its resolved IP. Network administrators should update web proxy and DNS filtering policies to block resolution of the domain and its associated IP. End users should be trained to verify domain authenticity before entering credentials, particularly when prompted by unsolicited login requests. Organizations are advised to monitor for credential reuse attempts, as harvested credentials from this campaign may be leveraged in subsequent account takeover attempts.