22-icloud[.]com

This domain, 22-icloud.com, is actively impersonating Apple’s iCloud service to deceive users into submitting credentials or personal data. Analysis indicates the site mimics legitimate Apple login pages, likely designed to harvest usernames, passwords, and potentially two-factor authentication codes. The threat extends to possible follow-up attacks, including account takeovers or unauthorized access to linked services such as iTunes, Apple Pay, or iCloud storage. Given the domain’s focus on Apple’s ecosystem, victims may also be targeted for phishing-related financial fraud or identity theft. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Sav.com, LLC, a registrar commonly associated with malicious domains. It resolves to the IP address 207.174.215.249, hosted on AS46606 (Unified Layer), a network frequently observed in phishing campaigns. The domain is flagged by 13 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate, issued by Let’s Encrypt (YR2), provides a false sense of security while failing to validate the site’s legitimacy. Despite its recent creation date, the domain remains active and unmitigated. Users who have visited 22-icloud.com should immediately revoke any entered credentials by changing their Apple ID password and enabling two-factor authentication if not already active. Monitor linked accounts for unauthorized activity, including transactions, device logins, or changes to security settings. If financial data was submitted, contact the relevant institution to report potential fraud. Additionally, scan the device used to access the site for malware, as credential-stealing payloads may have been deployed. Report the domain to security teams or abuse contacts for further investigation and takedown efforts.