mail[.]findmy-support1[.]com

Analysis of mail.findmy-support1.com shows a high‑risk brand‑impersonation campaign targeting Apple users. The domain was registered on May 31, 2026 through Sav.com, LLC and resolves to IP address 207.174.215.249, which belongs to the Unified Layer network (AS46606) located in the United States. The hosting infrastructure uses the nameservers ns1.md-35.webhostbox.net and ns2.md-35.webhostbox.net, and the site was served over a Let’s Encrypt YR2 certificate, indicating that TLS was correctly configured at the time of observation. The page title returned by the server is "iCloud," matching the Apple brand that the campaign seeks to mimic.

Google Safe Browsing has flagged the domain for social engineering, and the site appears on one external security blocklist as well as on PhishDestroy’s blocklist, reinforcing the malicious classification. A Gridinsoft trust score of 0 / 100 further reflects the lack of legitimacy. VirusTotal scans recorded 15 detections out of 91 security vendors, confirming that multiple detection engines recognize the domain as malicious. The domain’s current status is offline, but historical evidence suggests it was actively used before takedown.

Uncertainty remains regarding the exact payload delivered to victims, as no page content or login form details have been disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any residual referrals to the IP address or associated nameservers. Incident response teams should also search for email artifacts that reference the iCloud branding and correlate them with the registration timestamp to identify potential compromise timelines.