mail[.]icloud-myfind[.]us

Analysis indicates that the domain mail.icloud-myfind.us was provisioned to impersonate Apple’s iCloud service. The site resolved to the IP address 207.174.215.249, which belongs to the Unified Layer hosting network (AS46606) located in the United States. The TLS certificate presented was issued by Let’s Encrypt and is identified as the YR2 certificate; no extended validation or Apple‑related attributes are present. The page title reported by the scanner is simply “iCloud,” confirming an attempt to reference the Apple brand.

Google Safe Browsing tagged the domain for social engineering, and the URL appears on one external blocklist. Independent reputation services have assigned a Gridinsoft trust score of 0 out of 100, reflecting a complete lack of trust. The domain has been black‑listed by the PhishDestroy service and was reported as taken offline at the time of collection. VirusTotal scanning shows that 14 out of 91 anti‑malware engines flagged the domain as malicious, underscoring the consensus that it is used for brand‑impersonation.

Nameserver information could not be retrieved (NS_NOT_FOUND), indicating possible use of dynamic or obscured DNS configuration. Defenders should immediately add mail.icloud-myfind.us to URL filtering rules, block traffic to the resolved IP 207.174.215.249, and monitor for any DNS queries to the domain. Because the site is already offline, incident response can focus on preventing future re‑use of the same hosting infrastructure; reviewing Unified Layer traffic and tightening outbound controls for connections to that AS may reduce exposure. Continuous monitoring of Google Safe Browsing, PhishDestroy, and VirusTotal feeds is advised to capture any re‑appearance of the domain or related indicators.