myphone-app[.]us

Analysis of the domain myphone-app.us indicates it was actively impersonating Apple's iCloud service as of July 23, 2026. The domain resolved to IP address 207.174.215.249, hosted on AS46606 (Unified Layer) in the United States. Infrastructure checks reveal the page title was explicitly set to 'iCloud,' aligning with the identified brand impersonation targeting Apple. The domain was flagged by 10 of 91 security vendors on VirusTotal, though it is currently offline, limiting further real-time verification. It appears on one security blocklist and was blocked by PhishDestroy, reinforcing its classification as a phishing threat.

The SSL certificate was issued by Let's Encrypt (YR2), a common choice for both legitimate and malicious domains. MX records point to mail.myphone-app.us with priority 0, suggesting potential email-based attack vectors, though no direct evidence of email abuse is confirmed. Nameservers ns1.md-35.webhostbox.net and ns2.md-35.webhostbox.net indicate hosting via a shared provider, a frequent pattern in phishing infrastructure. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

Defenders should treat this domain as part of a brand impersonation campaign targeting Apple users. While the site is offline, historical resolution data and detection metrics remain relevant for retrospective blocking and threat hunting. No additional scam-specific details (e.g., credential harvesting, account takeover flows) are available from the current dataset. Monitoring for re-activation or related domains under the same nameservers or IP range is recommended.