recovery-lcloudsphone[.]help

The domain www.recovery-lcloudsphone.help was registered on March 17 2026 through NameSilo, LLC and is currently taken offline. Infrastructure analysis shows the domain resolves to IP 185.218.124.255, a server operated by Contabo GmbH in France. The nameservers ns1.dnscloudmail.lat and ns2.dnscloudmail.lat are associated with the same hosting provider. No SSL certificate is presented, meaning the site does not support HTTPS, a common characteristic of fraudulent pages that avoid encryption.

The page title observed before takedown was “Find Devices – Apple iCloud,” indicating the site attempted to impersonate Apple’s iCloud device‑location service. The scam type is explicitly listed as brand impersonation targeting Apple, and the site incorporated Apple MapKit JS, HSTS headers, and Akamai CDN components, further mimicking legitimate Apple infrastructure. Trust metrics are uniformly negative: Gridinsoft assigned a score of 0 out of 100, the domain appears on a single security blocklist, and PhishDestroy has already blocked it. VirusTotal analysis recorded a single vendor flag among 95 scanners, reinforcing the malicious classification.

The combination of a newly created domain, absence of TLS, low trust score, and the use of Apple‑specific assets points to a deliberate attempt to harvest credentials or lure victims into a credential‑harvesting flow. Because the site is offline, detailed payload inspection is not possible, leaving the exact malicious behavior uncertain. Defenders should continue to block the domain and its hosting IP, monitor DNS queries for the associated nameservers, and add the domain to internal phishing‑prevention lists. Continuous observation of the IP range used by Contabo GmbH is advised, as the provider may host additional malicious actors.