50298-icloud[.]com

This domain, 50298-icloud.com, is flagged as a high-risk credential harvesting site designed to impersonate Apple's iCloud service. Analysis indicates the domain presents a fraudulent login interface under the page title 'iCloud,' aiming to collect user credentials through deceptive authentication prompts. No specific drainer kit signatures have been identified, but the infrastructure aligns with common phishing toolkits used for credential theft targeting cloud service users. Infrastructure analysis reveals the domain resolves to IP address 178.16.54.253 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 26, 2026. Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The creation date is anomalous, suggesting either a typographical error in registration records or an attempt to obfuscate the domain's age. Google Safe Browsing (GSB) status remains unconfirmed, and no additional blocklist entries beyond VirusTotal detections have been recorded at this time. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing emails, SMS campaigns, or malvertising. Response actions include submission to security vendor blocklists and monitoring for changes in hosting infrastructure. Despite low detection rates, the domain's active status and targeted impersonation of a widely used cloud service justify its high-risk classification. Users are advised to verify domain authenticity before entering credentials and to report suspicious URLs to their security teams for further analysis.