icloud-searchdevices[.]help

The domain icloud-searchdevices.help was registered on November 12, 2025 through NameSilo, LLC and is currently taken offline. DNS resolution points to IP 158.94.208.249, which is assigned to AS202412 (Omegatech LTD) in Germany. The host provides no SSL certificate, indicating that any HTTP service would be unencrypted. Google Safe Browsing classifies the domain as a social engineering threat, and 21 of 95 security vendors on VirusTotal have flagged it, reflecting a strong consensus of malicious intent.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single known security blocklist. It is also listed in 16 AlienVault OTX pulses, reinforcing its association with active threat campaigns. The nameservers a1.sigtryg.com and a2.sigtryg.com are used for resolution, but no additional infrastructure details are disclosed. The site is identified as impersonating Apple and is categorized as a Tech Support Scam, suggesting that any content would likely attempt to convince victims to grant remote access or provide payment for bogus support services.

Defenders should block the domain at network perimeter and DNS layers, monitor for outbound connections to the associated IP, and ensure that endpoint security solutions are updated to include the 21 vendor detections. Since the site lacks TLS, any accidental access would expose clear‑text traffic, making it easier to inspect with proxies or sandbox environments if the domain reappears. Continuous watch of the associated nameservers and the host ASN is advisable, as changes could indicate redeployment of the same infrastructure under a new domain. Evidence from Google Safe Browsing, VirusTotal, Gridinsoft, OTX, and the PhishDestroy blocklist should be incorporated into threat intel feeds to improve detection accuracy.