poll[.]apple-cl0ud[.]com

The domain poll.apple-cl0ud.com was registered on October 5 2023 through Tucows Domains Inc. and is currently active, returning HTTP 200. It is listed on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a malicious reputation. VirusTotal records show that nine of ninety‑five scanned security vendors flag the domain as malicious, reinforcing its classification as a high‑risk threat. Infrastructure analysis shows the domain resolves to IP address 34.243.17.125, which belongs to AS16509 Amazon.com, Inc. and is geolocated to Ireland. The authoritative nameservers are dns.technorail.com, dns2.technorail.com, dns3.arubadns.net, and dns4.arubadns.cz, a configuration often observed in transient phishing deployments. The site presents a valid SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain, and HTTP Strict Transport Security (HSTS) is enabled. Content on the site mimics Apple branding and is identified as a tech‑support scam, leveraging the appearance of a legitimate poll page to lure victims. The page title matches the fully qualified domain name, a tactic that reinforces the impersonation of Apple services. The domain has been blocked by PhishDestroy, confirming its use in active phishing campaigns targeting Apple users. Defenders should add poll.apple-cl0ud.com to block lists at DNS and proxy layers and monitor outbound connections to the associated IP address 34.243.17.125. Email gateways should be tuned to detect and quarantine messages that reference this domain or similar Apple‑related subdomains. Continuous threat‑intel feeds should be consulted for any additional indicators of compromise linked to the listed nameservers and the underlying Amazon hosting infrastructure.