applefilevault[.]com

Analysis of the domain applefilevault.com indicates it is an active phishing infrastructure impersonating Apple's iCloud or FileVault security services. Registered on June 08, 2026, through DYNADOT LLC, the domain resolves to the IP address 104.21.7.18, which is associated with Cloudflare's network, as confirmed by its nameservers ethan.ns.cloudflare.com and walk.ns.cloudflare.com. This hosting choice is common among phishing operators seeking to obscure the true origin of their infrastructure and leverage Cloudflare's privacy features. As of August 05, 2026, the domain remains active and is flagged by 15 of 91 security vendors on VirusTotal, suggesting detection as malicious by a subset of the security community.

It also appears on at least one security blocklist, specifically PhishDestroy, further corroborating its classification as a phishing threat. The combination of recent registration, Cloudflare hosting, and detection by multiple security vendors aligns with patterns observed in phishing campaigns targeting Apple users, though the exact content or functionality of the site has not yet been analyzed. Defenders should treat this domain as high-risk infrastructure. Network-level blocking of 104.21.7.18 and the domain itself is recommended, particularly for organizations with Apple-centric user bases.

Monitoring for related domains registered through DYNADOT LLC or resolving to Cloudflare IPs may help identify additional phishing assets. While the domain's registration details do not include obvious red flags beyond its recent creation, the convergence of detection by security vendors and its presence on a blocklist provides sufficient evidence to classify it as malicious. Further investigation into the site's content and any associated email or SMS campaigns is advised to determine the full scope of the threat.