mail[.]icloud-localizado[.]us

mail.icloud-localizado.us targeted Apple ID credentials, leveraging the recognizable 'icloud' branding to deceive users. Despite being taken down, the domain was flagged as malicious by 9 out of 91 vendors on VirusTotal and appeared on three public blocklists, including PhishDestroy, OpenPhish, and Phishunt. Its registration through Dynadot Inc and hosting by Unified Layer in the US facilitated its operations.

The domain was created on June 6, 2026, and detected by PhishDestroy on June 22, 2026. This phishing attempt highlights the critical window between domain registration and detection by antivirus vendors. PhishDestroy's early detection capabilities are crucial in identifying threats during this period, as evidenced by the domain's presence on blocklists despite its offline status.

With a platform risk score of 75/100, mail.icloud-localizado.us posed a significant threat while active. The use of a familiar brand like Apple increases the likelihood of successful credential theft, emphasizing the need for continuous monitoring and rapid response to new phishing domains. The swift takedown of such domains is essential to mitigate potential damage to unsuspecting users.