icloudocs[.]com

This domain, icloudocs.com, is flagged as a high-risk brand impersonation targeting Apple users. Registered on September 15, 2025, through Dynadot LLC, the domain resolves to the IP address 23.254.129.180 and is currently active as of July 12, 2026. Infrastructure analysis reveals the use of an SSL certificate issued by Hestia Control Panel, a detail that may aid in identifying related malicious infrastructure. The domain has been detected in 23 threat intelligence pulses, indicating widespread recognition of its malicious nature across security communities. The page title, 'Index of /', suggests the domain may be hosting an open directory or misconfigured server, which is often leveraged in phishing campaigns to distribute malicious payloads or redirect victims to credential-harvesting pages. While the exact content of the site has not been fully analyzed, the domain is explicitly identified as impersonating Apple, a common tactic to deceive users into divulging sensitive information such as iCloud credentials or personal data. The domain appears on two security blocklists and is flagged by 9 out of 95 security vendors, further corroborating its malicious classification. Defenders should prioritize blocking this domain at the network level, particularly in environments where Apple-related services are in use. The domain's association with known malicious infrastructure, combined with its recent registration and active status, warrants immediate action to mitigate potential threats. Monitoring for connections to the resolving IP address, 23.254.129.180, may also help identify compromised systems or additional malicious activity linked to this campaign. Given the domain's persistence and high-risk designation, organizations should treat any interaction with it as suspicious and investigate accordingly.