mail[.]support-icloudmyjhhs[.]info

The domain mail.support-icloudmyjhhs.info is currently active and classified as a high‑risk generic phishing site. DNS resolution points to the single IPv4 address 96.125.163.17, indicating a likely dedicated hosting environment for the malicious payload. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has observed malicious activity associated with this host. VirusTotal analysis shows that 1 of 91 scanned security vendors flagged the domain, providing an additional independent indication of compromise.

Nameserver queries returned NS_NOT_FOUND, meaning authoritative name server information could not be retrieved at the time of analysis; this limits visibility into the registration and hosting infrastructure. No SSL/TLS certificate data, HTTP response codes, page title, or content signatures are available, so the exact phishing lure or target brand cannot be confirmed from the current evidence set. The lack of further telemetry leaves the full scope of the campaign uncertain, but the existing indicators—IP address, blocklist presence, and vendor flag—justify a high‑confidence assessment of phishing intent.

Defensive actions should include immediate network‑level blocking of the domain and its resolved IP, inclusion of the host in intrusion‑prevention signatures, and continuous monitoring of the IP for any new associated domains. Analysts should also query passive DNS and WHOIS sources for registration details and watch for changes in the nameserver configuration that could reveal additional command‑and‑control infrastructure. Given the active status and high risk rating, organizations are advised to treat any traffic to this domain as malicious and to educate users about unsolicited communications that reference iCloud or Apple‑related services, as attackers often exploit such brand trust to harvest credentials.