icloudphotos[.]litong5969[.]work

PhishDestroy identifies icloudphotos.litong5969.work as an active brand impersonation scam targeting Apple users. This domain closely mimics Apple's iCloud Photos service to deceive victims into entering credentials or payment details. The site leverages social engineering tactics, exploiting trust in Apple's brand to harvest sensitive information. No drainer kit or advanced malware delivery mechanisms were observed during the initial investigation, though this may evolve as the campaign matures.

Technical indicators confirm this domain as a high-risk impersonation threat. VirusTotal reports a 12/95 detection rate at the time of analysis, indicating it remains undetected by most AV engines. The domain is registered through Alibaba Cloud Computing Ltd. d/b/a HiChina and resolves to IP address 50.71.105.230. It was created on March 10, 2021, and secured with a Let's Encrypt SSL certificate. The domain has not been flagged by Google Safe Browsing (GSB) and remains absent from major blocklists as of the latest scan.

The threat is currently active and under ongoing investigation by PhishDestroy’s threat intelligence team. No immediate public blocklists have been updated to flag this domain, though proactive blocking is recommended for users and organizations. The remaining risk is considered moderate due to its low detection rate and potential for rapid evolution. Users are advised to avoid interacting with this domain and report any suspicious activity to PhishDestroy or Apple Security for further analysis.