iphone-iforgot[.]live

PhishDestroy identifies iphone-iforgot.live as an Apple ID phishing site designed to harvest user credentials under the guise of a legitimate Apple recovery portal. The domain mimics Apple’s “iforgot” service, likely deployed to trick victims into surrendering their Apple ID passwords and associated personal data. No evidence of a crypto drainer kit was detected during analysis, indicating the primary objective is credential theft rather than direct financial asset exfiltration.

This domain was flagged with a VirusTotal detection score of 14/95 security vendors, registered through Gransy, s.r.o., and resolves to IP 31.148.99.121. The domain was created on March 05, 2026, and currently holds a valid SSL certificate issued by Let’s Encrypt. It has been blocked by two major threat intelligence feeds: OpenPhish and PhishingArmy. Despite its recent registration, the domain’s high-risk profile is further evidenced by its presence on multiple security blocklists and the use of a legitimate but misused SSL certificate intended to deceive users.

PhishDestroy continues to monitor iphone-iforgot.live as an active threat with elevated risk. Immediate action includes blocking the domain at the network level and preventing user access via browser-based URL filtering. However, the persistence of such domains highlights the ongoing risk of short-lived phishing campaigns leveraging deceptive naming conventions and valid SSL certificates. Users are strongly advised to verify the authenticity of Apple ID recovery pages by visiting https://iforgot.apple.com directly and enabling two-factor authentication to mitigate account takeover risks.