mail[.]11-icloud[.]com

PhishDestroy has flagged the domain mail.11-icloud.com as a generic phishing threat, impersonating iCloud to steal user credentials. This domain is currently under investigation, but early analysis suggests it may be part of a credential harvesting campaign targeting Apple users. The domain was registered through Sav.com, LLC on May 31, 2026, a relatively recent creation date that often indicates malicious intent. It resolves to IP address 162.251.80.247, which may host other phishing sites. VirusTotal scans show 0 detections out of 95 engines, meaning no anti-virus vendors have flagged it yet — a common tactic for fresh domains to evade signature-based detection. Google Safe Browsing status is not available, and blocklist checks are pending.

The domain remains active and accessible, posing an ongoing risk to users who may inadvertently visit it. The threat type is generic phishing, but the domain name strongly suggests it targets iCloud login pages to harvest Apple IDs and passwords. No specific crypto drainer kit has been associated with this domain at this time. PhishDestroy recommends that users avoid visiting the domain and manually verify any communications claiming to be from iCloud or Apple. Organizations should monitor for attempts to access this domain from internal networks and consider blocking it at the firewall level. Further analysis is ongoing, and updates will be provided as new intelligence becomes available.