mail[.]apple-icloud[.]us

This domain, mail.apple-icloud.us, is identified as a high-risk credential harvesting site specifically designed to impersonate Apple’s iCloud services. Analysis confirms it operates as a brand impersonation threat, targeting users through fraudulent login interfaces to extract sensitive account credentials and personal information. The domain is currently offline but was actively used in phishing campaigns prior to takedown. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was flagged by 11 of 95 security vendors on VirusTotal, including detection by Phishunt, PhishDestroy, and PhishingArmy blocklists. It was registered through Dynadot Inc on June 03, 2026, and resolved to the IP address 162.251.80.247. The site employed a Let’s Encrypt SSL certificate to create a false sense of legitimacy, while its Gridinsoft trust score of 0/100 further confirms its malicious nature. The page title, mail.apple-icloud.us, was engineered to deceive users into believing they were accessing an official Apple service. Current status indicates the domain has been taken offline, though residual risk remains due to potential re-emergence under similar infrastructure. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related indicators, including the registrar (Dynadot Inc) and SSL certificate patterns, to detect future iterations. Users who may have interacted with the site should immediately reset their Apple credentials, enable multi-factor authentication, and review account activity for unauthorized access. Proactive threat hunting for domains mimicking Apple’s branding is recommended to mitigate similar threats.