icloudmail[.]live

This domain, icloudmail.live, poses as an official Apple iCloud Mail login page to trick visitors into entering their credentials. It is a classic brand impersonation phishing attack, designed to harvest Apple IDs and passwords. The site was registered through GoDaddy and was found to have a page title of 'iCloud Mail - Apple iCloud', closely mimicking the real iCloud Mail interface. Because the domain is now offline, the immediate risk is reduced, but anyone who visited and entered their details should take action immediately.

PhishDestroy identified this threat through multiple security checks. VirusTotal shows that 10 out of 95 security vendors flagged the domain as malicious, indicating a high level of consensus among security tools. The domain was created on March 27, 2026, and was registered through GoDaddy.com, LLC, a common registrar for phishing sites due to its ease of use. The SSL certificate was issued by Google Trust Services, which is a legitimate certificate authority, but that does not guarantee the site's safety. Additionally, the domain was found in one threat intelligence pulse on AlienVault OTX and appeared on one security blocklist. The IP address 188.114.96.3 is associated with Cloudflare, which can be used to hide the true hosting location.

If you visited icloudmail.live and entered any personal information, especially your Apple ID and password, you should change your Apple account password immediately and enable two-factor authentication if you haven't already. Also, monitor your account for any suspicious activity. For those who simply browsed the site without entering data, the risk is lower, but it is always wise to be cautious. PhishDestroy recommends running a full security scan on your device and being vigilant against future phishing attempts. Remember, legitimate Apple services will never ask for your password via email or a third-party site.