buscarmeuiphone[.]com

Analysis indicates that buscarmeuiphone.com was registered on 9 May 2026 through TUCOWS.COM, CO. The domain resolves to 172.67.183.81, an address owned by Cloudflare (AS13335) and is served via Cloudflare’s infrastructure, including HTTP/3 and Cloudflare Browser Insights. The site presents a TLS certificate from Let’s Encrypt (E7) and returns an HTTP 302 status code, suggesting a redirection before content delivery. The page title “Buscar Dispositivos do iCloud” and the classification as a brand‑impersonation campaign targeting Apple indicate an attempt to lure victims into providing iCloud credentials. Threat intelligence sources corroborate the malicious intent: the domain appears in 50 AlienVault OTX pulses, is listed on two public blocklists, and has been blocked by PhishDestroy and PhishingDB. VirusTotal scans show 14 of 91 security engines flagging the domain as malicious. The infrastructure score from Gridinsoft is 0/100, reinforcing the high risk assessment. Defenders should add buscarmeuiphone.com to network denylists, monitor DNS queries for the associated Cloudflare nameservers (cecelia.ns.cloudflare.com, lex.ns.cloudflare.com), and enforce email and web filtering rules that detect the “Buscar Dispositivos do iCloud” phrase. Ongoing observation of related Cloudflare‑hosted IP addresses is advised, as the attacker may reuse the same infrastructure for additional impersonation campaigns.