findmy2[.]support

Analysis of findmy2.support reveals active brand impersonation of Apple with an iCloud page title serving as the primary lure. The domain resolves to 207.174.215.249 under AS46606 in the United States and was registered on May 26 2026 via Sav.com LLC using nameservers ns1.md-35.webhostbox.net and ns2.md-35.webhostbox.net. Detection signals include a Gridinsoft trust score of 0/100 presence on one security blocklist and VirusTotal flags from 4 out of 95 vendors. The site returns HTTP status 200 with a Let's Encrypt SSL certificate and remains operational as of the July 12 2026 report date while being categorized under generic phishing within the brand impersonation threat type.
Infrastructure details point to a webhostbox.net hosted configuration that supports the observed Apple service mimicry without additional kit indicators. The combination of low trust metrics and external blocking by PhishDestroy establishes concrete evidence of malicious deployment rather than benign coincidence. Registration age of approximately six weeks aligns with patterns where short-lived domains are used to evade initial reputation checks.
Uncertainties persist around the precise payload delivery since only metadata such as page title and HTTP response are confirmed without full content enumeration. No additional ASN or country-specific anomalies beyond the listed US location are documented. The single blocklist appearance and moderate VirusTotal ratio indicate detection is emerging but not yet widespread across all vendors.
Defenders should implement immediate DNS and IP blocks for 207.174.215.249 alongside the domain itself in mail gateways and endpoint policies. Continuous monitoring of nameserver patterns associated with webhostbox.net and Sav.com registrations is recommended to catch variants. Integration of the high risk classification into internal feeds will support proactive filtering of Apple-themed lures while tracking future blocklist expansions.