gov-icloud[.]com

This domain, gov-icloud.com, is identified as a credential harvesting platform designed to impersonate Apple's iCloud service. Analysis indicates the site presents a counterfeit iCloud login interface, tricking users into submitting their Apple ID credentials. The objective is to capture sensitive authentication details, which can lead to unauthorized account access, data exfiltration, or further exploitation in targeted attacks. The use of a familiar brand interface, combined with SSL encryption, increases the likelihood of successful deception, particularly among users who may not scrutinize domain names closely. Infrastructure analysis reveals the domain was registered on April 28, 2026, through the registrar Gransy, s.r.o. It resolves to the IP address 31.148.99.121, hosted under the entity FOP Hornostay Mykhaylo Ivanovych in the United Kingdom. The domain is secured with a Let's Encrypt SSL certificate (R13), a common tactic to lend an air of legitimacy. Detection metrics show 23 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The domain has since been taken offline, though its prior activity remains a documented threat. Users who may have interacted with gov-icloud.com should take immediate remedial action. First, reset Apple ID credentials through Apple's official authentication portal, ensuring the use of multi-factor authentication. Review recent account activity for unauthorized access or transactions. Monitor linked devices and services for signs of compromise, such as unfamiliar logins or data modifications. If financial or personal data was entered, consider placing fraud alerts with relevant institutions. Organizations should update internal blocklists to include this domain and its associated IP to prevent future exposure.