icloud-searchdevice[.]help

Analysis of icloud-searchdevice.help indicates a high‑risk brand‑impersonation infrastructure targeting Apple users through a tech‑support scam. The domain was registered on 1 November 2025 via NameSilo, LLC and uses the authoritative nameservers a1.sigtryg.com and a2.sigtryg.com. DNS resolution points to 158.94.208.249, an address assigned to AS202412 operated by Omegatech LTD in Germany. No TLS certificate is presented, leaving the site exposed to clear‑text interception and confirming the lack of legitimate HTTPS deployment.

Reputation services reflect a hostile profile: Gridinsoft assigns a trust score of 0 out of 100, Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has added the domain to its blocklist. VirusTotal records 17 detections out of 95 scanned engines, and AlienVault OTX cites the domain in 16 separate threat‑intel pulses, demonstrating broad awareness among security communities. The domain appears on a single additional blocklist, further confirming its malicious nature. The current operational status is offline, which may indicate a temporary takedown or a shift to a new command‑and‑control point.

Defenders should continue to block the domain and associated IP address at perimeter and DNS layers, monitor for any resurgence under related subdomains or new registrants, and enforce strict user awareness training regarding unsolicited Apple tech‑support calls that reference the icloud‑searchdevice.help URL. Indicators of compromise, including the domain name, IP address, registrar, and nameserver values, should be added to threat‑intelligence feeds and SIEM correlation rules. Because the site lacks SSL, any future activation would be readily observable on network traffic. Ongoing observation of the AS202412 range is advised to catch potential migration of the campaign.