iphonebuscar[.]support

This domain, iphonebuscar.support, is flagged as a credential-harvesting phishing site targeting Apple users through brand impersonation. The site mimics Apple’s iCloud login interface, as indicated by its page title and known intelligence, aiming to capture user credentials or sensitive information. No specific drainer kit signatures have been identified, but the infrastructure aligns with typical phishing campaigns targeting cloud service logins.

Analysis indicates the domain was registered on March 29, 2026, through Gransy, s.r.o., and resolves to the IP address 31.148.99.121. Detection metrics reveal a VirusTotal score of 20/95 security vendors flagging the domain as malicious. It appears on one security blocklist and is assigned a trust score of 0/100. The site employs an SSL certificate issued by Google Trust Services and runs on Apache HTTP Server, a common web server technology exploited in phishing operations.

Currently, iphonebuscar.support is offline, having been taken down or suspended. It was blocked by at least one security provider, mitigating immediate risk. However, residual threats persist, including potential reuse of the infrastructure or registration of similar domains. Organizations and users are advised to monitor for related indicators, such as the IP address or registrar patterns, and implement blocking measures for domains registered through high-risk providers. Continuous vigilance is recommended due to the elevated risk of recurring phishing attempts targeting the same brand.