Phishing detection: app-icloudrecover.click
Apple Screenshot
No screenshot available yet
Captured automatically on the next refresh cycle
Investigate
Domain
app-icloudrecover.click1 CT host on apex
urlscan
VirusTotal
Whois
IP
31.56.209.114
ipinfo
Greynoise
URL
https://app-icloudrecover.click
Phishunt analysis Beta
30
low suspicionheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +4.0 Young domain
- +2.2 Country mismatch
- +1.7 Shared IP cluster
- +1.6 Favicon (kit)
- +1.3 Suspicious TLD
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +1.0 Site cluster
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.7 Unrecognised DNS provider
- +0.5 Long domain
- +0.3 Free CA
- +0.1 Hyphens
19 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
A newly registered .click domain (4 days old) uses iCloud recovery wording to impersonate Apple account recovery, likely to steal Apple ID credentials. Google Safe Browsing flags it, and its favicon matches a known phishing kit.
Google Safe BrowsingYoung domainFavicon (kit)
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-29 · confidence 75%
Domain & Network
Whois
Registrar
Sav.com, LLC
Network
Country
The Netherlands
The Netherlands
Hosting
SWISSNET LLC
ASN
AS209373
TLS Cert
YR1
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
Apple
Submit to blocklists