Phishing detection: c-icloud.com

Apple
https://c-icloud.com Access site
Screenshot
Screenshot of c-icloud.com
Investigate
Domain c-icloud.com6 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 154.204.240.42
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://c-icloud.com
urlscan Wayback archive.today
Cert YE1
crt.sh Censys Google CT
Phishunt analysis Beta
33 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +4.1 Site cluster
  • +3.5 ASN reputation
  • +3.4 Cert reuse
  • +3.4 Shared IP cluster
  • +2.2 Country mismatch
  • +1.1 No CSP header
  • +0.9 Young certificate
  • +0.8 Young domain
  • +0.7 Bulletproof DNS
  • +0.6 Registrar reputation
  • +0.3 Free CA
  • +0.2 Long domain
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
16 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Root domain of a typosquatted iCloud phishing cluster hosted in Hong Kong by a registrar flagged for abuse. Flagged by Google Safe Browsing for social engineering. Serves as the apex of multiple iCloud-branded subdomains on the same IP targeting Apple account credentials.

Google Safe BrowsingCountry mismatchKeyword match
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-03 · confidence 60%
Domain & Network
Whois
Registrar Chengdu Fly-Digital Technology Co., Ltd.
Network
IP 154.204.240.42
Country Hong KongHong Kong
Hosting LUOGELANG (FRANCE) LIMITED
ASN AS135097
TLS Cert YE1
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 934153e122fc (5 members total)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
down.c-icloud.com 77 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert similar colors same favicon
active 2026-09-03
h5.c-icloud.com 77 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert similar colors same favicon
active 2026-09-03
m.c-icloud.com 77 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert similar colors same favicon
active 2026-09-03
wap.c-icloud.com 77 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert similar colors same favicon
active 2026-09-03
Top 4 of 4 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Brand owner Apple
reportphishing@apple.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-03 05:24 UTC  ·  Last refreshed 2026-09-04 03:30 UTC