Phishing detection: signin-icloud.sa.com
Apple Screenshot
Investigate
Domain
signin-icloud.sa.com1 CT host on apex
urlscan
VirusTotal
Whois
IP
108.167.146.200
ipinfo
Greynoise
URL
http://signin-icloud.sa.com/fl26
Phishunt analysis Beta
30
low suspicionheuristic risk score · not a probability
Keyword matchBrand impersonation in pathOpenPhish
18 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting
Impersonates Apple iCloud to harvest credentials. The site uses iCloud branding on a non-Apple domain registered via Sav.com and redirects victims to the real iCloud site after capture. Hosted on Oracle infrastructure and confirmed malicious by OpenPhish.
OpenPhishFinal host mismatchBrand impersonation in path
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-11 · confidence 85%
Domain & Network
Whois
Registrar
Sav.com, LLC
Network
Country
United States
United States
Hosting
Oracle Corporation
ASN
AS31898
TLS Cert
-
External detection
OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Brand owner
Apple
Submit to blocklists