Phishing detection: down.c-icloud.com

Apple
https://down.c-icloud.com Access site
Screenshot
Screenshot of down.c-icloud.com
Investigate
Domain down.c-icloud.com6 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 154.204.240.42
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://down.c-icloud.com
urlscan Wayback archive.today
Cert YE1
crt.sh Censys Google CT
Phishunt analysis Beta
33 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +4.1 Site cluster
  • +3.5 ASN reputation
  • +3.4 Cert reuse
  • +3.4 Shared IP cluster
  • +2.2 Country mismatch
  • +1.1 No CSP header
  • +0.9 Young certificate
  • +0.8 Young domain
  • +0.7 Bulletproof DNS
  • +0.6 Registrar reputation
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
  • +0.1 Deep subdomain
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Apple iCloud via a typosquatted domain with a download-themed subdomain. Hosted in Hong Kong by an abuse-linked registrar. Shares infrastructure with multiple iCloud-branded subdomains on the same IP, potentially used to deliver phishing payloads to Apple users.

Google Safe BrowsingCountry mismatchShared IP cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-03 · confidence 65%
Domain & Network
Whois
Registrar Chengdu Fly-Digital Technology Co., Ltd.
Network
IP 154.204.240.42
Country Hong KongHong Kong
Hosting LUOGELANG (FRANCE) LIMITED
ASN AS135097
TLS Cert YE1
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 934153e122fc (5 members total)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
m.c-icloud.com 87 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert same favicon same screenshot
active 2026-09-03
wap.c-icloud.com 87 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert same favicon same screenshot
active 2026-09-03
h5.c-icloud.com 84 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert same favicon same screenshot
active 2026-09-03
c-icloud.com 77 same apex same IP same nameservers similar name same registrar appeared together (24h) certs issued together same TLS cert similar colors same favicon
active 2026-09-03
Top 4 of 4 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Brand owner Apple
reportphishing@apple.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-03 05:24 UTC  ·  Last refreshed 2026-09-04 03:30 UTC