public company · US
Apple
Apple Inc.
Consumer electronics and services.
- Primary official domain
- apple.com
- Reviewed official domains
- 2 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
60
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
2
domains first source-reported within 30 days
First observed, 30 days
65
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF ~all · 2/10 lookups · Mail: Not checked · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- appleidicloud
- Label aliases
- Apple ID · iCloud · Apple
- Official domains
- apple.com · icloud.com (all)
- Generated spellings
- 285 tracked · 157 observed somewhere · 128 not observed (all)
- Can receive mail
- 65 spellings and 13 reported domains publish MX records · mail at Above.com parking (parking placeholder) 17 · h-email.net (parking placeholder) 7 · Microsoft 365 7 · 35 more (157 spellings and 60 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
drive-icloud[.]comMail: MXSPF · checked 2026-10-19mail at eye-mail.net (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.237.129.108Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-108.ip.linodeusercontent.com172.237.129.236Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-236.ip.linodeusercontent.com172.237.129.242Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-242.ip.linodeusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
gatewayicloud[.]comMail: MXSPF · checked 2026-10-19mail at Above.com parking (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.182.247Trellian (Above.com parking)Trellian (Above.com parking) (AS133618) · AUlb-182-247.above.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloud-oficial[.]comMail: MX · checked 2026-10-19mail at mail.parktons.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive46.8.8.220GRANSY Gransy s.r.o. gransy.com (AS60592) · CZ46.8.8.222GRANSY Gransy s.r.o. gransy.com (AS60592) · CZ46.8.8.223GRANSY Gransy s.r.o. gransy.com (AS60592) · CZ46.8.8.224GRANSY Gransy s.r.o. gransy.com (AS60592) · CZ46.8.8.225GRANSY Gransy s.r.o. gransy.com (AS60592) · CZ46.8.8.226GRANSY Gransy s.r.o. gransy.com (AS60592) · CZchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloud[.]youMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at mail.icloud.you · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive85.17.9.154 · Confirmed phishing host address (DomainSpoof, 14 days)LEASEWEB-NL-AMS-01 Netherlands (AS60781) · NLchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
iconerp[.]icloudjo[.]comMail: MX · checked 2026-10-19mail at mail.icloudjo.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.20.41CloudflareCloudflare (AS13335) · US172.67.191.82CloudflareCloudflare (AS13335) · US2606:4700:3032::6815:1429CloudflareCloudflare (AS13335) · US2606:4700:3034::ac43:bf52CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudmail[.]liveMail: MXSPFDMARC · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · DMARC policy reject · sends via Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.77.57CloudflareCloudflare (AS13335) · US172.67.204.215CloudflareCloudflare (AS13335) · US2606:4700:3034::ac43:ccd7CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:4d39CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudmex-lost[.]comMail: MXSPF · checked 2026-10-19mail at eye-mail.net (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.237.129.108Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-108.ip.linodeusercontent.com172.237.129.236Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-236.ip.linodeusercontent.com172.237.129.242Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-242.ip.linodeusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudocs[.]comMail: MXSPF · checked 2026-10-19mail at Above.com parking (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.212.142Trellian (Above.com parking)Trellian (Above.com parking) (AS133618) · AUlb-212-142.above.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudsupport[.]co[.]ukMail: MXSPF · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.20.22CloudflareCloudflare (AS13335) · US172.67.190.218CloudflareCloudflare (AS13335) · US2606:4700:3036::6815:1416CloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:bedaCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudweb-ext860[.]clickMail: MXSPF · checked 2026-10-19mail at eye-mail.net (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.237.129.108Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-108.ip.linodeusercontent.com172.237.129.236Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-236.ip.linodeusercontent.com172.237.129.242Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-242.ip.linodeusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
icloudphotos[.]litong5969[.]workMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at mail.litong5969.work · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive24.79.111.216 · Confirmed phishing host address (DomainSpoof, 14 days)SHAW (AS6327) · CAs01060cea14fea9f6.wp.shawcable.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
magicloud[.]blogMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at magicloud.blog · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive95.175.103.103 · Confirmed phishing host address (DomainSpoof, 14 days)FICOLO (AS49282) · SEchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
storemanageappleid[.]comMail: MXSPF · checked 2026-10-19mail at mx02.mailcluster.com.au · sends via spf.mailcluster.com.au | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive116.90.50.205 · Confirmed phishing host address (DomainSpoof, 14 days)Oracle CloudOracle Cloud (AS31898) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
13 registrable domains · 13 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.