https://icloud.qpon/_frame/a_index.html

Impersonating Apple

Intent: Credential collection

• Domain is not operated by Apple
• Domain name closely resembles Apple's real domain
• DNS nameservers do not match Apple's known infrastructure
• TLS certificate has no organization information
• Domain was registered very recently
• Domain not registered through Apple's usual registrar

Apple Account sign-in page with email or phone number and password fields