Criticalscore 64 · flagged Friday, October 2, 2026

gps-apple.cloud

Appeared in the .cloud zone on Friday, October 2, 2026; by the end of that day the census found active website about hosting & domains. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

ambiguous brand word
matched: apple
+4
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: NAMECHEAP
+8
brand name at a watch-list registrar
matched: NAMECHEAP
+6
page impersonates a brand
matched: PayPal
+22
form on a brand-styled page
matched: has_form
+18
Registrar
NAMECHEAP
Nameserver provider
Nameservers
everton.ns.cloudflare.com, heather.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
IvanOFFS
Has a form
yes
Brand echoed
apple

Model opinions

Second opinionlooks like abusetarget: Appleconfidence 80%· claude-opus-5-5

The page is its own branded 'IvanOFFS' iPhone/IMEI unlocker panel (PayPal appears only as a payment option), with a Telegram operator contact and a login posting to onoffs.pro. It sits on a brand-squat name 'gps-apple.cloud', a shape typical of the Find-My/iCloud-unlock ecosystem used against owners of stolen phones, so this is a brand-squatting unlock-service front rather than a direct Apple login phish.

First passlooks like abuseconfidence 92%· claude-haiku-4-5

The domain gps-apple.cloud hosts IvanOFFS, a self-branded IMEI/device unlocking service with its own login and branding. While the domain name contains 'apple' (a typosquat element), the page does not impersonate Apple, PayPal, or any other brand—it presents itself as IvanOFFS throughout. The service itself (IMEI unlocking, device unbricking) is typically used to bypass carrier locks and activation locks on stolen devices, making this a clear abuse case (unlicensed/illicit device services) rathe

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, October 2, 2026

Screenshot of gps-apple.cloud taken by the zone census on 2026-10-02

Same data as JSON: /api/zone/domain/gps-apple.cloud. This page is not indexed by search engines and does not link to the site it describes.