Apple iCloud phishing landing page: tokenized /help?TOKEN with spoofed Find My m

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule identifies potential Apple iCloud phishing attempts by monitoring web proxy logs for requests containing specific indicators of a spoofed 'Find My' page. It specifically looks for URLs that include '/help?' combined with keywords like 'Find Devices', 'Geräte finden', 'icloud', or 'findmy', which are common markers for malicious phishing landing pages attempting to harvest user credentials.