{"success":true,"data":{"id":"apple-id-suspended-cross-domain","label":"Fake Apple ID suspended / locked notice sent from a non-Apple domain claiming the target must verify identity to restore iCloud, App Store, or Find My access — credential-harvest cross-domain phish. Real Apple security alerts originate from apple.com / icloud.com only and link back to appleid.apple.com.","description":"Fake Apple ID suspended, locked, or \"verify to keep iCloud\" notice sent from a non-Apple sending domain (From / Reply-To / link domains do not align with apple.com / icloud.com / appleid.apple.com) demanding the recipient click a verification link to restore App Store, iCloud, Find My, or Apple Pay access — credential-harvest cross-domain phish targeting the Apple ecosystem. Real Apple security communications originate exclusively from apple.com or icloud.com with DMARC-aligned signing and always direct users back to appleid.apple.com or the Settings app on their device — never to third-party domains. The cross-domain mismatch (off-brand sender + off-brand verification link) is the defining signal. Distinct from generic account-suspended-phish — this targets the Apple ID / iCloud / App Store / cross-domain From-link mismatch pretext. Detection: Apple brand vocabulary (Apple ID suspended, iCloud locked, verify to restore) + sender or link domain ≠ apple.com / icloud.com / appleid.apple.com + no DMARC alignment. Trash score: +5. Source: GC1-R31; APWG Apple impostor phishing report 2025; Apple Support anti-phishing guidance; FTC tech-platform impostor advisory.","tier":"warning","category":"other","isThin":false}}