If a page says your lost iPhone was found, it should never ask for your phone's passcode
Who may be targeted: Anyone who has recently lost an iPhone, or had one stolen, and is hoping to hear that it has been found.
What we are seeing
A message may tell you that your lost or stolen iPhone has been found, with a link to a map. The map looks convincing, but it is not Apple's, and the phone shown on it is not yours. Before it will show you anything, the page asks for the code you use to unlock your phone screen. Apple never asks for that code on a web page. If a page says the code is wrong and asks you to type it again, that is not a mistake on your part; it is how the page gets a second copy.
Warning signs
- The page asks for the code that unlocks your phone screen. Apple never asks for this on a web page.
- It says your code is wrong and asks you to type it again.
- The web address starts with a lowercase L, so "lcloud" is standing in for "icloud".
- The web address ends in .co instead of .com.
- The page shows a phone model or a city that is not yours.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
lcloud.find-ld[.]co
Source and limitations — what this alert does not establish
- CSRF reviewed the page itself, not the message that delivered it; the delivery method is not established.
- The device model and location shown on the page are fixed values and do not reflect any real device or any real person's location.
- The page's script contains comments written in Spanish and a fixed location in Colombia; neither establishes the identity, nationality, or physical location of whoever created or operates the page.
- The page carried an internal link reference number; a reference number is not a count of recipients or of affected people.
- CSRF cannot confirm whether any specific person entered information into this page.
- A recent registration date, a look-alike name, or a match in a public phishing feed is a signal and does not by itself prove who is responsible.
- The page may move to other addresses, and related pages may use different wording or ask for a different code length.
First observed Sep 16, 2026. Published Sep 16, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.