Apple login URL: the real address

Apple has 2 real sign-in addresses. If a link takes you anywhere else and asks for your Apple password, close it. We opened each address below on 9 November 2026.

Domains Apple uses

Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still Apple's.

• apple.com
• icloud.com

How to read the address

Look at the part between https:// and the first single /. Read it from the right. The real thing ends in apple.com or another domain listed below, with nothing but a dot before it.

• https://login.apple.com/… is Apple: it ends in .apple.com.
• https://apple.com.account-check.example/… is not: it ends in account-check.example, and Apple's name at the front is decoration.
• https://apple-secure-login.example/… is not: a hyphen makes a different domain, and anyone can register one.

Everything after the first / is chosen by whoever made the page, so …/apple.com/signin in the path proves nothing.

What fake Apple pages looked like

On 5 November 2026, PhishTank listed 37 live, verified phishing URLs that its volunteers labelled Apple.

• 94.6% used HTTPS. The padlock means the connection is encrypted, not that the site is Apple.
• 8.1% had "apple" in the hostname. Most fakes give no such clue, so the absence of Apple's name doesn't make a link safe either.
• 18.9% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.

Hostnames from the same list that use Apple's name without being Apple's, newest first. Dots are written as [.] so none of them is a working link.

• mail[.]cases-apple-id[.]com
• www[.]applecreditlimit[.]com
• appleid[.]scure[.]icu
• apple-icloud[.]azurewebsites[.]net
• applemymusic[.]com
• pkobp[.]appleenespanol[.]com

Report a fake Apple email or page

Forward suspicious emails that look like they come from Apple to reportphishing@apple.com.

Source: Apple: Recognize and avoid phishing messages, phony support calls, and other scams, checked 9 November 2026.

Lures to watch for

• "Your Apple ID has been locked" and fake App Store receipts are the usual lures. Check your account in Settings on your iPhone or Mac instead of following a link.
• If you get an unexpected call from someone saying they are Apple, Apple's advice is to hang up and contact Apple yourself.

Questions

What is Apple's official login URL?

account.apple.com (Your Apple Account (formerly Apple ID). appleid.apple.com still works too.); www.icloud.com (iCloud on the web: Mail, Photos, Find My). A real Apple address ends in apple.com, icloud.com, read from the right of the hostname.

How do I report a fake Apple email or website?

Forward suspicious emails that look like they come from Apple to reportphishing@apple.com.

Do fake Apple sites use Apple's name in the address?

In PhishTank's list of live phishing URLs on 5 November 2026, 3 of the 37 URLs labelled Apple (8.1%) had the brand's name in the hostname, so most gave no such clue. 94.6% used HTTPS, so a padlock proves nothing.

How we checked

• Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
• Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Apple count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
• Example hostnames: hostnames in the whole list that contain "apple" but aren't on Apple's domains, one per domain.

See also: official sign-in addresses of 15 brands.

Last updated: 9 November 2026, when the sign-in addresses were checked.