# Apple login URL: the real address > Apple's real sign-in page is on account.apple.com. How to tell a fake Apple link from the real one, with examples from 37 live phishing URLs. Canonical: https://www.phishclean.com/official-domains/apple Last updated: 2026-11-09 Apple has 2 real sign-in addresses. If a link takes you anywhere else and asks for your Apple password, close it. We opened each address below on 9 November 2026. account.apple.com Your Apple Account (formerly Apple ID). appleid.apple.com still works too. www.icloud.com iCloud on the web: Mail, Photos, Find My ## Domains Apple uses Not a complete list. Each address below can have subdomains in front of it (`www.`, `login.`), and they are still Apple's. - `apple.com` - `icloud.com` ## How to read the address Look at the part between `https://` and the first single `/`. Read it from the right. The real thing ends in `apple.com` or another domain listed below, with nothing but a dot before it. - `https://login.apple.com/…` is Apple: it ends in `.apple.com`. - `https://apple.com.account-check.example/…` is not: it ends in `account-check.example`, and Apple's name at the front is decoration. - `https://apple-secure-login.example/…` is not: a hyphen makes a different domain, and anyone can register one. Everything after the first `/` is chosen by whoever made the page, so `…/apple.com/signin` in the path proves nothing. ## What fake Apple pages looked like On 5 November 2026, PhishTank listed 37 live, verified phishing URLs that its volunteers labelled Apple. - **94.6%** used HTTPS. The padlock means the connection is encrypted, not that the site is Apple. - **8.1%** had "apple" in the hostname. Most fakes give no such clue, so the absence of Apple's name doesn't make a link safe either. - **18.9%** sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered. Hostnames from the same list that use Apple's name without being Apple's, newest first. Dots are written as `[.]` so none of them is a working link. - mail[.]cases-apple-id[.]com - www[.]applecreditlimit[.]com - appleid[.]scure[.]icu - apple-icloud[.]azurewebsites[.]net - applemymusic[.]com - pkobp[.]appleenespanol[.]com ## Report a fake Apple email or page Forward suspicious emails that look like they come from Apple to reportphishing@apple.com. Source: [Apple: Recognize and avoid phishing messages, phony support calls, and other scams](https://support.apple.com/102568), checked 9 November 2026. ## Lures to watch for - "Your Apple ID has been locked" and fake App Store receipts are the usual lures. Check your account in Settings on your iPhone or Mac instead of following a link. - If you get an unexpected call from someone saying they are Apple, Apple's advice is to hang up and contact Apple yourself. Not sure about a link? Paste it into the [free link checker](https://www.phishclean.com/check-link). It reads the address only and doesn't open the page. The [PhishClean browser extension](https://www.phishclean.com/) also checks each page you open for signs of a fake sign-in form. ## Questions ### What is Apple's official login URL? account.apple.com (Your Apple Account (formerly Apple ID). appleid.apple.com still works too.); www.icloud.com (iCloud on the web: Mail, Photos, Find My). A real Apple address ends in apple.com, icloud.com, read from the right of the hostname. ### How do I report a fake Apple email or website? Forward suspicious emails that look like they come from Apple to reportphishing@apple.com. ### Do fake Apple sites use Apple's name in the address? In PhishTank's list of live phishing URLs on 5 November 2026, 3 of the 37 URLs labelled Apple (8.1%) had the brand's name in the hostname, so most gave no such clue. 94.6% used HTTPS, so a padlock proves nothing. ## How we checked - **Sign-in addresses:** opened on 9 November 2026 and followed through every redirect to where the sign-in page loads. - **Phishing numbers:** [PhishTank](https://phishtank.org/)'s online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Apple count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/); method as in our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls). - **Example hostnames:** hostnames in the whole list that contain "apple" but aren't on Apple's domains, one per domain. See also: [official sign-in addresses of 15 brands](https://www.phishclean.com/official-domains). Last updated: 9 November 2026, when the sign-in addresses were checked.