iCloud sign-in reverse proxy (adversary-in-the-middle) behind e-signature lures (hunting rule)

Phishing kit that relays Apple's real iCloud website and Apple Account sign-in through the attacker's own domain (an adversary-in-the-middle reverse proxy), so the victim signs in on what looks like a genuine Apple page while the operator captures the password, the two-factor code and the signed-in session. Seen behind DocuSign- and Clixsign-themed e-signature lures: docusignaccessportal[.]com redirects to na4.clixsignportal[.]pro, a 'Welcome! Redirecting you in 3 seconds' page, which sends the visitor on to the proxy at my-docusign-documents[.]com. The proxy shows its iCloud page only to visitors who arrive through the lure; anyone else is redirected to the website of a genuine e-signature company. This hunt matches the proxied iCloud page itself by its structure, and tracks the operator's lure and proxy domains.