I just got an email that looked like it came from Apple. It looked like I or someone pretending to be me had changed some settings on my AppleID, something that is entirely possible given I’ve had to reset my password many times and I just downloaded several major updates from Apple yesterday. But was it a real email from Apple, no it was a phishing exercise from Russia.
Nothing good ever comes from mail.ru and I know Russians, this email comes from p-online.ru whatever that is. Here is the email with complete Internet headers, don’t get fooled by this Apple fans.
From ???@??? Thu Sep 19 16:42:37 2013 Return-path: <firstname.lastname@example.org> Envelope-to: email@example.com Delivery-date: Thu, 19 Sep 2013 19:26:44 -0400 Received: from [188.8.131.52] (helo=p-online.ru) by 01-ah-r29u34-ss30.alphahosting.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from <firstname.lastname@example.org>) id 1VMncR-0004JC-Rg for email@example.com; Thu, 19 Sep 2013 19:26:44 -0400 Received: from www by p-online.ru with local (Exim 4.69 (FreeBSD)) (envelope-from <firstname.lastname@example.org>) id 1VMnj1-0002qO-U0 for email@example.com; Fri, 20 Sep 2013 03:33:31 +0400 Date: Fri, 20 Sep 2013 03:33:31 +0400 To: firstname.lastname@example.org From: AppIe <email@example.com> Reply-To: Subject: Notice of Update Message-ID: <firstname.lastname@example.org> X-Priority: 3 X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version ] MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset="iso-8859-1" Sender: World Wide Web Owner <email@example.com> [ This message was sent as HTML. The text you see here was ] [ generated by Mailsmith; the original HTML is available as ] [ an enclosure. ] Hello, The following information for your ID was updated : Account informations If these changes were made in error, or if you believe an unauthorized person accessed your account, please reset your account information immediately by going to update.appIe.com <http://appleid.abaclia.vox.md/apple.com>. This is an automated message. Please do not reply to this email. Thanks, Apple Customer Support