Another Apple ID phishing scam

[Jessica Lares]

Just got this e-mail today.

From: apple <no-reply@apple.com> via in3.hostgator.in

Subject: Warning! your ID has been frozen temporarily

Dear Customer,

We have updated the section 9 of the security policy and our privacy to make our website more safer, simpler and more convenient for our customers,you tried to login to your account from several different places at the same time and that is why Your account has been frozen temporarily, If you have read and agree to save your account and reactivate your account, please follow the instructions and apologize for any inconvenience .

click on the following link verify your information : Verify Now >.

This is an automated message. Please do not reply to this email. If you need additional help, visit Apple Support.

Thanks,
Apple Customer Support

And here are the headers:

Delivered-To: jessicalares@gmail.com
Received: by 10.58.188.44 with SMTP id fx12csp217655vec;
Mon, 23 Sep 2013 15:59:34 -0700 (PDT)
X-Received: by 10.42.148.138 with SMTP id r10mr3578738icv.80.1379977174341;
Mon, 23 Sep 2013 15:59:34 -0700 (PDT)
Return-Path: <erictest@in3.hostgator.in>
Received: from in3.hostgator.in (in3.hostgator.in. [111.118.212.210])
by mx.google.com with ESMTPS id h1si12467700paw.249.1969.12.31.16.00.00
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 23 Sep 2013 15:59:34 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of erictest@in3.hostgator.in designates 111.118.212.210 as permitted sender) client-ip=111.118.212.210;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of erictest@in3.hostgator.in designates 111.118.212.210 as permitted sender) smtp.mail=erictest@in3.hostgator.in;
dmarc=fail (p=NONE dis=NONE) header.from=apple.com
Received: from erictest by in3.hostgator.in with local (Exim 4.80)
(envelope-from <erictest@in3.hostgator.in>)
id 1VOF6J-0001cR-6I
for jessicalares@gmail.com; Tue, 24 Sep 2013 04:29:31 +0530
To: jessicalares@gmail.com
Subject: Warning! your ID has been frozen temporarily
X-PHP-Script: 111.118.212.211/~erictest/index..php for 41.131.239.159
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: apple <no-reply@apple.com>
Message-Id: <E1VOF6J-0001cR-6I@in3.hostgator.in>
Date: Tue, 24 Sep 2013 04:29:31 +0530
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - in3.hostgator.in
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1046 32008] / [47 12]
X-AntiAbuse: Sender Address Domain - in3.hostgator.in
X-BWhitelist: no
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/erictest/public_html/index..php
X-Source-Dir: erictest.com:/public_html
X-Source-Sender:
X-Source-Auth: erictest
X-Email-Count: 29
X-Source-Cap: ZXJpY3Rlc3Q7ZXJpY3Rlc3Q7aW4zLmhvc3RnYXRvci5pbg==

Stay safe people!

 

[Intell]

You may want to remove your email address. There is one neat link within the email headers: http://111.118.212.211/~erictest/index..php It's not bad, just a PHP email script. Someone may want to contact HostGator and let them know about the spamming that's coming from a site they're hosting.

 

[Jessica Lares]

My e-mail address is out there anyway, it's OK. Not like they didn't hack my Yahoo, LivingSocial, Evernote, and every other account already these past few years.

The actual link points to a bicycle related website apparently (looking up the URL in Google). Dumb spammer.