{"id":5972,"date":"2011-05-19T00:42:53","date_gmt":"2011-05-19T07:42:53","guid":{"rendered":"http:\/\/37prime.wordpress.com\/?p=5972"},"modified":"2011-05-19T00:42:53","modified_gmt":"2011-05-19T07:42:53","slug":"scam-alert-fake-email-pretending-to-be-from-apple","status":"publish","type":"post","link":"https:\/\/37prime.com\/news\/2011\/05\/19\/scam-alert-fake-email-pretending-to-be-from-apple\/","title":{"rendered":"Scam Alert: Fake Email Pretending To Be From Apple."},"content":{"rendered":"

UPDATE:
\nThe DNS registration information was changed on 2011-05-19, also noted by a reader<\/a>.<\/p>\n

Domain Name: APPLESDOWNLOAD.COM
\nRegistrar: ELB GROUP, INC.
\nWhois Server: whois.retailstudio.com
\nReferral URL: http:\/\/www.retailstudio.com
\nName Server: NS1.QUCKBO.RU
\nName Server: NS2.QUCKBO.RU
\nName Server: NS3.QUCKBO.RU
\nName Server: NS4.QUCKBO.RU
\nStatus: clientTransferProhibited
\nUpdated Date: 19-may-2011
\nCreation Date: 14-mar-2011
\nExpiration Date: 14-mar-2012<\/p>\n

>>> Last update of whois database: Thu, 19 May 2011 20:15:58 UTC <<<<\/p><\/blockquote>\n

Whois info as of 2011-05-19<\/p>\n

Domain Name: APPLESDOWNLOAD.COM<\/p>\n

Registrant:
\nVanna Berglund
\nVanna Berglund\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (stalk@mailae.com)
\nDanska Vagen 68-70
\nGothenburg
\nVästra Gotalandslän,SE-41659
\nSE
\nTel. +46.317078999<\/p>\n

Creation Date: 14-Mar-2011
\nExpiration Date: 14-Mar-2012<\/p>\n

Domain servers in listed order:
\nns1.quckbo.ru
\nns2.quckbo.ru
\nns3.quckbo.ru
\nns4.quckbo.ru<\/p>\n

Administrative Contact:
\nVanna Berglund
\nVanna Berglund\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (stalk@mailae.com)
\nDanska Vagen 68-70
\nGothenburg
\nVästra Gotalandslän,SE-41659
\nSE
\nTel. +46.317078999<\/p>\n

Technical Contact:
\nVanna Berglund
\nVanna Berglund\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (stalk@mailae.com)
\nDanska Vagen 68-70
\nGothenburg
\nVästra Gotalandslän,SE-41659
\nSE
\nTel. +46.317078999<\/p>\n

Billing Contact:
\nVanna Berglund
\nVanna Berglund\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (stalk@mailae.com)
\nDanska Vagen 68-70
\nGothenburg
\nVästra Gotalandslän,SE-41659
\nSE
\nTel. +46.317078999<\/p>\n

Status:LOCKED<\/p><\/blockquote>\n

——-<\/p>\n

A reader sent in a screenshot of an email pretending to be from Apple.<\/p>\n

\"\"<\/p>\n

All clicks lead to: http:\/\/tariacuri.crefal.edu.mx\/dweb\/images\/smilies\/index.php which redirects to applesdownload.com.
\nIt is likely that tariacuri.crefal.edu.mx site has been compromised.<\/p>\n

\"\"<\/p>\n

applesdownload.com whois info<\/a>:<\/p>\n

Domain Name: APPLESDOWNLOAD.COM<\/p>\n

Registrant:
\nLyubov Bushmakina
\nLyubov Bushmakina\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ()
\nul.Yuriya Gagarina d.38 k.2 kv.99
\nSankt-Peterburg
\nSankt-Peterburg,196105
\nRU
\nTel. +7.8125540822
\nFax. +7.8125540822<\/p>\n

Creation Date: 14-Mar-2011
\nExpiration Date: 14-Mar-2012<\/p>\n

Domain servers in listed order:
\nns1.thejobrano.com
\nns2.thejobrano.com<\/p>\n

Administrative Contact:
\nLyubov Bushmakina
\nLyubov Bushmakina\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ()
\nul.Yuriya Gagarina d.38 k.2 kv.99
\nSankt-Peterburg
\nSankt-Peterburg,196105
\nRU
\nTel. +7.8125540822
\nFax. +7.8125540822<\/p>\n

Technical Contact:
\nLyubov Bushmakina
\nLyubov Bushmakina\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ()
\nul.Yuriya Gagarina d.38 k.2 kv.99
\nSankt-Peterburg
\nSankt-Peterburg,196105
\nRU
\nTel. +7.8125540822
\nFax. +7.8125540822<\/p>\n

Billing Contact:
\nLyubov Bushmakina
\nLyubov Bushmakina\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ()
\nul.Yuriya Gagarina d.38 k.2 kv.99
\nSankt-Peterburg
\nSankt-Peterburg,196105
\nRU
\nTel. +7.8125540822
\nFax. +7.8125540822<\/p>\n

Status:LOCKED<\/p><\/blockquote>\n

The site is currently still up.<\/p>\n

This is not the first time such email pretending to come from Apple.<\/p>\n","protected":false},"excerpt":{"rendered":"

UPDATE: The DNS registration information was changed on 2011-05-19, also noted by a reader. Domain Name: APPLESDOWNLOAD.COM Registrar: ELB GROUP, INC. Whois Server: whois.retailstudio.com Referral URL: http:\/\/www.retailstudio.com Name Server: NS1.QUCKBO.RU Name Server: NS2.QUCKBO.RU Name Server: NS3.QUCKBO.RU Name Server: NS4.QUCKBO.RU Status: clientTransferProhibited Updated Date: 19-may-2011 Creation Date: 14-mar-2011 Expiration Date: 14-mar-2012 >>> Last update of whois … <\/p>\n

Continue reading “Scam Alert: Fake Email Pretending To Be From Apple.”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[946,4],"tags":[2009,2511,2619,2648,2769,936,3039],"class_list":["post-5972","post","type-post","status-publish","format-standard","hentry","category-announcements","category-news","tag-media","tag-resources","tag-scam","tag-security","tag-spam","tag-tech","tag-troubleshooting"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pcNtU-1yk","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/5972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/comments?post=5972"}],"version-history":[{"count":0,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/5972\/revisions"}],"wp:attachment":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/media?parent=5972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/categories?post=5972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/tags?post=5972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}