0

I got the following phishing email from “Apple”:

Your ApрIe ID ( xxx ) was used to sign in to other device. Date and Time: 16 August 2017, 04:28 PM (GMT+10) Operating System: Linux

If you have not logged in recently and feel someone is logged in to your account ,go to ApрIe ID ( Verification your account ) and update your account.

ApрIe Suρρort

The “Verification your account” text contains a hyperlink to https://t.co/ccFy4cn8jr?=redirect.

When I click that link I get redirected to what looks like the official Apple website. How is this possible? Has the t.co link been adjusted/modified/redirected to protect people from going to the malicious website?

When I submit the HTTP request I receive the following response:

<head>
    <noscript>
        <META http-equiv="refresh" content="0;URL=https://appleld.apple.com.3c8fcfcffe480bc910-verify.info/?adu">
    </noscript>
    <title>https://appleld.apple.com.3c8fcfcffe480bc910-verify.info/?adu</title>
</head>
<script>window.opener = null; location.replace("https:\/\/appleld.apple.com.3c8fcfcffe480bc910-verify.info\/?adu”)</script>

Visiting https://appleld.apple.com.3c8fcfcffe480bc910-verify.info/?adu correctly triggers a “Malicious site detected” warning, unlike clicking the original t.co link.

What is happening here? Why does clicking the t.co link take me to the legitimate Apple website, when I should instead be redirected to a phishing website? Is it possible I am done any harm here caused by cross site scripting? Or is it only redirecting to a fake website?

  • The t.co address did indeed take me to a phishing site: "appleld.apple.com.3c8fcfcffe480bc910-verify.info/…" The page is a look-alike copy of a real Apple page, but all the links on the page are internal, and clicking on them does nothing. The only functioning feature is the sign-in window’s ability to capture your Apple ID. The culprit site "3c8fcfcffe480bc910-verify.info" has an IP address of 62.4.16.89, which belongs to the French hosting company Dedibox. – Doc G. Aug 18 '17 at 2:35
  • It's not Apple's site, it's a copy. – John Keates Aug 18 '17 at 8:46
1

That is not the legitimate Apple ID website. Notice the lowercase l in the URL in place of an uppercase i. Not only that, the actual domain is something-verify.info rather than apple.com.

In this case appleld.apple.com is merely a subdomain, and since anyone can register anything as a subdomain on their own site, they should have kept that i instead of replacing it with an l. The URL might have looked slightly less suspicious.

Report this email as spam/phishing, and if you entered your credentials on that site, immediately head to the real appleid.apple.com and change your password.

1

Editing, because I'm as confused as the original poster now. Expanding the t.co link via CheckShortURL, yields a google.ca redirect to apple.com/errors/us_error.html , not the bad account page.

I can't find anywhere that ends up at 3c8fcfcffe480bc910-verify.info

....

....

....

(original answer below)

t.co is a url shortening/alias service

But, that link is not taking you to the apple page, but a subdomain of 3c8fcfcffe480bc910-verify.info

Phishing attacks like that are designed to make people see "oh, it has apple.com in the url, so it must be safe". But, follow the URL all the way to the end.

  • 4
    The t.co redirect address is still taking me to the phishing site. It may be that after being notified of the situation, Twitter altered its t.co shortened URL to redirect instead to an Apple error page, as your URL checker showed, but that my DNS servers are still serving up cached information. – Doc G. Aug 18 '17 at 2:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .