Appstore - check your personal data (Apple Phishing)

Dear Customer

We need your help to solve a problem with your account.

Your Apple ID was used to log in to iCloud from an unauthorized computer.

Your iTunes account will be suspended.

To help us solve this problem, click the link below and perform a verification of personal data.

Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T

For further information, please contact custom! er service.

Thanks,
Apple Customer Support Service

Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland. Numero di registrazione impresa 15719. Partita IVA IE6554690W.
Tutti i diritti riservati/Tutela della privacy/Il mio Apple ID

Se non desideri ricevere comunicazioni di carattere commerciale da Apple o se hai cambiato indirizzo e-mail, fai-clic qui.

TM e copyright 2014 Apple Inc.

Phishing analysis :

CLICK : Https://www.apple.com/En-Au/check your personal data./ID: 6HL37295PC836484T
OPEN : http://reims-et-soissons.com/wp-includes/ID3/
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/
SCREENSHOT :

ACTION : VALIDATE FORM
REDIRECT : http://zwonakaparkandlodge.co.za/components/com_ajax/paoolinh.apple.com/info.php?//appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/273/wo/RHbGlbVOSDtkOMbXu4TET0/0.0.67.17.1
SCREENSHOT :

ACTION : VALIDATE FORM
REDIRECT : https://appleid.apple.com/

Email analysis :

NOTE : icoud@dongi.ir
NOTE : apache@dongi.ir
NOTE : X-Msmail-Priority : High
NOTE : X-Mailer : timor.websitewelcome.com 192.185.164.21
NOTE : client-ip=78.111.2.20;

Notes from Scam.cz

- A compromised wordpress installation : reims-et-soissons.com
- A compromised joomla installation : zwonakaparkandlodge.co.za
- A relay to send phishing : dongi.ir