13 Replies Latest reply: Nov 22, 2011 4:49 PM by hopita
jmiler Level 1 (0 points)
This is a fake offer for 50 free iTunes songs. The link in the email says http://www.apple.com/itunes/winners, but it really goes to http://nolde.us/img/Winners/

The email seems to be from info@apple.com and the server that sent the email is beryllium.elinuxservers.com. The page redirects to pages on Apple's site to seem legit.

Macbook Pro, Mac OS X (10.6.2)
  • ThunderChild Level 1 (0 points)
    Yep, just saw this on my e-mail. I called Apple to verify this before finding the forums. Report the message then delete it as soon as possible!
  • gerart Level 1 (0 points)
    I agree I got the same one!!! –remember, it's just a fake front cover, it's not an Apple's Legitimate Site.

    Just, be careful, and check always the APPLE URL and which is even more important, the SERVER "from", it's a LINUX server, and of course, talk to Apple Support, or even better: use this link right away: http://www.apple.com/contact/feedback.html

    Cmon' HACKERS!!!... there is not more creativity at all? that's it? –poor of you guys, beware guys that your life is not going to be any longer happy enough, specially with this illegal method!, they are so freaking cheap and angry with Apple, and which is more, with Apple's users, that now, they are implementing the CHEAP strategy of stilling APPLE's Customers ID's! –I know that they are reading me , wherever they are right now, again, beware "cyber-thieferesh" that the law is ready to catch you sooner than never, you won't doing this anymore!!!...
  • leee1102 Level 1 (0 points)
    I just joined this forum because I got the same phishing scam.
    I couldn't find ANYWHERE to report this. There are no customer service forms or links for reporting fraud or phishing. Please tell me someone already reported this!?!?

    Also if you go to http://nolde.us/ you just get a place holder from a company called Plesk. I again tried to find a way to report a phishing scam through Plesk but couldn't find anything other than corporate office addresses.

    If you do a whois search for nolde.us it will give you this individual's name and address (nothing to do with Apple) and is registered with TUCOWS.
    I'll see if they have a means of reporting phishing.

    I believe this page is set up to catch your username and password when you try and sign in to the fake page. So be careful!
  • varjak paw Level 10 (169,815 points)
    You might want to forward the entire message, with all it's headers, to Apple's legal department. I'm not sure which would be the correct contact there, but perhaps their copyright infringement department:

  • pappasross Level 1 (0 points)
    Just received an email that said I have a gift card for $50 waiting for me from the itunes store. I stupidly clicked on it and it downloaded as an exe file. Am deleting it and forwarding to spam. How do I let itunes know about this?
  • Frinkala Level 1 (0 points)
    I also received the same email and have not opened it. I went to my Itunes account looking for verification that a Gift Card was waiting....looked for a way to have a "chat" with itunes support, and now am looking for an itunes support address to forward this likely fake email. I think if it were a legitimate gift card "gift" the purchaser's name would have been mentioned in email, right?
  • JimAlfonse Level 1 (0 points)
    Hi All,
    I've received the same $50.00 Gift Certificate email. It included a zip file described as a 'certificate code' but no link. The email instructs me to open the zip file, open iTunes and verify my account.
    This is too suspicious for any number of reasons.

    My problem is that there is no easy method of contacting Apple with this information. I'd be glad to forward this email to a support person at Apple. The Apple website is configured to answer as many issues as possible with utilizing support personnel's time. I can understand that but there should be an easier method of bring a situation to someone's attention.

  • pappasross Level 1 (0 points)
    I agree with you and Frinkaka (?) - this is a SERIOUS matter for itunes and there is no way to let them know.
  • varjak paw Level 10 (169,815 points)
    Apple already knows. There's not much they can do about such scams since they're always based in other countries, ones with little or no enforcement to stop such fraud.
  • ndesimone Level 1 (0 points)
    I got my first one today... actually 2 on the same day, within minutes of each other. Too bad nothing can be done against these scammers.

    Return-Path: <legity2@talentas.com>
    Delivery-Date: Thu, 27 May 2010 20:41:14 -0600
    Received: from [] (helo=HGKPGWU) by host209.hostmonster.com with esmtp (Exim 4.69) (envelope-from <legity2@talentas.com>) id 1OHpUM-00045Y-F2 for ; Thu, 27 May 2010 20:41:14 -0600
    Received: from by mail5.bullhorn.com; Fri, 28 May 2010 10:39:55 +0800
    Message-Id: <000d01cafe0f$0e522730$6400a8c0@legity2>

    IP Information -
    Country Vietnam Vietnam
    Country Code VN
    Region Dac Lac
    City Hanoi
    Latitude 21.0333
    Longitude 105.85
  • ndesimone Level 1 (0 points)
    I could not find a phishing reporting address for apple so I'm just going to post the headers here

    From: Your iTunes Store <online.support@itunes.com>
    Subject: Thank you for buying iTunes Gift Certificate!
    Date: May 26, 2010 4:10:26 AM PDT
    Return-Path: <spokesmenf5@lastminutebets.com>
    Delivery-Date: Wed, 26 May 2010 04:10:49 -0600
    Received: from [] (helo=host-92-8-29-247.as43234.net) by host209.hostmonster.com with esmtp (Exim 4.69) (envelope-from <spokesmenf5@lastminutebets.com>) id 1OHDZS-0006hV-O1 for ; Wed, 26 May 2010 04:10:48 -0600
    Received: from by mailstore1.secureserver.net; Wed, 26 May 2010 11:10:26 +0000
    Message-Id: <000d01cafcbb$a98aa4c0$6400a8c0@spokesmenf5>
    Mime-Version: 1.0
    Content-Type: multipart/mixed; boundary="----=NextPart_000_000601CAFCBB.A98AA4C0"
    X-Priority: 3
    X-Msmail-Priority: Normal
    X-Mailer: Microsoft Outlook Express 4.72.2106.4
    X-Mimeole: Produced By Microsoft MimeOLE V4.72.2106.4

    IP Information -
    Host name host-92-8-29-247.as43234.net
    Country United Kingdom United Kingdom
    Country Code GB
    Region Doncaster
    City Doncaster
    Latitude 53.5333
    Longitude -1.1167
  • shelleyi Level 1 (0 points)
    I received the $50 iTunes gift certificate spam email on my birthday. Norton picked up about 7 viruses whilst downloading my emails on 26th May. The "To" address wasn't mine but it came to my inbox. Apple makes it very difficult to report these things via email. I haven't opened the attachment, but having found these discussions I am now deleting it. The sender claims to be iTunes Online Products <certificate@itunes.com.
  • hopita Level 1 (0 points)

    I just got the very same thing the day after my birthday. How do phishers know when my birthday is?


    A few things that tipped me off that it might be less than legit:


    "Dear customer,"   --  what, you don't know my name anymore?


    "You have received an Itunes Gift Certificate in the amount of $50"  --  incorrect capitalization of "iTunes"


    "... Then you need to open iTunes. .... So you can start buying video, music, games right away."  -- sentence fragments, ****-poor grammar, etc.


    It also took me a while to find an address to foward the suspicious email to, but I finally found one: