I reported "phishing" email to Apple using the below instructions.
Quote: "If you receive what you believe to be a phishing email purporting to be from Apple, please send it to reportphishing@apple.com, a monitored email inbox, which does not generate individual email replies."
Emails with this scam came pouring into my @icloud.com email address with the "senders" being email addresses from several universities, meaning that these scammers hacked the email of college students and then used their email addresses to blast out the scam. Their email sends you to: http://followsavetheladder.net/iclou/
And of course that webpage asks for 1- your email address / 2- your password / 3- confirm password
Now, over 24 hours since I reported it, that website is still active.