Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

11 points

iPhone stolen and disappeared in "Find My Phone"

Unfortunately my wife's phone got stolen on Wednesday night. I logged into her iCloud account by "Find My Phone" but it had been turned off and could not track the location. Then I locked it remotely. Later it appeared for a while in another district but soon became offline again. The police said unless we could keep tracking the location, the past location did not provide much value.

She bought a new iPhone 6 last night and restore it from the iCloud backup. This morning I checked "Fine My Phone" again but found nothing new (the stolen phone still offline), and then I sent the remote wipe instruction on next time it connects to Internet.

Here is the weird part:

My wife got an SMS this morning from "info.imessage.id@icloud.com" with the message below:

"Dear XXX (my wife's name),

Lost mode iPhone has been found now.

OS: iOS 8.2

If you want to get more information, please go to http://page-icloud.com/?token=492d878a-8

Thanks

Apple Support"

By instinct I suspected it could be a phishing address. However, after I googled it for a while, there was nothing mentioned about this "page-icloud.com", and when I visited this address, it was basically pointed to "icloud.com" (I tried the exact link with a wrong password but it did have background validation). Then I decided to give it a go. After logging into this address, it brought me to "Fine My Phone" and I could see the real time location of my wife's newly bought iPhone 6. However, I could not see other devices any more. There used to be the stolen phone (offline though) and my wife's old iPhone 4S, but now only the new phone can be seen.

Does any one have any idea about why the device list of "Find My Phone" got cleared? Or did any one receive the similar SMS about "page-icloud.com" and had a proof that it was a phishing address (or something that can trigger the removal on device records)?

Even that thief was captured by CCTV, there is little hope for the police to catch him or get our phone back. And now the weird device record lost in "Find My Phone"...... This is so frustrating...

Appreciate your ideas. Thanks.

BR,

Richard

Posted on Aug 20, 2015 8:29 PM

Best reply

elcpu

Level 7

31,481 points

Posted on Aug 22, 2015 5:39 AM

Assad, when you say that you opened the page, what do you mean? A Safari page? If so follow my advice below, but first if you did not provide any info on the Safari page or otherwise they did NOT steal your ID or anything else, you would have had to enter info into the page yourself so rest assured. However you need to go into Settings, Safari, and clear history and data to remove any cookies that could have placed, that is all.

elcpu

View in context

23 replies

Aug 24, 2015 2:24 AM in response to F.A. Assad

Could it be intercepting data after redirecting to the Apple site? The lock icon in the address does show the Apple certificate, but there may be ways to fake the address line.

Aug 24, 2015 2:31 AM in response to Malcolm J. Rayfield

I do not know ... theoretically the answer is yes.

Aug 24, 2015 3:01 AM in response to F.A. Assad

Anyway, when I tried iCloud to find my phone when it was off, it send email, not SMS when I turned it on. The link in the email was:

https://www.icloud.com/find

zricyan Author

Level 1

11 points

Aug 24, 2015 12:16 PM in response to elcpu

Thanks man. Eventually my wife bought a new phone and restored it using iCloud backup. Fortunately there was not much sensitive information on the stolen one and I have told her to change several critical passwords like the bank account just in case... It is true that losing your phone is really a nightmare. Maybe we all rely too much on the smartphone nowadays.

zricyan Author

Level 1

11 points

Aug 24, 2015 12:30 PM in response to F.A. Assad

Hi Assad, after looking back into the whole case, I do believe it is a phishing link, coz it not only wiped that stolen phone but all the other historical devices from "Find My Phone" as well. Remote wipe should not remove other devices according to my knowledge. I think the tricky part is "token=xxxxx". Like you said it pointed back to iCloud.com but that suffix might perform something else. Maybe some web experts can explain it in a more professional way.

It seems my wife has not received the wipe confirmation email from Apple, so I am not 100% sure if that stolen phone was wiped or not. What I understand is that once the wipe instruction is sent to the phone, there would be no approach to stop it upon next Internet connection. Hope my understanding is correct...

Aug 24, 2015 10:33 PM in response to F.A. Assad

icloud.com is owned by Apple.

page-icloud,com was created by sombody in China just a few days ago,

http://www.whois.com/whois/page-icloud.com

Aug 25, 2015 12:15 AM in response to Malcolm J. Rayfield

ABsolutely right! Thanks M Rayfield

Aug 25, 2015 12:16 AM in response to zricyan

YOu sound like you are in better shape than before and you should be too! good Luck 🙂

iPhone stolen and disappeared in "Find My Phone"