![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/12\/phishing-red-at-symbol-with-fishing-hook-and-dollar-signs-600x300-1.jpg\")
<\/p>\n<\/p>\n
A couple weeks ago, we wrote about a scam e-mail alleging that a website had violated image copyrights<\/a>.<\/p>\n We recently received another interesting message, this time more Apple-specific. It claims that “Your iCloud storage might be full,” and tries to convince the reader to upgrade to 50 GB of storage. However, the e-mail isn’t actually from Apple.<\/p>\n The e-mail contains links that could potentially lead to phishing sites or other scams, malware, or other potentially harmful sites.<\/p>\n In our case, the links went to TinyURL short addresses, which in turn redirected to pages hosted at But it’s possible that the e-mail may have originally redirected to something more harmful, shortly after the message was sent. By the time we tested the links, the redirect-URL database may have changed many times. Initially, the links might have led to, for example, a phishing site designed to look like an Apple ID sign-in page.<\/p>\n It’s also entirely possible that the redirections may change based on factors such as the visitor’s browser, operating system, or IP address. We’ve often observed phishing and spam campaigns do exactly that. Harmful sites do this to make it more difficult for anyone investigating the URLs to prove the sites’ dangerousness.<\/p>\n If you’re concerned that your Mac might be infected<\/strong> after visiting a link in an e-mail, download a free trial of VirusBarrier<\/a> and scan your Mac. (To buy VirusBarrier at a discount, use the exclusive promo link<\/a> for our blog readers.) If you clicked a suspicious link on a Windows PC<\/strong>, you can scan your PC using Intego Antivirus for Windows<\/a>.<\/p>\n If an e-mail like this one isn’t caught by your spam filter, mark it as spam. By doing so, you can help your mail provider identify similar e-mails, which can help them protect other people.<\/p>\n For more tips on reporting scam e-mails, check out our YouTube video, “How to Report Scam Emails<\/a>.”<\/p>\nWhat happens if you click on a link in the e-mail?<\/h3>\n
amirlabd[.]com<\/code>, a domain that was registered in November<\/a>. In our observations, those amirlabd<\/code> pages would sometimes attempt to redirect to sites hosted at other domains, for example unanimcar[.]club<\/code>\u00a0or octanvolume[.]store<\/code>, both of which were registered days after the e-mail was sent<\/em>. This is possible because the first amirlabd<\/code> URL dynamically changes the next redirection URL in the chain. Other times, the links redirected to seemingly innocuous pages, such as a Fox News RSS feed hosted at the first domain, or the actual homepage of Microsoft’s Bing search engine.<\/p>\nHow to report scam e-mails<\/h3>\n