So yesterday my girlfriend received a bunch of weird iMessages saying that &quot;Find my iPhone&quot; had found her lost iPhone (which obviously wasn&#x27;t lost). It included this link http:&#x2F;&#x2F;bit.do&#x2F;lost-or-stolen which in turn just redirects to http:&#x2F;&#x2F;188.26.15.18 (it&#x27;s still up). The page looks exactly like the &quot;Manage your Apple ID&quot; page.<p>But before I managed to stop her she had tried to login and I assume her credentials got sent to some hacker. We immediately changed all of her passwords, but has anyone else seen this?<p>A traceroute seems like it ends up in Russia:<p><pre><code>    $ traceroute 188.26.15.18
    ...
    9  xr01.amsterdam.rdsnet.ro (80.249.208.51)  31.182 ms  31.053 ms  31.012 ms
    10  10.30.2.101 (10.30.2.101)  98.765 ms  98.810 ms  98.754 ms
    11  188-26-15-18.rdsnet.ro (188.26.15.18)  100.827 ms  100.678 ms  100.752 ms
</code></pre>
And HTTP headers hints that it&#x27;s just a simple Python web server:<p><pre><code>    $ curl -I http:&#x2F;&#x2F;188.26.15.18
    HTTP&#x2F;1.0 200 OK
    Server: SimpleHTTP&#x2F;0.6 Python&#x2F;2.6.5
    Date: Tue, 01 Sep 2015 07:05:29 GMT
    Content-type: text&#x2F;html
    Content-Length: 19169
    Last-Modified: Mon, 31 Aug 2015 14:39:29 GMT</code></pre>
Ask HN: Did my girlfriend get her Apple account hacked?