Apple iCloud cancellation lure sent via abused mortgage-CRM SendGrid tenant
Docket 17 checks
high · 7
01The message body impersonates Apple: Apple-styled iCloud cancellation notice with the Apple logo hotlinked from Apple's own CDN and an Apple copyright line
Headline "iCloud Account Cancellation Request", body text "We have received a request to deactivate your iCloud account dariush@wahdany.de, including the associated email address and billing information", 60%-filled blue progress bar, "Cancel Request" button, footer "Copyright © 2026 Apple Distribution International Ltd. / One Apple Park Way, Cupertino, CA 95014". Logo loaded twice from https://s.mzstatic.com/email/images_shared/logo_apple_small_d-2x.png; s.mzstatic.com resolves via s.mzstatic.v.aaplimg.com to 17.253.105.134/139 (Apple's own 17.0.0.0/8 space). No Apple domain appears in From, Reply-To or any link.
python3 email.message_from_file + get_payload(decode=True) on email.eml; regex extraction of img src/href hosts; dig +short s.mzstatic.com ·
Observed
· § line 01
02The mail was sent through SendGrid as authenticated subuser 19277112 belonging to preapp1003.com, not spoofed
Envelope sender bounces+19277112-532c-dariush=wahdany.de@em194.preapp1003.com; injected via SendGrid HTTP API ("Received: from MTkyNzcxMTI (unknown) by geopod-ismtpd-19 (SG) with HTTP", where MTkyNzcxMTI is base64 for 19277112); relayed from o2.ptr7687.preapp1003.com [168.245.10.50], which is inside SENDGRID-168-245-0-0-17 (OrgName SendGrid, Inc.). em194.preapp1003.com is a CNAME to u19277112.wl113.sendgrid.net and s1._domainkey.preapp1003.com is a CNAME to s1.domainkey.u19277112.wl113.sendgrid.net — i.e. SendGrid domain authentication is configured on preapp1003.com for account 19277112.
grep Received/Return-Path in email.eml; echo -n MTkyNzcxMTI | base64 -d; dig +short CNAME em194.preapp1003.com s1._domainkey.preapp1003.com; whois 168.245.10.50 ·
Observed
· § line 02
03The platform's own mortgage-loan-officer signature block is still appended below the fake Apple email, with the account's profile fields empty
Below the Apple footer the message carries a CRM-generated signature: broken logo <img src="hxxps://plus[.]preapp1003[.]com">, "Support Team / RMLO | NMLS" with no numbers, a placeholder phone rendered as "() -", joe@gigtown.com, an "apply now" CRM button image from hxxps://plus[.]preapp1003[.]com/app/templates/pa_layout/img/crm_buttons/button_apply-now_1.png, an Equal Housing Lender logo (.../img/logos/ehl.png), a mortgage disclaimer naming Gigtown ("Links to external websites are provided by Gigtown for your convenience"), and the address line "Gigtown | 1927 Estrella De Mar Ct UNIT B Carlsbad, CA . | NMLS# ." — company/NMLS/phone left unfilled.
Decoded quoted-printable body of email.eml; grep for plus.preapp1003.com, NMLS, Estrella ·
Observed
· § line 03
04Exactly 45 empty spacer divs are inserted between the fake Apple footer and the CRM signature, pushing the mortgage branding out of view
45 identical divs of the form <div style="width:562px;color:var(--grey-600,#80868b);...font-family:Roboto;font-size:14px;...line-height:24px">&nbsp;</div> sit after </body> and before the CRM signature block, i.e. roughly 1080px of blank vertical space. The Apple-styled table is itself wrapped in an outer <div style='max-width:700px;margin: auto;...'><img src=''> and contains a full nested <html><head><body> document — the shape of HTML pasted into a WYSIWYG composer rather than sent by the platform's own templating.
python3 count of 'width:562px' occurrences and regex for -only divs in the decoded body; inspection of tag order (html/head/body appear inside an outer div) ·
Observed
· § line 04
06Every clickable element and the tracking pixel point at SendGrid click-tracking on url4017.preapp1003.com; the true destination is encrypted inside the per-recipient token and was deliberately not dereferenced
Four URLs, all on hxxp://url4017[.]preapp1003[.]com (CNAME to sendgrid.net): three /ls/click?upn=u001.<token> links (the "Cancel Request" button, the CRM "apply now" image, the "Unsubscribe" link, 389/389/515 chars) and one 1x1 open-tracking pixel /wf/open?upn=u001.<token>. No other hostname is linked anywhere in the message. Tokens are per-recipient and encrypt the destination, so the landing page cannot be read from the message; it was not fetched, because dereferencing would register a click against the victim's tracking identity. SendGrid holds the plaintext destination for message id T8ZZNOfoSy6BohjHbQGDog / X-Entity-ID u001.h5nIfCYZJn0OK+pYZxlgbw==.
regex extraction of url4017.preapp1003.com URLs from the decoded body; dig +short CNAME url4017.preapp1003.com; Message-ID and X-Entity-ID headers ·
Observed
· § line 06
07The abusing CRM account's own profile name is literally "Support Team", appearing in the From, the Reply-To and the platform-rendered signature
"Support Team" occurs as the From display name (line 44 of email.eml), the Reply-To display name (line 48), and — rendered by the platform's own signature template, where a loan officer's name would go — in bold at line 158 of the decoded body. The credential fields around it (RMLO, NMLS, phone) are blank. The account is configured as a generic support identity rather than a named mortgage professional.
grep -n "Support Team" email.eml and body.html (decoded quoted-printable body) ·
Observed
· § line 07
medium · 6
08SPF, DKIM and DMARC all pass — for preapp1003.com, not for Apple — and the message scored 0.32/15 at the receiving spam filter
Authentication-Results: dkim=pass header.d=preapp1003.com header.s=s1; spf=pass (168.245.10.50 permitted for em194.preapp1003.com); dmarc=pass (policy=none) header.from=preapp1003.com. X-Rspamd-Score: 0.32 / 15.00. The passes establish only that whoever sent it controlled a preapp1003.com SendGrid account; they carry no Apple authorisation. em194.preapp1003.com publishes "v=spf1 ip4:134.128.106.149 ip4:149.72.225.70 ip4:149.72.37.35 ip4:168.245.10.50 -all"; preapp1003.com's DMARC policy is p=none.
Authentication-Results/X-Rspamd-Score headers in email.eml; dig +short TXT em194.preapp1003.com _dmarc.preapp1003.com ·
Observed
· § line 08
09The Apple-styled HTML is built on a recycled Daftra business-software email template, identified by a left-in attribution comment
The body contains the HTML comment "<!-- Daftra attribution -->" wrapping an empty table, alongside 17 uses of the font stack 'CustomFont,Roboto,-apple-system,"Segoe UI",Helvetica,Arial,sans-serif' and Daftra-style utility classes (column-12 is-first is-last p-0, px-responsive, pt-8, bg-gray-2, image-reset). Section comments "Progress Bar Row", "Button Row", "Footer Row" mark hand-editing of that template into an Apple notice.
regex extraction of all HTML comments and class attributes from the decoded body of email.eml ·
Observed
· § line 09
10The address the mail calls an "iCloud account ... including the associated email address" is a mailbox.org-hosted German address, not an Apple-hosted one
wahdany.de MX = mxext1/mxext2/mxext3.mailbox.org; SPF "v=spf1 mx ip4:51.254.55.252 include:mailbox.org -all". No Apple MX or Apple SPF include. Delivery path in the headers confirms it: mx2.mailbox.org -> director-22.heinlein-hosting.de -> dobby35b.heinlein-hosting.de. Apple neither hosts nor bills the mailbox, so it cannot cancel "the associated email address".
dig +short MX wahdany.de; dig +short TXT wahdany.de; Received chain in email.eml ·
Observed
· § line 10
11The footer attributes a Cupertino address to Apple's Irish entity, conflating two different Apple companies
Mail footer: "Copyright © 2026 Apple Distribution International Ltd." immediately followed by "One Apple Park Way, Cupertino, CA 95014, United States" and "© 2026 Apple Inc.". Apple Distribution International Limited is the Irish entity registered at Hollyhill Industrial Estate, Hollyhill, Cork T23 YK84, Ireland (company no. 12401448, LEI 54930027SQL2KPSDBM58); One Apple Park Way is Apple Inc.'s US headquarters. Genuine Apple mail does not carry this hybrid attribution.
Decoded body footer text; web search of Irish registry/LEI records for Apple Distribution International Limited (lei-ireland.ie, lobbying.ie, D&B listings all give Hollyhill, Cork T23 YK84) ·
Observed
· § line 11
12The message contradicts itself in four places that a genuine automated Apple notice would not
(1) Footer says "This is an automated notification. Please do not reply directly to this email" while a Reply-To header is set to a third party (joe@gigtown.com). (2) Subject cites "Ticket Ref:20260907" but the mail was composed and sent 2026-09-08 12:36:56 UTC, i.e. the ticket predates the notice by a day and the reference is simply a date. (3) From display name "Support Team" over local part 754667b8-90c3-45e1-a559-47fa0ab898e1@preapp1003.com — a bare UUID at a mortgage-software domain. (4) The first element of the body is an image tag with an empty source (<img src=''>), and the CRM logo below it is <img src="hxxps://plus[.]preapp1003[.]com"> — an unfilled template field pointing at a host root, which renders broken.
Subject/Date/From/Reply-To headers of email.eml compared with the decoded body text and img tags ·
Observed
· § line 12
13An independent submission shows the same sending account's tracking host in circulation a day earlier, on 2026-09-07
urlscan.io scan 01a07a9d-87a3-706f-8aa2-eb054dae9bb6, submitted via API 2026-09-07T06:45:45Z, is an open-tracking pixel on the same host hxxp://url4017[.]preapp1003[.]com/wf/open?upn=u001.<token> with a token different from the one in this mail (XtERfKYjkUm2Q2q7Q4SFaa... vs l188ry2yrJbB3B6HHQnouWVN...), i.e. a different recipient. It returned a 1x1 image/gif from 52.209.209.53 (AS16509 AMAZON-02, eu-west-1, PTR ec2-52-209-209-53.eu-west-1.compute.amazonaws.com), TLS issued by "Go Daddy Secure Certificate Authority - G2", and urlscan reports the subdomain as 201 days old. This is the only scan of that host in urlscan's index (total=1), against 110 scans for preapp1003.com overall, the rest being ordinary plus.preapp1003.com loan-officer pages. The date matches the "Ticket Ref:20260907" in this mail's subject.
curl -s "https://urlscan.io/api/v1/search/?q=page.domain:url4017.preapp1003.com" and the linked result record ·
Observed · source (check 13)
· § line 13
info · 4
14preapp1003.com is a real, ten-year-old mortgage loan-origination SaaS, not attacker-registered infrastructure
RDAP: registered 2015-11-17T21:41:05Z, expires 2027-11-17, registrar GoDaddy.com, LLC (IANA 146), NS ns05/ns06.domaincontrol.com, all four client-*-prohibited locks set. Site title "PreApp 1003 Mortgage App | Loan Origination Software | Mortgage Application", WordPress/Elementor, product menu (Broker LOS & Point-of-Sale, Product & Pricing Engine, Native CRM, eSignature), customer login at hxxps://plus[.]preapp1003[.]com/login/. Corporate mail is Proofpoint-hosted (MX mx1/mx2-us1.ppe-hosted.com); the app runs on AWS (plus.preapp1003.com -> preap-preap-43p8wvia78or-813903627.us-east-1.elb.amazonaws.com).
curl -s https://rdap.verisign.com/com/v1/domain/preapp1003.com; fetch hxxps://preapp1003[.]com/; dig +short MX preapp1003.com; dig +short CNAME plus.preapp1003.com ·
Observed Archive archived copy (check 14) · § line 14
15Certificate Transparency shows no rogue subdomain on preapp1003.com — the abuse is confined to a sending account, not the domain's DNS or web estate
193 certificates logged for %.preapp1003.com; most recent distinct names are preapp1003.com (2026-08-04), billing.preapp1003.com (2026-07-24), *.preapp1003.com (2026-07-07), staging (2026-04-09), plus (2026-03-30), www (2026-02-02) — all consistent with the vendor's own estate. No certificate for a lookalike or Apple-themed subdomain, and no certificate issued around the 2026-09-08 send date.
curl -s "https://crt.sh/?q=%25.preapp1003.com&output=json" and grouping by common_name/not_before ·
Observed · source (check 15)
· § line 15
16gigtown.com publishes two conflicting DMARC records, which leaves the domain effectively without an enforced policy
_dmarc.gigtown.com returns both "v=DMARC1; p=none;" and "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; pct=100; rua=mailto:dmarc@gigtown.com". Under RFC 7489 a domain with multiple DMARC TXT records is treated as having no valid record, so neither policy is applied. Not the vector used here (this mail was authenticated as preapp1003.com), but it means gigtown.com itself is not protected against direct spoofing. Its outbound SPF is "v=spf1 google-site-verification=... include:spf.mandrillapp.com ?all" — a soft ?all with a stray verification token inside the SPF record.
dig +short TXT _dmarc.gigtown.com; dig +short TXT gigtown.com ·
Observed
· § line 16
17Send time is corroborated by the DKIM signature timestamp, and the evidence file hashes are fixed
DKIM t=1788871016 = 2026-09-08T12:36:56+00:00, matching the Date header (Tue, 08 Sep 2026 12:36:56 +0000), the SendGrid injection record (2026-09-08 12:36:56.344 UTC) and delivery at mailbox.org 14:36:58 +0200 — a 2-second end-to-end path with no back-dating. SHA-256 email.eml = 70d2c4ace695e9fc618f28f764945b76bba6e05f7f739d00c5d16c0bd1f54f15; SHA-256 of the decoded HTML body = e79871a5b750bb4848b063239c711bca9822f668b0cfe85fe44d50097fc68527.
python3 datetime.fromtimestamp(1788871016, UTC); sha256sum email.eml body.html; Date/Received headers ·
Observed
· § line 17
Notified 2 parties
Who was told, and whether they answered. The letters themselves stay in the file; each party decides for itself what to do.
Assessment
Withheld. The verdict stays in the file. Each line above is one check — what was tested, how, and when.