"Your AppleID was used to sign in to iCloud" notification

A detailed but suspicious email was reported that appears to come from Apple, warning that your Apple ID was used to sign into iCloud, but is actually a phishing attempt. Here is an example and clues to spotting this phish, followed by a legitimate notification for comparison purposes. If you do receive a suspicous iCloud email, Apple requests that you forward it to them at abuse@icloud.com.

This is an example of a legitimate notification from Apple. Besides the differences noted above, this one was sent from noreply@email.apple.com instead of do_not_reply@apple.com.

Phishing
Phishing Email (on campus)

Written by pfalcon@brown.edu on