Ask HN: Did my girlfriend get her Apple account hacked?

So yesterday my girlfriend received a bunch of weird iMessages saying that "Find my iPhone" had found her lost iPhone (which obviously wasn't lost). It included this link http://bit.do/lost-or-stolen which in turn just redirects to http://188.26.15.18 (it's still up). The page looks exactly like the "Manage your Apple ID" page.

But before I managed to stop her she had tried to login and I assume her credentials got sent to some hacker. We immediately changed all of her passwords, but has anyone else seen this?

A traceroute seems like it ends up in Russia:

    $ traceroute 188.26.15.18
    ...
    9  xr01.amsterdam.rdsnet.ro (80.249.208.51)  31.182 ms  31.053 ms  31.012 ms
    10  10.30.2.101 (10.30.2.101)  98.765 ms  98.810 ms  98.754 ms
    11  188-26-15-18.rdsnet.ro (188.26.15.18)  100.827 ms  100.678 ms  100.752 ms

And HTTP headers hints that it's just a simple Python web server:

    $ curl -I http://188.26.15.18
    HTTP/1.0 200 OK
    Server: SimpleHTTP/0.6 Python/2.6.5
    Date: Tue, 01 Sep 2015 07:05:29 GMT
    Content-type: text/html
    Content-Length: 19169
    Last-Modified: Mon, 31 Aug 2015 14:39:29 GMT