adam20
Member
OP
Ex-Abuse Desk
- Joined:
- Jul 2024
- Posts:
- 149
- From:
- Los Angeles, US
Got an email saying RackNerd had been acquired and my data would migrate in 48 hours unless I initiated transfer to their "secure acquisition portal." Looked legit, same logo colors, referenced my actual plan name.
Something felt off. RackNerd's status page showed nothing. I opened a ticket. The ticket said: "We have not been acquired. Do not click that link." Turns out the "portal" was a credential harvester running on a Hetzner IP that got suspended two hours later.
I was one click from handing over my database dumps. The email spoofed their support address perfectly. Has anyone else seen this specific campaign?
reported. resolved. repeat.
mediaaustin
Member
Deliverability Nerd
- Joined:
- Jul 2024
- Posts:
- 276
- From:
- Austin, US
Different, I get email like this for HostHatch, not real, check whois first, domain registered 3 days ago, always check,
SPF, DKIM, DMARC — holy trinity ✉️
tinaworm
Member
- Joined:
- Jun 2024
- Posts:
- 84
- From:
- Riga, Latvia
- acquisition announcements require SEC filings or press releases on verified domains
- "secure acquisition portal" is not standard industry terminology
- legitimate transfers do not operate on 48-hour deadlines
- the Hetzner IP is consistent with bulletproof hosting patterns
I have observed three similar campaigns this quarter. Always verify through independent channels. Never through links in unsolicited email.
-t
worst bandwidth, best stories
sarahjey
Member
- Joined:
- Jul 2024
- Posts:
- 149
- From:
- Ottawa, Canada
I use Time4VPS for my project and I would probably have clicked that link 😅
learning on $5 VPS and prayers
