Clicked phishing link that knew my server IP

Got email "suspicious login from 185.x.x.x" with link to "reset password." Almost clicked—then noticed the IP matched my actual server at Hetzner. Not my home IP, not VPN. The server IP.

How did they get it? I checked breach databases, nothing recent. Server runs standard stack, Debian 12 https://www.debian.org, unattended-upgrades on. Only services: ssh (key-only, nonstandard port), nginx, postgresql local.

Email headers show SPF pass from lookalike domain. Body had my first name from WHOIS? Or from somewhere else?

Anyone else seeing targeted phish with server IPs? I changed all keys just in case. Cheers

Here is what the iron teaches,,,,, Your IP it is in the public WHOIS for the domain registered,,,,, No breach needed no hack needed just rdap query or whois lookup,,,,, The phish it is smarter dan you think but not smarter dan the iron,,,,,
I seen this before with Leaseweb ips,,,,, They scrape the WHOIS archive and match to email from breaches or public lists,,,,, Not hard not fancy just patient,,,,,dave

Likely source chain:

1. Domain registration → public WHOIS/RDAP → IP address in historical records
2. Reverse DNS (PTR) for your IP → hostname → association with your identity
3. Certificate Transparency logs for your domain → subdomains → IP exposure

Immediate actions:
- Verify RDAP redaction status with Hetzner
- Check if reverse DNS reveals identifying hostnames
- Review nginx server_tokens; confirm off

Recommendation: If this server hosts personal projects, consider separating registrar identity from server admin identity. Use privacy protection where available.

Cara that is scary véi kkkkk I going to check my WHOIS right now this happened to my friend at Time4VPS too the email knew the server IP and everything kkkkk

But cara the scrap gods they are real véi I enabled privacy protection and changed my reverse DNS, put something generic kkkkk

Ana_mad thanks for sharing I audited all my domains today cheers cara