uma
Member
OP
99.99% or bust
- Joined:
- Jun 2024
- Posts:
- 324
- From:
- Dublin, IE
Got an email this morning claiming to be from my host's abuse team. Exact template match, same footer, same ticket formatting. Nearly clicked the "resolve dispute" link until I checked the graphs. : my status page showed zero alerts, no abuse flags, nothing on the monitoring dashboard. Checked headers. Return-Path was off by one character. But the scary part: they referenced an actual ticket ID I opened six months ago. That ticket was with a different provider, Hostinger, which had a breach last spring. Has anyone else seen these? The visual fidelity is way beyond the old grammar-mess scams.
436 days. reboot is surrender.
wilmaethqn44
Member
- Joined:
- Jun 2024
- Posts:
- 135
- From:
- Cardiff, UK
How do I check the headers? I got one of these last week and I just deleted it. Should I be worried? I use OVHcloud for my shop site and I dont want to break anything by clicking wrong. 😬
frames, tables, still valid HTML
GeorgeNmp
Member
AS64512
- Joined:
- May 2024
- Posts:
- 218
- From:
- Ashburn, US
How do I check the headers?
In most mail clients, "View Source" or "Show Original" reveals the full header block. Look for Received: lines, which build bottom-to-top. The first Received (nearest your server) and Return-Path are most telling. SPF, DKIM, and DMARC results often appear in Authentication-Results headers.
The ticket ID correlation suggests either a breach correlation database or, more likely, the Hostinger incident exposed email-to-ticket mappings that attackers now cross-reference against provider templates. This is not header forgery per se but reconnaissance augmentation.
RPKI for email when?
iBGP, eBGP, don't care, just peer
