Quentin
Member
> no subdomains in censys
That's useful, thanks. I checked URLScan too—no web presence at all. Just MX records pointing to a cheap VPS provider.
Is it normal for my upstream's upstream to email me directly?
What cheap VPS provider? Might be worth reporting to them if the TOS covers abuse of service for social engineering.
Quentin
Member
Hostinger. I'll open a ticket but not holding my breath.
Hostinger's abuse form is web-only and wants you to be the victim or rights holder. As a third party reporting suspected phishing they usually auto-close. Better to forward the email with full headers to your national CERT.
Quentin
Member
Done. Also shared with my colo so they can warn other customers if they bother. Thanks all—feel like I overreacted but better than the alternative.