Scam warning: fake 'abuse department' emails targeting our niche

tifiucem

Member OP

🇹🇷 cheap vps hunter

Joined:: Jul 2024
Posts:: 97
From:: Istanbul, Turkey

3mo ago

#1

Just almost got owned by a phishing mail!!! Looked exactly like it came from Vultr, subject "Abuse Report #89234 - Action Required". The logo was pixel-perfect, even the footer matched. But the link went to vultr.com not vultr.com!!!

I hovered and saw the real url, credential harvester for sure. They wanted my panel login. The scare tactic was "your node will be suspended in 24 hours", classic pressure!!!

Be careful out there, check those headers. These hos are getting good, very very good!!!

I paid 12$ for this vps, they want to steal it, cant believe it!!!

çok ucuz, çok hızlı

ellagee91

Member

Joined:: Sep 2024
Posts:: 34
From:: Melbourne, Australia

3mo ago · edited

#2

Oh no... thats getting really convincing these days... I got something similar last month... from "OVHcloud abuse team"... forwarded it to their real support and they confirmed it was fake... the headers were all wrong though... originating from some residential IP in... I forget where... somewhere eastern europe probably...

The thing that tipped me off was the grammar... "your account violate terms" instead of violates... but yours sounds more polished... thats worrying...

RAJ

Member

Joined:: Jul 2024
Posts:: 294
From:: Mumbai, IN

3mo ago · edited

#3

#I #got #three #variants #of #this #in #the #last #month #alone #hashtag #scam #season #is #here #people #one #claimed #to #be #from #Hetzner #another #from #Contabo #third #from #some #fake #InterServer #lookalike #domain #interserverl #with #two #Ls #at #the #end #hashtag #check #your #urls #hashtag #always

your margin is my opportunity

LU

luka16

Member

Joined:: Jun 2024
Posts:: 7

3mo ago · edited

#4

The more moving parts, the more ways to die— enemy check headers before you click
The calm user survives

ana_mad

Member

Joined:: Jun 2024
Posts:: 298
From:: Madrid, ES

3mo ago · edited

2 #5

Cheers for flagging this @tifiucem! Sent ticket to real Vultr abuse team yesterday, they are aware now and working on statement. Made test order with fake site to see where it leads, payment page was collecting card details directly instead of processor redirect. Reported to relevant authorities!

Found another variant using RackNerd branding, be careful everyone. Real site is https://www.racknerd.com — don't fall for fakes. Cheers!

swimming upstream since 2019 🐟

lucgone

Member

Le Baguette

Joined:: Jul 2024
Posts:: 296
From:: Lyon, FR

3mo ago · edited

2 #6

Mdr I have make something stupid since 2 days... I have call the number in the fake mail

Was "urgent abuse hotline" with american accent but bad hold music... wasted 20 minutes of their time asking about "my server who is attacking the nasa" lol... guy become very angry when I ask why he work sunday for abuse department... "sir this is serious matter" lol... I say yes very serious my server is in space now

They hang up... it is possible to do that? Yes apparently... dont call them back though, probably not cheap number

Vive la résistance... électrique

MA

maxcee

Member

Joined:: Jun 2024
Posts:: 12

3mo ago · edited

#7

I get hos from "HostHatch abuse team" too ạ very cheap trick ạ they say my server send spam ạ I dont even have mail server running ạ

Check the received header always ả look for spf fail ạ dkim none ạ that how you know ạ

Stay safe everyone ạ

RAJ

Member

Joined:: Jul 2024
Posts:: 294
From:: Mumbai, IN

3mo ago · edited

#8

Pixel-perfect logos are the real danger now. Hover EVERY link, brother.

your margin is my opportunity

ana_mad

Member

Joined:: Jun 2024
Posts:: 298
From:: Madrid, ES

3mo ago · edited

#9

Thanks for flagging this. We've seen a sharp uptick in these lately.

The vultr.com domain is new to me. Did anyone report it to their actual registrar or just bin it? Curious if there's any takedown momentum or if we're just playing whack-a-mole.

Also

ellagee91 said:

The grammar... "your account violate terms"

— funny how the polished ones are almost scarier. The broken-English scams almost feel safer because they're obvious.

swimming upstream since 2019 🐟

zoekyo

Member

Less Is More

Joined:: May 2024
Posts:: 102
From:: Kyoto, JP

2mo ago · edited

#10

Did anyone ever figure out if Vultr sent a real abuse alert around the same time, or was this completely out of the blue

I ask because my provider (HostHatch) actually did suspend a neighbour for abuse last month and the real email looked almost identical to a fake one I got the week before

The only difference was the real one had my actual ticket number and the fake one had a generic #89234 like yours

Makes me wonder if they're timing these to coincide with real enforcement waves

rm -rf / --no-preserve-root ☯

Post a reply