Administered by:
@jessienab@wetdry.world#PHISHING WARNING
Emails targeting domains hosted by #Porkbun are being sent en-mass to emails attached to the domain; rather, to any email their scraper can find on a webpage.
I received two emails for two of my domains with Porkbun, from:
dh_e82aun [at] pdx1-shared-a1-28.dreamhost.com
which direct me to login to:
hxxps:// porkbunrr [dot] web [dot] app
The web.app domain forwards to pay [dot] iagadvanced [dot] com
BE VIGILANT!
I've already submitted phishing reports to the host and registrar, and forwarded the email to Porkbun. Further reports will be submitted to relevant groups and anti-phishing lists.
BE VIGILANT!!!
@jessienabFURTHER UPDATE
The web.app domain forwards to pay [dot] iagadvanced [dot] com
BE VIGILANT!
@jessienab I've been getting a version of this attack that detects my host is Hetzner and sends it to the email on the page. I know it's BS because the email on file for Hetzner isn't on the page :) and my provider's spam filter seemed to learn that pretty fast too!