From: brendinghat.com Nigel@brendinghat.com
Date: 03 Feb 2021 19:55:58 -0800
Subject: Unauthorized Login-Attempt
Dear Nigel@brendinghat.com,
we noticed that an unrecognized device made a suspicious login attempt
using your account password error. If you do not verify your account,
your Mail will be temporarily blocked within hours.
You need to verify the password to continue sending and receiving
messages.
Verify to continue receiving messages
<Suspicious link to firebase storage>
If this wasn’t you, please follow below to keep your account safe.
Activate second sign-in
<Suspicious link to firebase storage>
brendinghat.com
Are you a Dreamhost customer by chance? We’ve experienced the same things, but the sender was send the phishing emails to the same address as the “sender” from within the hosting provider.
No, we are not dreamhost – we actually operate our own servers.
It is very easy to spoof an Email as though it comes from someone else’s server. Particularly with this Email as all it needs to do is deliver the dodgy hyperlink for the recipient to click.
I will look closer at the actual Email tomorrow, and if I find anything interesting, I will let you know.