Phishing campaign

netcup.de is the valid DE domain from Netcup.

And the email seems legit. Is a renewal notification about the SSL in your domain.

Those emails are definitely not legitimate. Text that looks like it's the right link but actually links to a phishing site is the oldest trick in the book. In this case the actual link is to a subdomain of voxpartner.fr, which is clearly not a Netcup domain. Aside from that, almost everybody who gets these emails doesn't actually buy for-pay certificates from Netcup but uses Letsencrypt certificates that Netcup installs at the click of a button and updates automatically for free.

Zitat von DJPRMF

netcup.de is the valid DE domain from Netcup.

And the email seems legit. Is a renewal notification about the SSL in your domain.

Sorry, but just look at the link behind https://www.netcup.de/rechnung. I really doubt that voxpartner.fr is related to netcup in any way. Also the sending adress has the domain endurogps.it, it's really hard to believe this could be legit.

Zitat von tab

it's really hard to believe this could be legit.

Scammers don't have to go to great lengths to hide the sending domain or the actual link target anymore, because most people have no ability to "mouse hover" over a sender name or link text to see the address or the link target. They read email on phone touch screens, and phone email clients stupidly don't show this information without interaction in an attempt to not confuse the user with "technical information".

so true - but sophisticated is possible :

https://thehackernews.com/2025/04/phishers-exploit-google-sites-and-dkim.html

Zitat von NaN

and phone email clients stupidly don't show this information without interaction in an attempt to not confuse the user with "technical information".

Jap, you're right.

Thankfully, there are also some really good alternatives to the standard mail apps, such as FairEmail. In such cases, it immediately displays a warning that the links are different:

pasted-from-clipboard.png

Sadly it's the users who really need these apps with protective measures who don't use them.

Zitat von webdesignheld

so true - but sophisticated is possible :

https://thehackernews.com/2025/04/phishe…s-and-dkim.html

For things like that, Google deserves to be banned from the internet and to pay for all damages. Haha, I know, "no rules". What a wonderful world this is - especially for criminals.

Are we seeing the same thing? 🤔

netcup.de is a valid domain from netcup,from what I can see.

In fact,is the domain where this forum is... You can see the attachment.

For me redirects for the .com domain

Edit: I see what you mean.

The link itself is redirecting. The text domain is ok. 😅

Zitat von DJPRMF

Are we seeing the same thing?

Iphone User? Then - no...