Welcome to the mailbox user forum
 
New Topic
mailbox user forumTopicProblemSpam and Viruses
Properties
Category Spam and Viruses
Tags scam, dataleak

Scam from xxx@mailbox.org

5871127 shared this problem 26 days ago
Solved

Hi guys,

I found very suspicious that after a couple of days of the Mailbox official reminder to renew to subscription, I got an email about a failed payment; It stinks as a personal data leak: 

X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <xxx@mailbox.org>
Delivered-To: OMITTED@mailbox.org
Received: from director-05.heinlein-hosting.de ([10.196.197.202])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	by dobby26a.heinlein-hosting.de with LMTPS
	id GH11HcOgZ2pgigEATazItQ:P1
	(envelope-from <xxx@mailbox.org>)
	for <OMITTED@mailbox.org>; Mon, 27 Jul 2026 20:17:39 +0200
Received: from smtp202.mailbox.org ([10.196.197.202])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	by director-05.heinlein-hosting.de with LMTPS
	id GH11HcOgZ2pgigEATazItQ
	(envelope-from <xxx@mailbox.org>)
	for <OMITTED@mailbox.org>; Mon, 27 Jul 2026 20:17:39 +0200
From: "helpdesk@mailbox.org" <xxx@mailbox.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org; s=mail20150812;
	t=1785176257;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type;
	bh=KAy7kYWw0tj6elrOhIykaGySV2XXHIaod9uv9i8jMOk=;
	b=ZNumh8wzcL1k1rd+CVDdeWY2oDNMTi+zMH4D3XNKK9sG7vg69AEy03I+ERvv2IkvCGQ3Hs
	sqpWl/tk7hvw6h5m39zX2zEdPFW0d7YEnjZkiOPgAjLtFzdKbqxMx0oYPVjT6yuA8HiZLf
	HSDqxSYUwVR7JVQHGkL5SOgGv0yZzDJy9Oxus/QHmODgHUzaBMPStI/+piea2axYXTrgi+
	WgnCICs0ocb7lkdsgMlAN9lmsRISDNAAvLY95vLjzBEurtpfV8dn6XFTFUxbrJOTrcoid8
	bDiCSKZ0ao8/coDJ4JRVjw8jSCBjPaIRK6VAPJFwmb3oXOmcoSuIkkuVeBn7jQ==
Subject: =?iso-8859-1?B?Qml0dGUgYWt0dWFsaXNpZXJlbiBTaWUgSWhyZSBEYXRl?=
 =?iso-8859-1?B?biBzbyBzY2huZWxsIHdpZSBt9mdsaWNoIQ==?=
To: <OMITTED@mailbox.org>
Content-Type: multipart/alternative; boundary="0cMM=_t93S2N7aZPmc9v4oPXBb4DFRiE42"
MIME-Version: 1.0
Date: Mon, 27 Jul 2026 11:17:37 -0700
Message-Id: <2736202607171172D3A6A711$17307BF468@DESKTOPATULD>
X-MBO-RS-META: q6fsqjkopquzjjk7t7adg9soytoi6i5x
X-MBO-RS-ID: af8defe096b6a182e53

This is a multi-part message in MIME format

--0cMM=_t93S2N7aZPmc9v4oPXBb4DFRiE42
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hallo,

wir haben festgestellt, dass Sie Probleme beim Verl=E4ngern Ihres Abon=
nements f=FCr OMITTED@mailbox.org bei Mailfence mit Ihrer aktuellen K=
reditkarte hatten.

Wir erhalten von Ihrer Bank die Fehlermeldung "Autorisierung abgelehnt=
".

Bitte kontaktieren Sie Ihre Bank, um dieses vor=FCbergehende Problem z=
u beheben.

Alternativ k=F6nnen Sie:

1. Ihre Kreditkartendaten aktualisieren:

Melden Sie sich in Ihrem Konto an > oben rechts auf Ihren Vornamen kli=
cken > Zahlungsinformationen aktualisieren

2. Bankkarte verkn=FCpfen:

BETRAG: 42,00 EUR (3,50 EUR * 12 Monate)

Zahlungsinformationen aktualisieren [Link removed]

Vergessen Sie nicht, Ihren Benutzernamen anzugeben, da wir Ihr Konto s=
onst nicht aktualisieren k=F6nnen.

Informationen zu Ihrem Konto: OMITTED@mailbox.org
Dienst: Mailbox
Kredit-/Debitkarte: xxxx

Mit freundlichen Gr=FC=DFen, Mailbox

support@mailbox.org mailto:support@mailbox.org

--0cMM=_t93S2N7aZPmc9v4oPXBb4DFRiE42
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html><head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-=
8859-1">
  <META name=3DGenerator content=3D10.90> <META name=3Dviewport conten=
t=3D"width=3Ddevice-width, initial-scale=3D1"> <META name=3Dformat-det=
ection content=3Dtelephone=3Dno> <title>Bitte aktualisieren Sie Ihre D=
aten so schnell wie m=F6glich!</title>
 </head>
 <body style=3D"BACKGROUND-COLOR: #ffffff" bgColor=3D#ffffff> <P>Hallo=
,</p><p>wir haben festgestellt, dass Sie Probleme beim Verl=E4ngern Ih=
res Abonnements f=FCr OMITTED@mailbox.org bei Mailfence mit Ihrer akt=
uellen Kreditkarte hatten.</p><p>Wir erhalten von Ihrer Bank die Fehle=
rmeldung "Autorisierung abgelehnt".</p><p>Bitte kontaktieren Sie Ihre =
Bank, um dieses vor=FCbergehende Problem zu beheben.</p><p>Alternativ =
k=F6nnen Sie:</p><p>1. Ihre Kreditkartendaten aktualisieren:</p><p>Mel=
den Sie sich in Ihrem Konto an > oben rechts auf Ihren Vornamen kli=
cken > Zahlungsinformationen aktualisieren</p><p>2. Bankkarte verkn=
=FCpfen:</p><p>BETRAG: 42,00 EUR (3,50 EUR * 12 Monate)</P> <H3><FONT =
face=3D"MS Serif"><A >Zahlungsinformationen aktualisieren</A></FONT></H3> <P>Vergessen Si=
e nicht, Ihren Benutzernamen anzugeben, da wir Ihr Konto sonst nicht a=
ktualisieren k=F6nnen.</p><p>Informationen zu Ihrem Konto: OMITTED@ma=
ilbox.org
Dienst: Mailbox
Kredit-/Debitkarte: xxxx</p><p>Mit fre=
undlichen Gr=FC=DFen, Mailbox
<A >support@mailbox.org</A></P></body>
 </html>

--0cMM=_t93S2N7aZPmc9v4oPXBb4DFRiE42--

1 The same problem 0  

Replies (1)

photo
1
mailbox Support ● 25 days ago

Hello 5871127,

thank you for reporting this!

Our administrators have already analysed the situation and cleared all affected inboxes of the phishing messages. We are constantly reviewing and strengthening our security measures to intercept such messages even earlier in future.

If you have any further questions, please feel free to contact our Support team via support.mailbox.org or by writing an email to helpdesk@mailbox.org.

Please note: We have removed the sender's email address from your report.

Kind regards

Your mailbox Team

---

Useful links:

d9e15a7fee470fb66af17115c3a43886

Reply
This comment is in trash! Restore
photo
1
5871127 ● 25 days ago

The problem here is not the phishing, is the fact this person knew that my contract was about to expire.

Why? and how?

This comment is in trash! Restore
photo
1
mailbox Support ● 24 days ago

Hello 5871127,

we understand your concerns and apologise for the inconvenience caused due to the latest phishing wave.

Based on the reports we have received, this appears to be part of a larger phishing campaign that was sent to several mailbox users. The message references a "contract", but that alone is not evidence that the sender had access to your specific account information. "Contract renewal", "subscription", or "account verification" are common themes in phishing emails because they apply to a large proportion of customers and increase the chance that recipients will think the email is genuine.

At this time, there is no indication from this campaign that attackers had knowledge of individual mailbox contracts. If such evidence existed—for example, if the email contained your exact contract term, payment history, or other non-public account details—that would be a different situation.

Your safety and trust are very important to us. Should you have any further questions or require assistance, our Support team will be happy to help at any time.


Kind regards

Your mailbox Team

---

Useful links:

d9e15a7fee470fb66af17115c3a43886

This comment is in trash! Restore
photo
Leave a Comment
 
Attach a file