PluginAlliance hacked? Questionable invoice emails
I originally posted this on the PA sub, but apparently that's a dead sub.
This was sent 3 hours after I made a purchase, which in itself seems off. "Shipping" also seems off, these are plugins, there is no shipping. The invoice number also does not appear in the PluginAlliance portal, nor does any invoice number. There is an order number which also doesn't match. And lastly, there is an extra space between "new" and "product."
I should also note the general greeting of "Dear Sir or Madam" as they know my name. If they are able to supposedly pull up invoice and order numbers, then they would be able to pull up my name.
Subject: Shipping Confirmation and Invoice 70428017
Dear Sir or Madam,
Please find the invoice for your order 7420984 enclosed.
If your order included a download, the download link was already sent to you in a separate email.
Thank you for your order and enjoy your new product!
Kind Regards,
Your PLUGIN ALLIANCE Sales Team
---------------------------------------------------------------------
-> Plugin Alliance LLC
-> 2 Avenue de Lafayette
-> Boston, MA 02111
-> United States of America
Attached was a PDF which I did not open. This was sent to an email address ONLY used for this particular website, and only after I made a purchase.
This was sent as plain text, no HTML, unlike the other PA emails.
The headers show that it was sent through Amazon Web Services (eu-central-1.amazonses.com).
The sending IP address (69.169.224.2) is on a black list (hostkarma.junkemailfilter.com).
The actual order email from PluginAlliance was sent through mailer7in.plugin-alliance.com.
Given that I've received no other emails to that email address of this nature before, if this indeed was not sent by or on the behalf of PA, that can only mean that a bad actor has compromised their system to send emails to those who made recent purchases.