https://kellypidone.infinityfreeapp.com/us
No Error
You definitely had a data breach and your customers are being contacted. I received an email made to appear to come from InfinityFree about an account with no activity to be disabled. With a link to reactivate it. I tried to post the email here so you could see the details but your forum did not allow it. You need to investigate the breach and notify your customers.
That sounds like a legitimate email to be honest.
Can you post the email address it came from but putting [at] instead of the @ and [dot] instead of the .
That way we can confirm if it’s come from a legitimate source
Did you receive the email from [email protected]? If so, that’s just our supplier iFastNet sending you system messages. You specifically gave consent for that when you created your hosting account. If so, that’s not a data breach, and we don’t need to notify anyone.
If the email is from a different sender, then that’s something to be investigated. And the outcome could potentially be that it’s caused by a data breach, but it could also be something else. It’s way to early to draw such conclusions.
Thank you for your reply. Below is the email I received. Except that I do not have an account named qkxpe2of. I added “one of my accounts” and “=My Email Address?” to replace the actual values in the link.
From Address: epizy dot com noreply <>
Subject: Epizy dot com account : qkxpe2of dot epizy dot com Inactive
Body: Hello Valued Customer,
We are emailing you, to let you know your Epizy dot com account qkxpe2of dot epizy dot com (one of my accounts) has received less than 5 visitors in
the past 30 day period.
The account will be removed in 20 to 60 days time.
If you require this account re-activated, please click the following link
http: forward-slash forward-slash byet dot org forward-slash reactivate dot php?hash=5e1a4f63593bd30779ea012d2f833b82&email=My Email Address&username=one of my accounts
Regards
Epizy dot com
Thank you for sharing. That confirms it: that’s an email from iFastNet.
The domain it refers to, qkxpe2of.epizy.com, is the “main domain” of your accounts, which on our hosting is only an internal identifier. It actually refers to your account epiz_33641205. You can verify it by logging into the hosting control panel for that account, the main domain is listed in the sidebar there.
I do agree: the email is very unclear and looks suspicious. That should definitely be improved.
But no personal information was leaked and no systems were breached.
Thank you again. That is the first email I have received from them that I know of and I have been a customer for several years. The wording was very similar but not exactly what I have received before from InfinityFree for the underactive account. I don’t know why I received this email since I had also received the standard email about the account being inactivated within the previous week. I had already re-activated it so I am confused as to why I received this. You are correct about the wording being sketchy. They should also clarify what the internal identifier account name is since I had never known of it nor seen it before, that I can recall. I assumed it was some fake or non-existent account.