Phishing: Messages Delivery Notification [Failure] | Fake Held-Mail Report From Your Own Address
At a glance
- Verdict
- PhishingGet the recipient to click Review or Delete Pending Messages and type their mailbox password into a mail login page on a travel-business domain.
- Subject line
Messages Delivery Notification [Failure]- Claimed sender
- Mail Delivery
info@secure-techie.comspoofed to look like the recipient - Impersonates
- No real organisation or personPersona: Mail Delivery, an unnamed mail system reporting from the recipient's own address that messages addressed to it are being held
- Received
- · Published
- Known variants
Display name as reported by the recipient; the screenshot shows only the address, which is also the address the message was sent to. The table spills out of its panel, so the buttons hide the fourth row's size and all of a fifth row but its To: line, and the External Email line below the message is the recipient's mail gateway's tag.
Evidence: the message as received, passive registry lookups, and the results of a detonation the recipient ran in a secured sandbox; the analysis itself opens nothing. How we analyse a scam email.
You have (11) pending message(s) stopped by the mail server from delivering due to low bandwidth. The report comes from the recipient's own address, the same sender's fourth lure of the evening. It lists invoices, an order and shipping documents without a single sender, blames bandwidth, and carries the same mail login link.
Complete Email
from: Mail Delivery info@secure-techie.com
date: 10/05/2026 9:56 PM
subject: Messages Delivery Notification [Failure]
Email Body
Message generated from secure-techie.com source.
Messages Delivery Failure.
Subject
Recipient
Size
Re: Requst for Invoice
To: info@secure-techie.com
156kb
RE: New Order
To: info@secure-techie.com
1.2mb
BL Copy, Shipping docs
To: info@secure-techie.com
374kb
Re: July Overdue Invoices
To: info@secure-techie.com
To: info@secure-techie.com
As at 10/5/2026 6:26:33 p.m. you have (11) pending message(s) stopped by the mail server from delivering due to low bandwidth.
We notify you to take prompt actions.
Review Pending Messages
Delete Pending Messages
Link
The link in the message, as reported by the recipient, is the same one the login alert, the delivery-failure notice and the storage warning carried that evening:
https://kebecotravel.com/be4f96/0910/mail/server/authn/log(in).html#info@secure-techie.com
Detonated by the recipient in a secured sandbox, the link returned this page:
Red Flags
This is mailbox credential phishing dressed as a held-mail report: a table of messages the mail server has supposedly stopped on their way to the recipient, and two buttons to deal with them. Its opening move is the fear of a missed invoice or order; what it is after is the password to the mailbox. It is the fourth lure from the same operator to the same mailbox that evening, after the fake login alert at 19:30, the fake delivery-failure notice at 20:09, whose subject it reuses, and the fake storage warning at 20:53: from the same address, with the same link. It belongs with the notice that restricted 7 incoming messages and the fake web-admin notice that held Two (2) Messages pending delivery: each holds mail the recipient cannot see and offers a link to get it back. Everything below comes from the message, the link and sandbox result reported by the recipient, and the public registration record of the link's domain.
1. From Your Own Address, Under a Bounce Notice's Name
- From, as reported: Mail Delivery
info@secure-techie.com - To, in the screenshot: the same address
- Below the message: External Email
Mail Delivery is close to the names real bounce messages arrive under, such as Mail Delivery Subsystem or Mail Delivery System. Those come from the mail system's own address, a mailer-daemon or postmaster address at the provider. A display name is free text the sender types, and the address behind this one is info@secure-techie.com, the very mailbox the notice was sent to. A mail system does not report on a mailbox from the mailbox.
It is the sender's fourth name for itself that evening, as the recipient reported them: Mail Administrator on the login alert, postmaster.secure-techie.com on the delivery notice, no name at all on the storage warning, and now Mail Delivery. The address behind all four is the same.
The recipient's mail system was not persuaded. The External Email line below the message is the recipient's mail gateway's tag for mail that arrived from outside the organisation, the same tag it put on the three earlier lures. A message from an account to itself does not arrive from outside.
2. A Report From Nobody, About Mail From No One
- "Message generated from
secure-techie.comsource." - Columns: Subject, Recipient and Size
- Every recipient: To:
info@secure-techie.com
Generated by what? The banner credits the notice to the recipient's own domain and to a source that is no server, no service and no provider. There is no provider's name anywhere, no logo, no signature, no footer and no link to a help page. A real report on held mail is written by the mail system that is holding it, and it says which one, because that is where the mail is.
Then the table. It has a column for the recipient and fills it with the recipient's own address on every row: the one thing the recipient already knows. It has no column for the sender, and the sender is what anyone needs to judge held mail. An invoice from a regular supplier is worth chasing; the same subject from a stranger is not. Real reports of held mail, such as the quarantine digests that business mail services send, list who each message is from, with its subject and date, and their buttons lead to the service's own website.
Leaving the senders out does the sender a favour. A sender could be checked: the recipient could simply ask a supplier whether they sent an invoice. A subject on its own cannot be checked against anything, so the only way offered to find out what is behind it is the click.
3. Invoices, an Order and Shipping Documents: Subjects Picked to Be Opened
- Re: Requst for Invoice
- RE: New Order
- BL Copy, Shipping docs
- Re: July Overdue Invoices
Every subject is about money: an invoice someone has asked for, a new order, a copy of a bill of lading, the shipping document that goods are released against, and invoices that are overdue. For a business, these are the messages that cannot wait, which is why they make good bait. Three are dressed as replies, with Re: or RE: in front, as if they continued conversations the recipient is already part of.
They do not hold up to a second look. Requst is missing an e. Invoices overdue since July, in a notice sent on 5 October, would be three months late, a reason to hurry that comes without the name of whoever is owed. And not one of the four names a company, an order number or an amount: only what a business would want to open, with nothing that could be looked up.
4. Eleven Messages Stopped by "Low Bandwidth"
- "you have (11) pending message(s) stopped by the mail server from delivering due to low bandwidth."
- "We notify you to take prompt actions."
Mail is not stopped by low bandwidth. A slow or busy connection makes mail slower, not lost: a sending server that cannot get through keeps the message and tries again on its own, for hours or days, and a receiving server that is busy tells the sender to try again later. Nothing in that process holds messages for the recipient to review or delete through a link. And a mail server with too little bandwidth for eleven messages had enough for this notice, which arrived like any other email.
The count is written like a slot in a template, just as the same sender's delivery notice put its fifteen in square brackets: (11) in round brackets, followed by message(s), the hedge of text written before anyone knew whether the number would be one or many. A system that had counted eleven messages would say 11 messages. Nor does the table bear the count out. In the recipient's mail client it spills out of its own panel: the third row's size and the fourth subject print across the summary, the buttons cover the fourth row's size and most of a fifth row, and the fifth row's To: line prints across the External Email tag. However many rows the table holds, the reader can make out four subjects, not eleven.
Both buttons are links: Review Pending Messages for the reader who wants to see the invoices, Delete Pending Messages for the reader who just wants the problem gone. Either way, the answer is a click into the email, as it was on the sender's three earlier lures.
5. Two Hours Ahead of UTC, for the Third Time
- Dated: 21:56 on Monday, 5 October 2026, India time, in the recipient's mail client: 16:26 UTC
- "As at 10/5/2026 6:26:33 p.m."
The notice gives its time without a time zone. Read in UTC, it is 18:26, two hours after the notice itself was sent. Read as India time, it is three and a half hours before. Either way, the minute gives it away: 6:26, on a notice sent at 16:26 UTC.
The same sender did this twice before, the same evening. Its login alert reported a sign-in at 10/5/2026 4:00:11 p.m. (UTC) on a message dated 14:00 UTC, and its delivery notice counted fifteen messages pending as of 10/5/2026 4:39:52 p.m. on a message dated 14:39 UTC. All three times sit exactly two hours ahead of the moment their message was sent, to the minute, and all three are written the same way: month first, seconds included, a lower-case p.m.
That fits one generator stamping each message with the moment it was written, read from a clock two hours ahead of UTC, and presenting it as an event. Messages that have been pending since the minute the notice about them was written have not been pending at all.
6. Four Stories in 146 Minutes, One Link
- 19:30: Multiple unusual login attempts: someone trying to get in
- 20:09: WARNING: [15] Messages Delivery Notification [Failure]: fifteen messages unable to leave
- 20:53: Your mailbox is full.: no room for new mail to arrive
- 21:56: Messages Delivery Notification [Failure]: eleven messages stopped on their way in
All four arrived on Monday 5 October 2026, at the India times shown in the recipient's mail client. In 146 minutes, one address reported four problems with one mailbox, and two different reasons why mail was not reaching it: at 20:53 the mailbox was full, at 21:56 the bandwidth was low. This notice even reuses the subject of the 20:09 one, without its WARNING and its count, for a different story: that one had fifteen outgoing messages stuck, this one eleven held on their way to the recipient. None of the four mentions the others.
What stays the same is what the sender needs: the recipient's address, and the link.
- Domain:
kebecotravel.com - Path:
/be4f96/0910/mail/server/authn/log(in).html - After the
#:info@secure-techie.com, the recipient's own address
It is the same link as on the three earlier lures, down to the last character: a page named like a mail server's sign-in, log(in).html under mail/server/authn, in folders on kebecotravel.com. That is a travel business's domain, registered in 2009 through Bluehost, with nothing to do with mail. As the post on the login alert sets out, a seventeen-year-old business website carrying a mail sign-in deep in its folders fits a site whose hosting has been broken into and borrowed, which makes the business a victim too.
Reviewing held mail would mean signing in, and signing in is the step this link is built for. The part after the # is the recipient's own address: the browser does not send it to the server, but a script on the page can read it, and phishing pages commonly use it to fill in the sign-in form, so that only the password is left to type.
7. In the Sandbox: Page Not Found, Which Is Not the Same as Safe
The recipient detonated the link in a secured sandbox, and the server answered with the stock web-hosting error page shown under the link above: ERROR 404 - PAGE NOT FOUND, with help links on spelling and folders, WordPress links and .htaccess files. It is the same link as on the three earlier lures, and the same page. By the time it was detonated, the page was gone, or was being kept from that visitor. A 404 is a fact about the page on the day it was checked, not a verdict on the email. On 5 October, four lures in one evening were built to lead to a page dressed as a mail sign-in, and the sender's next one can point to a page that is still up.
How This Scam Works
The email is bait for one click on Review Pending Messages or Delete Pending Messages. What the page behind the link asked for was not observed (by the time the link was detonated, the page was gone), so the steps below describe how mailbox credential phishing of this kind typically works, not what this sender was seen to do. The fourth story, step 5, is the one stage observed here.
- The List: Lures like this go to addresses harvested in bulk, and role mailboxes such as
info@on company domains are among the most exposed, because they are published by design. The template fills the address into the From line, the To line, every row of the table and the link, and the domain into the banner. - The Forged Sender: The From line carries the recipient's own address under Mail Delivery, a name close to the ones real bounce messages arrive under, so that the message reads as the mail system reporting to its own user.
- The Bait: Four subjects about money, each with a size: an invoice requested, an order, shipping documents and invoices overdue. Enough to look like real mail waiting, and no sender that could be checked.
- The Push: We notify you to take prompt actions. Held mail sounds as if it could be lost, and both remedies on offer, review or delete, are in the email.
- The Fourth Story: This notice came 63 minutes after the same sender's storage warning, 107 minutes after its delivery notice and 146 minutes after its login alert, to the same mailbox, with a different story and the same link. Operators typically keep sending new stories to an address that has not taken the bait, and this one sent four in a single evening.
- The Page: Pages behind lures of this kind typically show a webmail sign-in form with the victim's address already filled in from the part of the link after the
#, and ask only for the password. Many report the first password as wrong to collect it twice, then send the victim on to their real webmail, so that nothing seems amiss. - The Prize: A business mailbox password opens far more than mail: password resets for other services, contacts who trust the address, and the invoices and payment conversations that business email compromise feeds on. The subjects in this table are that kind of conversation: an invoice sent from a trusted address with new bank details is how a stolen mailbox password typically turns into a stolen payment.
Conclusion and Recommendations
Nothing in this notice holds a real message. It is the same operator's fourth lure of the evening to the same mailbox: from the recipient's own address under a bounce notice's name, it lists four subjects about money without a single sender, blames low bandwidth for mail that would never wait on a click, stamps its time two hours ahead of UTC as two of the earlier lures did, and links to the same mail login page as the three before it.
Mail does get held, and this notice counts on that. A real held-mail report says who each message is from and lets you release it in your own account. A report that shows only subjects and asks for a click is holding nothing but bait.
Immediate Actions:
- Do Not Click Review or Delete Pending Messages: Both are links, and there is nothing behind either one to review or delete. Mail your service is really holding is held in your own account.
- Do Not Reply: Nobody behind this message reads replies in good faith, and any answer confirms that the mailbox is watched.
- Check for Held Mail Yourself: Sign in to your mail the way you always do, from a bookmark or its app. If your service holds suspicious mail, its own quarantine page or spam folder lists it, with each message's sender. If nothing is there, nothing is held.
- Ask the Sender, Not the Email: If you are expecting an invoice, an order or shipping documents, ask the customer or supplier directly, on a number or address you already have. They can send it again.
- Report It: Use your mail client's Report phishing option, so the next copy is filtered for everyone, and forward the message to CERT-In at
incident@cert-in.org.in. The registration record listsabuse@bluehost.comas the abuse contact of the link domain's registrar; reports there help get pages like this removed. If money was lost, use the National Cyber Crime Reporting Portal atcybercrime.gov.inor call the helpline 1930. - If You Entered Your Password: From a trusted device, go to the mail service directly, change the password, sign out every other session and turn on multi-factor authentication. Then check the mailbox for forwarding rules, filters and connected apps you did not set up, tell whoever runs your mail, and change the same password anywhere else it is used.
Verification Steps:
- Read the From Line: A delivery report from your own address, to your own address, did not come from your mail system.
- Look for the Senders: A real held-mail report says who each message is from. One that puts your own address beside every subject is not a report.
- Check the Time: Compare the time a notice gives with the time it arrived. Messages pending as at the minute their notice was written have not been pending.
- Point Before You Click: On a computer, rest the pointer on a button and read the address from the left to the first single slash.
kebecotravel.comis not your mail server. - Watch for the External Tag: If your mail system tags mail from outside, a message from your own address that carries the tag did not come from your account.
- Search the Wording: Paste stopped by the mail server from delivering due to low bandwidth into a search engine. Templates like this are often reported word for word.
Additional Protection Tips
- Turn On Multi-Factor Authentication for Every Mailbox: Shared mailboxes such as
info@included. A stolen password is then not enough on its own. - Know Where Your Held Mail Lives: Find out once whether your mail service holds suspicious messages, where you review them and what its real notices look like. A notice that looks nothing like them stands out.
- Use a Password Manager: It offers a saved sign-in only on the domain it was saved for, so it stays silent on a mail login page that lives on someone else's website.
- Sign In Only From a Bookmark or the App: Then no email ever needs to send you to your mail's sign-in page, and one that tries stands out.
- Publish DMARC on Your Own Domain: A DMARC policy, raised to
p=rejectonce your genuine mail is confirmed to pass, tells receiving servers to refuse mail that puts your domain in the From line without your authority. - Confirm New Bank Details by Phone: Invoices and orders are the bait here, and they are also what a captured mailbox is used for. Agree with customers and suppliers that any change of bank details is confirmed by phone, on a number you already have, before money moves.
- Expect the Next Story: When lures start arriving from your own address, tell whoever reads the mailbox that more are likely to follow from the same sender, with different stories and the same kind of link. This notice was the fourth in 146 minutes.
Remember: Mail that is really held waits for you in your own account, under its sender's name. A notice that shows you the subjects and hides the senders is not holding your mail. It is holding out bait.
