Skip to main content

Phishing: Multiple unusual login attempts | Fake Mail Administrator Alert From Your Own Address

· 15 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

At a glance

Verdict
PhishingGet the recipient to click a response button and type their mailbox password into a login page on an unrelated travel-business domain.
Subject line
Multiple unusual login attempts
Claimed sender
Mail Administrator info@secure-techie.comspoofed to look like the recipient
Impersonates
No real organisation or personPersona: Mail Administrator, an unnamed mail-service administrator writing from the recipient's own address
Received
· Published
Known variants
Related analyses

Display name as reported by the recipient; the screenshot shows only the address, which is also the address the message was sent to. The External Email line below the message is the recipient's mail gateway's tag.

Evidence: the message as received, passive registry lookups, and the results of a detonation the recipient ran in a secured sandbox; the analysis itself opens nothing. How we analyse a scam email.

We noticed some unusual login activity with your account. The alert comes from the recipient's own address, signed by a Mail Administrator who never names a mail service. It calls one attempt multiple, dates it two hours after the alert itself, leaves the IP address blank, and links to a page dressed as a mail login on a 17-year-old travel-business domain.

Complete Email​

from: Mail Administrator info@secure-techie.com
date: 10/05/2026 7:30 PM
subject: Multiple unusual login attempts

Email Body​

Multiple unusual login attempts on your mail account

We noticed some unusual login activity with your account.

Email
info@secure-techie.com
Time
10/5/2026 4:00:11 p.m. (UTC)
Location
East Jerusalem, Palestine
Device
Windows 10
Browser
Chrome
IP address

To make sure your account is secure, let us know if this was you.

This wasn't me

This was me

Attacking email screenshot: Multiple unusual login attempts, sent from and to the recipient's own address, listing a time, a location in East Jerusalem, Windows 10 and Chrome, an IP address row with no value, and two buttons, This wasn't me and This was me

The link in the message, as reported by the recipient:

https://kebecotravel.com/be4f96/0910/mail/server/authn/log(in).html#info@secure-techie.com

Detonated by the recipient in a secured sandbox, the link returned this page:

Sandbox screenshot of the link: a stock web-hosting ERROR 404 - PAGE NOT FOUND page with help links about spelling and folders, WordPress links and .htaccess files

Red Flags​

This is mailbox credential phishing dressed as a security alert: a report that someone has been trying to sign in to the recipient's mail account, and buttons to answer it. Its opening move is fear for the account; what it is after is the password to it. It belongs with the fake web-admin notice that claimed to come from the recipient's own mail system, and with the fake Facebook login alert, whose two answers, Report the user and Yes, me, played the same part as the two buttons here. Everything below comes from the message, the link and sandbox result reported by the recipient, and the public registration record of the link's domain.

1. From Your Own Address, to Your Own Address​

  • From, as reported: Mail Administrator info@secure-techie.com
  • To, in the screenshot: the same address
  • Below the message: External Email

The alert claims to come from the very mailbox it is warning about, and the screenshot shows it addressed to that mailbox too. A mail service sends its security alerts from its own domain, under its own name. It does not write to an account from the account.

The From line is text the sender types, and putting the recipient's own address in it is a deliberate choice: a message from your own address looks internal, like the mail system talking to itself. Mail Administrator finishes the effect with a role where a name should be.

The recipient's mail system was not persuaded. The External Email line below the message is the recipient's mail gateway's tag for mail that arrived from outside the organisation, and a message from an account to itself does not arrive from outside. Only the full headers, which record the servers the message passed through, could show its route, and they were not captured for this post. The tag shows that the recipient's own mail system saw it arriving from outside, whatever its From line says.

2. A Mail Administrator for No Mail Service​

  • Display name, as reported: Mail Administrator
  • "Multiple unusual login attempts on your mail account"
  • "let us know if this was you"

Which mail service? The email never says. There is no provider's name, no logo, no signature, no footer with a company name or address, and no link to a help page or to the account itself. It speaks of your mail account and your account, and asks the recipient to let us know, without ever saying who us is.

A real sign-in alert is about one account at one provider, and it says which: the provider's name is on the message because the alert is the provider's. A template that has to work for mailboxes at every provider at once cannot name any of them, so it names none and calls itself Mail Administrator.

3. "Multiple" Attempts, One Set of Details, and a Blank IP Address​

  • Subject: Multiple unusual login attempts
  • "We noticed some unusual login activity with your account."
  • Details: one time, one location, one device, one browser, and IP address with nothing after it

The subject and the heading say multiple. The panel lists one attempt: one time, one place, East Jerusalem, Palestine, one device, Windows 10, and one browser, Chrome. Then it reaches the detail a real alert is built on, the internet address the sign-in came from, and prints the label alone. A provider that saw a sign-in knows the address it came from: that address is how it places the sign-in on a map in the first place. This alert names a city and leaves blank the one field that could back it up.

The panel does not even fit its own contents. In the recipient's mail client its last rows spill out below it, and Chrome prints across the sentence that follows.

4. A Login Attempt Two Hours After the Alert About It​

  • Dated: 19:30 on Monday, 5 October 2026, India time, in the recipient's mail client: 14:00 UTC
  • Time in the alert: 10/5/2026 4:00:11 p.m. (UTC): 16:00 UTC

Read as written, month first and in UTC, the alert reports a sign-in at 16:00 UTC on 5 October. That is 21:30 India time, two hours after the alert itself. An alert cannot report an event that has not happened yet. Read day first, as dates are written in India, 10/5/2026 is 10 May, five months earlier, which fits no better.

The gap is exactly two hours, to the minute. That suggests the time is simply the moment the message was generated, taken from a clock two hours ahead of UTC and labelled UTC. Either way, it is not the time of any sign-in this email could be warning about.

5. "This Was Me" Is a Click Too​

  • "To make sure your account is secure, let us know if this was you."
  • Buttons: This wasn't me and This was me

The email offers two answers, and both are buttons. A button in an email is a link, so there is no answer to this message that does not involve clicking into it. This wasn't me is for the reader who is alarmed. This was me is for the reader who only wants the warning to go away, and it is a click all the same.

A genuine alert can be checked without touching it. The same activity is listed in the account's own security settings, reached by typing the provider's address or opening its app, and that is where a real sign-in, and a real answer to it, belong. An alert that can only be answered by clicking inside the email is asking for the click.

6. A Mail Login Page on a Travel Business's Domain​

  • Domain: kebecotravel.com
  • Path: /be4f96/0910/mail/server/authn/log(in).html
  • After the #: info@secure-techie.com, the recipient's own address

Read the domain first: kebecotravel.com. It is a name for a travel business, and it has nothing to do with mail. Its public registration record shows a domain registered on 27 February 2009 through Bluehost and registered until 27 February 2027, last changed on 12 February 2026, with its owner's details redacted for privacy and its name servers under cbs-me.com. That is not a throwaway registered for a campaign. A seventeen-year-old domain with a business's name, carrying a mail sign-in page deep in its folders, fits a familiar pattern: a small business's website whose hosting has been broken into and used for someone else's page, which makes the business a victim too. Nothing in the record suggests the business had anything to do with this email.

The path is dressed as a mail server's sign-in: mail, server, authn (shorthand for authentication) and log(in).html. That last name reads as login to a person, but the plain word is not in the address, perhaps so that a filter looking for it does not find it. In front of them sit be4f96 and 0910, folder names that mean nothing to anyone but whoever created them.

The part after the # is the recipient's own address. Everything after a # in a link is a fragment: the browser does not send it to the server, but a script on the page can read it. Phishing pages commonly use it to fill in the victim's address on their sign-in form, so that the page appears to know the account already and asks only for the password.

7. In the Sandbox: Page Not Found, Which Is Not the Same as Safe​

The recipient detonated the link in a secured sandbox, and the server answered with the stock web-hosting error page shown under the link above: ERROR 404 - PAGE NOT FOUND, with help links on finding the correct spelling and folder, on 404 errors after clicking WordPress links and on modifying an .htaccess file. It is the kind of page a hosting provider shows when the file asked for is not there.

So by the time the link was detonated, the page was gone, or was being kept from that visitor: some phishing pages show an error to anything that looks like a scanner or a sandbox, as the fourth draft of the fake Income Tax notice did with its Access Denied page. Either way, a 404 is a fact about the page on the day it was checked, not a verdict on the email. On 5 October the link was built to lead to a page dressed as a mail sign-in, and a fresh copy of the same email can point to one that is still up.

How This Scam Works​

The email is bait for one click on either button. What the page behind the link asked for was not observed (by the time the link was detonated, the page was gone), so the steps below describe how mailbox credential phishing of this kind typically works, not what this sender was seen to do.

  1. The List: Lures like this go to addresses harvested in bulk, and role mailboxes such as info@ on company domains are among the most exposed, because they are published by design. The template fills the address into the From line, the To line, the details panel and the link.
  2. The Forged Sender: The From line carries the recipient's own address under a role name, Mail Administrator, so that the message reads as the mail system talking to its own user.
  3. The Alarm: A sign-in from a distant city, a device, a browser and the word multiple: enough detail to look like a log entry, and none of it checkable.
  4. The Choice That Isn't: Two buttons, one for each answer, and both are clicks. The alarmed reader clicks This wasn't me; the reader who wants the warning gone clicks This was me.
  5. The Borrowed Website: The page is typically placed on someone else's website, often a small business's site whose hosting account has been compromised, in folders of its own. When it is found and removed, as this one appears to have been by the time it was detonated, the operator moves to another site and sends the next batch.
  6. The Page: Pages behind lures of this kind typically show a webmail sign-in form with the victim's address already filled in from the part of the link after the #, often with the company's logo pulled from its own website, and ask only for the password. Many report the first password as wrong to collect it twice, then send the victim on to their real webmail, so that nothing seems amiss.
  7. The Prize: A business mailbox password opens far more than mail: password resets for other services, contacts who trust the address, and the invoices and payment conversations that business email compromise feeds on. A captured mailbox is typically used to send the next round of the same lure to everyone in its contacts.

Conclusion and Recommendations​

Nothing in this email records a real sign-in. It is a template that puts the recipient's own address in its From line, its To line, its details panel and its link, reports one sign-in as multiple with no IP address at a time two hours after its own, names no mail service, and asks for an answer that can only be given by clicking through to a page dressed as a mail login on a travel business's domain.

Real sign-in alerts exist, and this one counts on that. A real alert is also in your account: look there, and the email has nothing left to say.

Immediate Actions:​

  • Do Not Click Either Button: This was me is a click too. Whatever the answer, give it in the account, not in the email.
  • Do Not Reply: Nobody behind this message reads replies in good faith, and any answer confirms that the mailbox is watched.
  • Check Your Account Yourself: Sign in to your mail service the way you always do, from a bookmark or its app, and open its security or recent-activity page. If nothing there matches the alert, the alert is false.
  • Report It: Use your mail client's Report phishing option, so the next copy is filtered for everyone, and forward the message to CERT-In at incident@cert-in.org.in. The registration record lists abuse@bluehost.com as the abuse contact of the link domain's registrar; reports there help get pages like this removed. If money was lost, use the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930.
  • If You Entered Your Password: From a trusted device, go to the mail service directly, change the password, sign out every other session and turn on multi-factor authentication. Then check the mailbox for forwarding rules, filters and connected apps you did not set up, tell whoever runs your mail, and change the same password anywhere else it is used.

Verification Steps:​

  • Read the From Line: A security alert from your own address, to your own address, was not sent by your mail provider.
  • Look for the Provider's Name: A real alert names the service whose account it is about. Mail Administrator is not a service.
  • Point Before You Click: On a computer, rest the pointer on a button and read the address from the left to the first single slash. kebecotravel.com is not a mail service.
  • Check the Time: Compare the time an alert gives with the time it arrived. An attempt dated after the alert is not a record of anything.
  • Watch for the External Tag: If your mail system tags mail from outside, a message from your own account that carries the tag did not come from your account.
  • Search the Wording: Paste We noticed some unusual login activity with your account into a search engine. Templates like this are often reported word for word.

Additional Protection Tips​

  • Turn On Multi-Factor Authentication for Every Mailbox: Shared mailboxes such as info@ included. A stolen password is then not enough on its own.
  • Use a Password Manager: It offers a saved sign-in only on the domain it was saved for, so it stays silent on a mail login page that lives on someone else's website.
  • Sign In Only From a Bookmark or the App: Then no email ever needs to send you to your mail's sign-in page, and one that tries stands out.
  • Publish DMARC on Your Own Domain: A DMARC policy, raised to p=reject once your genuine mail is confirmed to pass, tells receiving servers to refuse mail that puts your domain in the From line without your authority.
  • Keep Your Own Website Patched: The page in this email sat on a business's website, not on one the sender built. Keep your site's software, plugins and hosting passwords current, and look out for folders and files you did not create.
  • Give Shared Mailboxes a Rule: Messages like this land in the mailboxes a company publishes. Agree that security alerts are checked in the account, never acted on from the email.

Remember: A sign-in alert is a record in your account, not a button in an email. An alert that comes from your own address and can only be answered with a click is the attempt it warns you about.

Share this post