Phishing: WARNING: [15] Messages Delivery Notification [Failure] | Fake Postmaster Notice From Your Own Address
At a glance
- Verdict
- PhishingGet the recipient to click Review or Delete and type their mailbox password into a mail login page on an unrelated travel-business domain.
- Subject line
WARNING: [15] Messages Delivery Notification [Failure]- Claimed sender
- postmaster.secure-techie.com
info@secure-techie.comspoofed to look like the recipient - Impersonates
- No real organisation or personPersona: Mail Administrator of the recipient's own domain mail server, sending as postmaster from the recipient's own address
- Received
- · Published
- Known variants
Display name as reported by the recipient; the screenshot shows only the address, which is also the address the message was sent to. The External Email line below the message is the recipient's mail gateway's tag.
Evidence: the message as received, passive registry lookups, and the results of a detonation the recipient ran in a secured sandbox; the analysis itself opens nothing. How we analyse a scam email.
The delivery of messages was stopped by your domain mail server. The notice comes from the recipient's own address, 39 minutes after the same operator's fake login alert. It names none of its 15 messages, blames a server named after an IP address that cannot exist, and carries the same link.
Complete Email
from: postmaster.secure-techie.com info@secure-techie.com
date: 10/05/2026 8:09 PM
subject: WARNING: [15] Messages Delivery Notification [Failure]
Email Body
Message from host.359.64.768.97.secure-techie.com domain server
Messages Delivery Failure
The delivery of messages was stopped by your domain mail server.
You have [15] pending messages that could not be sent as of 10/5/2026 4:39:52 p.m.
Click to Review or Delete pending outgoing email messages.
Thanks,
Mail Administrator
Link
The link in the message, as reported by the recipient, is the same one the Multiple unusual login attempts alert carried:
https://kebecotravel.com/be4f96/0910/mail/server/authn/log(in).html#info@secure-techie.com
Detonated by the recipient in a secured sandbox, the link returned this page:
Red Flags
This is mailbox credential phishing dressed as a bounce notice: a report that the recipient's own mail server has stopped their outgoing mail, and two links to deal with it. Its opening move is worry about messages that never arrived; what it is after is the password to the mailbox. It is the second lure from the same operator to the same mailbox that evening, 39 minutes after the fake login alert: from the same address, in the name of the same Mail Administrator, with the same link. It belongs with the fake web-admin notice that held Two (2) Messages pending delivery and the notice that restricted 7 incoming messages: each counts messages the recipient cannot see and offers a link to get them back. Everything below comes from the message, the link and sandbox result reported by the recipient, and the public registration record of the link's domain.
1. From Your Own Address, Under a Postmaster's Name
- From, as reported:
postmaster.secure-techie.cominfo@secure-techie.com - To, in the screenshot: the same address
- Below the message: External Email
The display name is the recipient's own domain with postmaster in front of it, joined by a dot. At a glance it reads like the domain's postmaster, the mailbox every mail domain is expected to keep for mail problems. It is not an address at all. A display name is free text the sender types, and the address actually behind it is info@secure-techie.com, the very mailbox the notice was sent to. A real delivery report comes back from the mail system's own address, such as a MAILER-DAEMON or postmaster address, not from the mailbox it is reporting to.
The recipient's mail system was not persuaded. The External Email line below the message is the recipient's mail gateway's tag for mail that arrived from outside the organisation, the same tag it put on the login alert that evening. A message from an account to itself does not arrive from outside.
2. A Server Named After an IP Address That Cannot Exist
- Banner: Message from
host.359.64.768.97.secure-techie.comdomain server
The banner credits the notice to a server, and the server's name is built the way internet and hosting providers often name machines after their numeric address: the word host, four numbers, then the domain. An address of that kind is four numbers, each from 0 to 255. Two of these, 359 and 768, are out of range, so no machine has ever had the address this name spells out. The name was not taken from a real server. It was put together to look like one, and set under the recipient's own domain so that the notice seems to come from inside.
3. Fifteen Messages, and Not One of Them Named
- Subject: WARNING: [15] Messages Delivery Notification [Failure]
- "You have [15] pending messages that could not be sent"
A real delivery failure report is about particular messages. It says which address could not be reached and gives the error the receiving server returned, such as a 550 code for an address that does not exist. It usually carries the original message or its headers too, subject line included, so that the sender knows exactly what did not arrive. This notice counts fifteen messages and names none of them: no recipient, no subject, no error, and no reason why your domain mail server would have stopped them.
The count sits in square brackets in both the subject and the body, and the subject brackets [Failure] the same way, like slots in a template waiting for a value. Messages Delivery, in both the subject and the heading, is not how a mail system, or English, names the thing: it is a message delivery failure.
4. Outgoing Mail Does Not Wait for a Click
- "The delivery of messages was stopped by your domain mail server."
- "Click to Review or Delete pending outgoing email messages."
That is not how outgoing mail works. A message that cannot be delivered right away stays with the sending server, which retries it on its own; if delivery fails for good, the server returns it to its sender with a report saying why. Nothing in that process waits for the sender to review or delete anything through a link in an email, and a message that never left the sender's own mail app sits in its Outbox, in plain sight.
Both choices offered here are links. Review is for the reader who wants to know what went missing, Delete for the reader who just wants the problem gone, and either way the answer is a click into the email. The login alert from the same sender did the same with its two buttons, This wasn't me and This was me.
5. Pending "As Of" the Minute It Was Written
- Dated: 20:09 on Monday, 5 October 2026, India time, in the recipient's mail client: 14:39 UTC
- "as of 10/5/2026 4:39:52 p.m."
The notice gives its time without a time zone. Read in UTC, as the same sender's login alert labelled its time, it is 16:39 UTC, two hours after the notice itself. Read as India time, it is three and a half hours before. Either way, the minute gives it away: 4:39, on a notice dated 14:39 UTC. The login alert did exactly the same 39 minutes earlier: dated 14:00 UTC, it reported a sign-in at 4:00:11 p.m. Both times sit two hours ahead of the moment their message was sent, to the minute, and both are written the same way, month first, with a lower-case p.m.
That fits one generator stamping each message with the moment it was written, read from a clock two hours ahead of UTC, and presenting it as an event. Messages that have been pending since the very minute the notice about them was written have not been pending at all.
6. A Delivery Notice and a Login Alert, One Link
- Domain:
kebecotravel.com - Path:
/be4f96/0910/mail/server/authn/log(in).html - After the
#:info@secure-techie.com, the recipient's own address
A delivery failure and a suspicious sign-in are different problems. This notice and the login alert send them to the same place, down to the last character: a page named like a mail server's sign-in, log(in).html under mail/server/authn, in folders on kebecotravel.com. That is a travel business's domain, registered in 2009 through Bluehost, with nothing to do with mail. As the earlier post sets out, a seventeen-year-old business website carrying a mail sign-in deep in its folders fits a site whose hosting has been broken into and borrowed, which makes the business a victim too.
Reviewing stuck mail would mean signing in, and signing in is the step this link is built for. The part after the # is the recipient's own address: the browser does not send it to the server, but a script on the page can read it, and phishing pages commonly use it to fill in the sign-in form, so that only the password is left to type.
7. In the Sandbox: Page Not Found, Which Is Not the Same as Safe
The recipient detonated the link in a secured sandbox, and the server answered with the stock web-hosting error page shown under the link above: ERROR 404 - PAGE NOT FOUND, with help links on spelling and folders, WordPress links and .htaccess files. By the time it was detonated, the page was gone, or was being kept from that visitor. A 404 is a fact about the page on the day it was checked, not a verdict on the email. On 5 October, this notice and the login alert were both built to lead to a page dressed as a mail sign-in, and the sender's next notice can point to one that is still up.
How This Scam Works
The email is bait for one click on Review or Delete. What the page behind the link asked for was not observed (by the time the link was detonated, the page was gone), so the steps below describe how mailbox credential phishing of this kind typically works, not what this sender was seen to do. The second story, step 5, is the one stage observed here.
- The List: Lures like this go to addresses harvested in bulk, and role mailboxes such as
info@on company domains are among the most exposed, because they are published by design. The template fills the address into the From line, the To line and the link, and the domain into the display name and the server name. - The Forged Sender: The From line carries the recipient's own address under a name built from their own domain, so that the message reads as the domain's mail system reporting to its own user.
- The Technical Costume: A green bar, a server name made of numbers, a bracketed count and a time to the second: enough to look machine-made, and none of it checkable.
- The Worry: Fifteen outgoing messages that never arrived could be anything: a quotation, an invoice, a reply a customer is waiting for. The reader is meant to want to know which, and the only way offered to find out is the link.
- The Second Story: This notice came 39 minutes after the same sender's login alert to the same mailbox, with a different story and the same link. Operators typically send several lures to an address that has not taken the bait, so a reader who shrugged off a sign-in warning may still click on lost mail.
- The Page: Pages behind lures of this kind typically show a webmail sign-in form with the victim's address already filled in from the part of the link after the
#, and ask only for the password. Many report the first password as wrong to collect it twice, then send the victim on to their real webmail, so that nothing seems amiss. - The Prize: A business mailbox password opens far more than mail: password resets for other services, contacts who trust the address, and the invoices and payment conversations that business email compromise feeds on. A captured mailbox is typically used to send the next round of the same lure to everyone in its contacts.
Conclusion and Recommendations
Nothing in this notice records a message that failed to send. It is the same operator's second lure of the evening to the same mailbox: from the recipient's own address under a postmaster's name, it blames a server named after an IP address that cannot exist, counts fifteen messages it cannot name, dates them to the minute it was written, and links to the same mail login page as the sign-in alert before it.
Real delivery failures happen, and this notice counts on that. A real bounce tells you which message failed. A notice that cannot, and asks you to click to find out, has no message to return.
Immediate Actions:
- Do Not Click Review or Delete: Both are links, and there is nothing behind either one to review or delete. Whatever you want to know about your outgoing mail is in your own mailbox.
- Do Not Reply: Nobody behind this message reads replies in good faith, and any answer confirms that the mailbox is watched.
- Check Your Outbox and Sent Folder Yourself: Open your mail the way you always do. A message that has not left is in your Outbox; a message a server refused comes back to your inbox as a delivery report that names it. If neither is there, nothing is stuck.
- Report It: Use your mail client's Report phishing option, so the next copy is filtered for everyone, and forward the message to CERT-In at
incident@cert-in.org.in. The registration record listsabuse@bluehost.comas the abuse contact of the link domain's registrar; reports there help get pages like this removed. If money was lost, use the National Cyber Crime Reporting Portal atcybercrime.gov.inor call the helpline 1930. - If You Entered Your Password: From a trusted device, go to the mail service directly, change the password, sign out every other session and turn on multi-factor authentication. Then check the mailbox for forwarding rules, filters and connected apps you did not set up, tell whoever runs your mail, and change the same password anywhere else it is used.
Verification Steps:
- Read the From Line: A delivery report from your own address, to your own address, did not come from your mail system.
- Look for the Message: A real delivery report names the message it is about: who it was to, the error that stopped it, and usually its subject. One that only counts is not a report.
- Check the Numbers: In a server name built from an IP address, every number runs from 0 to 255. A 359 or a 768 means the name was made up.
- Point Before You Click: On a computer, rest the pointer on a link and read the address from the left to the first single slash.
kebecotravel.comis not your mail server. - Watch for the External Tag: If your mail system tags mail from outside, a message from your own address that carries the tag did not come from your account.
- Search the Wording: Paste The delivery of messages was stopped by your domain mail server into a search engine. Templates like this are often reported word for word.
Additional Protection Tips
- Turn On Multi-Factor Authentication for Every Mailbox: Shared mailboxes such as
info@included. A stolen password is then not enough on its own. - Know What a Real Bounce Looks Like: Send one test message to an address you know does not exist, and keep the delivery report that comes back. That is what a real failure looks like, and a notice that looks nothing like it stands out.
- Use a Password Manager: It offers a saved sign-in only on the domain it was saved for, so it stays silent on a mail login page that lives on someone else's website.
- Sign In Only From a Bookmark or the App: Then no email ever needs to send you to your mail's sign-in page, and one that tries stands out.
- Publish DMARC on Your Own Domain: A DMARC policy, raised to
p=rejectonce your genuine mail is confirmed to pass, tells receiving servers to refuse mail that puts your domain in the From line without your authority. - Expect the Next Story: When one lure arrives from your own address, tell whoever reads the mailbox that more are likely to follow from the same sender, with different stories and the same kind of link. This notice followed a login alert by 39 minutes.
Remember: Mail that fails to send comes back to you on its own, with its name on it. When a delivery notice asks you to come and collect your mail, the only thing it wants delivered is your password.
