The email was from dev.to and the fraud was in the comment
A dev.to notification landed in my inbox today.
Someone called Dev Support Team had mentioned me in a comment.
The first thing I did was open the .eml and look at the headers.
They were genuine.
DKIM for dev.to and SendGrid in pass, SPF pass from IP 168.245.48.148 and DMARC pass.
The From is yo@dev.to and the Return-Path bounces at em4960.dev.to.
That detail changes how you read the incident.
The sender is not spoofed, so they used the platform's mention system to make the notification go out from its real infrastructure and pass every filter.
The mention was a sweep
Both notifications came from accounts created that same day.
The display name is πΏππ« ππͺπ₯π₯π€π§π© ππππ’ in Unicode mathematical characters.
Those characters slip past text filters and the name reads like an administrator's. The usernames are random keypresses.
{"type_of":"user","id":4228803,"username":"fgggggggggggggggggg",
"name":"πΏππ« ππͺπ₯π₯π€π§π© ππππ’","twitter_username":null,
"github_username":null,"summary":null,"website_url":null,
"joined_at":"Nov 5, 2026"}
A single comment mentioned 10 accounts in alphabetical order. @anabel_obieze_1a5f44815ba, @anagha_h_a68da6f1218e8e30, @anajsana95, @analista_83 (mine) and six more starting with anand. (Source: dev.to).
That is not a targeted attack.
It is a sweep of the user directory with a list pasted into a comment.
The accounts no longer exist
Both permalinks in the notification have been returning 404 for a while.
I checked a legitimate comment on the same platform and that one answers 200, so it is not a routing fault.
The profiles do not load either and the API still returns the data because it caches it.
The comment and the account have already been swept.
The destination was a five-week-old domain
The campaign's shortener tr.ee/dev-to landed on offerup-pay.top (Source: tr.ee, resolved on November 5).
It was registered on October 1 at 21:48 UTC, with PDR Ltd as registrar, Cloudflare nameservers and a Let's Encrypt certificate issued that same day (Source: rdap.org).
The campaign has a documented earlier step, anti-bot.icu, registered on September 25 with the same registrar, now in clientHold with its nameservers pointing to suspended-domain.com (Source: rdap.org).
The domain did not go unnoticed either.
On October 10, ten days after registration, a public urlscan.io analysis already returned the same title and the October 1 certificate. Google Safe Browsing had not classified it in that analysis (Source: urlscan.io).
The verify you are human protects the scammer
I passed the check out of curiosity.
It is not Cloudflare, it is a cheap copy with the title "Just a moment", a hue filter on top, right-click disabled and copy and Ctrl+U blocked.
It loads no external script and sends the drag telemetry to /__captcha/verify.
Below it there is a paragraph forbidding AI, LLMs and crawlers from reading the page.
A real site puts that control in front of a signup to stop bots.
This one puts it in front of the scam.
That way it slows down scanners and anyone asking an assistant whether the link is safe.
Behind it appears the card Mandatory Verification Of User #17984 with a 24-hour deadline and a fake support chat.
The form asks for card number, expiry, CVV, name and the exact card balance.
Then comes the code the bank sends you by SMS.
The domain is called offerup-pay because the original script was a marketplace scam with the excuse of receiving a buyer's payment.
They pasted the DEV logo on top and reused it (Source: dev.to/rudratosh).
What I checked on my machine
In Brave, both links in the email, opened at 19:09, landed on 404.
There is not a single visit to offerup-pay.top or tr.ee in this machine's history.
I opened the gateway on my phone.
There is no trace of an installation either.
No new .exe, .msi, .ps1 or .zip in Downloads or Temp. The startup keys still hold Syncthing and Discord. Nothing else.
A web page installs nothing unless you accept a download. The risk starts when someone types the card or the bank code.
The platform acknowledges it
Ben, DEV's founder, posted today that they are working on mechanisms to reject that kind of attack automatically (Source: dev.to/ben).
Until that filter arrives, anyone can fire an email at you with the platform's real brand and a link that works.
What to do if you get one?
- Do not pay, do not verify and do not type the card, the balance or the bank code.
- Report the comment and block the account even if it no longer exists, the report feeds the filter.
- Report the domain at abuse.cloudflare.com (even if they wash their hands) and in Google Safe Browsing's phishing form.
- If you typed the card, call the bank, block the card and review the charges.
- If you wrote in the chat, expect calls or SMS from a fake support in the coming days.
- If you opened the link on your phone, check whether you accepted a configuration profile or installed an app.
Originally published at https://sammideblas.com/notas/the-email-was-real-and-the-fraud-was-in-the-comment
Si has leΓdo hasta aquΓ... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ΒΏNo Crees?
Top comments (0)