Phishing attempt #1975

soulstenance commented 2025年06月06日 02:57:14 +02:00

Comment

@moderation
I recently got a phishing attempt to the email address I have here on Codeberg. I only use it on Codeberg and Github, and based on what I know, it seems plausible that someone harvested it from here. I have it visible exclusively to signed in users (at least that's how it should be) for legitimate use - namely for using it to grab my public GPG key off a keyserver. However, this means that someone must have signed up on Codeberg for the express purpose of phishing which surely violates the TOS.

Here's what I know:

• Impersonation of what appears to be a German domain registrar
• Entire email is in German - clearly targeting German nationals
• The confirmation link goes to an obviously different site (I didn't open it of course)
• All the other links appear valid (again, I'm not testing it)

This is both a warning to users, to be careful out there, but also wondering if there's any specific thing Codeberg can do or if there's any private channel I can and/or should send the email's details to for potential action, such as banning the user (if they in fact used the same email here). Should I also notify the registrar or anyone else?

Given my account is highly secured and my email is visible to signed in users, I don't think a data breach is likely but I thought I should make this event known anyways.

### Comment @moderation I recently got a phishing attempt to the email address I have here on Codeberg. I only use it on Codeberg and Github, and based on what I know, it seems plausible that someone harvested it from here. I have it visible exclusively to signed in users (at least that's how it should be) for legitimate use - namely for using it to grab my public GPG key off a keyserver. However, this means that someone must have signed up on Codeberg for the express purpose of phishing which surely violates the TOS. Here's what I know: - Impersonation of what appears to be a German domain registrar - Entire email is in German - clearly targeting German nationals - The confirmation link goes to an obviously different site (I didn't open it of course) - All the other links appear valid (again, I'm not testing it) This is both a warning to users, to be careful out there, but also wondering if there's any specific thing Codeberg can do or if there's any private channel I can and/or should send the email's details to for potential action, such as banning the user (if they in fact used the same email here). Should I also notify the registrar or anyone else? Given my account is highly secured and my email is visible to signed in users, I don't think a data breach is likely but I thought I should make this event known anyways.

ashimokawa commented 2025年06月06日 13:36:48 +02:00

@soulstenance
please forward the information you have to abuse@codeberg.org
would be nice if you could also reach out to the registrar.

@soulstenance please forward the information you have to abuse@codeberg.org would be nice if you could also reach out to the registrar.

fnetX commented 2025年06月10日 00:11:20 +02:00

I checked one of your repos, and your email address is also used in Git commits, thus publicly available.

Crawlers crawling email addresses from Git hostings is an annoying thing and happening for years. I have an email address that is only used on GitHub, and it is regularly being spammed.

I really doubt that email crawlers make an extra account on Codeberg, but even if they do, there is little we can do to know who is doing this and to prevent it.

I checked one of your repos, and your email address is also used in Git commits, thus publicly available. Crawlers crawling email addresses from Git hostings is an annoying thing and happening for years. I have an email address that is only used on GitHub, and it is regularly being spammed. I really doubt that email crawlers make an extra account on Codeberg, but even if they do, there is little we can do to know who is doing this and to prevent it.

soulstenance commented 2025年06月10日 05:20:21 +02:00

@fnetX wrote in #1975 (comment):

I checked one of your repos, and your email address is also used in Git commits, thus publicly available.

Crawlers crawling email addresses from Git hostings is an annoying thing and happening for years. I have an email address that is only used on GitHub, and it is regularly being spammed.

I really doubt that email crawlers make an extra account on Codeberg, but even if they do, there is little we can do to know who is doing this and to prevent it.

That makes sense. I hadn't considered that git commits would be crawlable, including the email address. With this bit of info, it seems prudent I chose to use an alias instead of my real email. I guess I have just been real lucky up till now.

@fnetX wrote in https://codeberg.org/Codeberg/Community/issues/1975#issuecomment-5063430: > I checked one of your repos, and your email address is also used in Git commits, thus publicly available. > > Crawlers crawling email addresses from Git hostings is an annoying thing and happening for years. I have an email address that is only used on GitHub, and it is regularly being spammed. > > I really doubt that email crawlers make an extra account on Codeberg, but even if they do, there is little we can do to know who is doing this and to prevent it. That makes sense. I hadn't considered that git commits would be crawlable, including the email address. With this bit of info, it seems prudent I chose to use an alias instead of my real email. I guess I have just been real lucky up till now.