Phishing Alert: Fake Account Activation Email from “photographie.de”
We've received a suspicious email posing as a notification from photographie.de regarding account login details. The subject line: [PHOTOGRAPHIE] Anmeldedaten (“Login Details”), and the message includes a fraudulent link claiming to allow you to set a password.
The email claims:
Benutzername: www.kgygte.blogspot.hk - 97 240 USD KRAKEN
Unter der folgenden Adresse kannst du dein Passwort festlegen:
Set Your Password
What Makes This Email Suspicious?
- The “username” is clearly bogus: it references a
blogspot.hkblog and a large dollar amount ($97,240 USD) with the word “KRAKEN,” possibly trying to bait cryptocurrency users. - The link leads to a legitimate-looking WordPress login page at
photographie.de, but it's likely compromised or spoofed. - SPF, DKIM, and DMARC all pass – meaning the domain was likely used legitimately or hijacked temporarily.
- The originating IP address (85.13.144.112) is registered in Germany and associated with
kasserver.com, a hosting service sometimes abused in phishing campaigns.
How to Tell This Is a Scam
- It references random content (blogspot.hk, Kraken, dollar amounts) that have no relation to your services or accounts.
- Uses urgent or irrelevant financial language (“97 240 USD KRAKEN”) to trigger clicks.
- Spoofs a legitimate site with a legitimate-looking login page – common in credential harvesting attacks.
What You Should Do
- Do not click any links in the message.
- Mark the message as spam or phishing in your email client.
- If you operate
photographie.de, scan for vulnerabilities or unauthorized access to your WordPress instance.
Stay Protected
Always verify unusual login requests, especially those involving unexpected usernames, unrelated financial terms, or odd domain names. For business owners, regularly monitor your domain and hosting account for any signs of compromise.
If you’ve received a similar email or need help securing your website or inbox, contact Mac-PC Assist for expert help.
