Executive Summary
On February 5-6, 2026, Rebel.com identified a sophisticated phishing campaign targeting our customers. The attackers used a deceptive "WHOIS Accuracy Verification" lure to direct users to a fraudulent login page. As of February 6, 11:55 AM EST, the malicious site has been successfully taken down and the threat has been neutralized.
1. Incident Overview
- The Lure: Clients received emails appearing to be from Rebel Support, claiming their domains would be placed "on hold" due to missing WHOIS information.
- The Technical Vector: The emails contained links to a third-party hosted site (
apps.emailerstack.com) designed to mimic the Rebel.com login dashboard to harvest credentials.
- The Source: Our analysis of the email headers identified the originating traffic from a specific external mail relay service.
2. Our Response Actions
Once the first reports reached our support queue, our security team initiated the following:
- Provider Escalation: We worked directly with the upstream hosting provider to provide forensic evidence of abuse.
- Domain Suspension: Within 24 hours of our formal report, the fraudulent domain and associated hosting account were suspended.
- Status Monitoring: We maintained a real-time status page update to keep our community informed throughout the investigation.
3. Lessons Learned & Improvements
While the external threat was neutralized quickly, this incident highlights the evolving nature of social engineering.
- System Hardening: We are reviewing our internal alerting systems to flag similar deceptive URLs faster.
- Community Reporting: The speed of this takedown was made possible by clients who provided Full Email Headers. This data is the single most important tool in our defense arsenal.
4. Moving Forward: Your Security Checklist
To ensure your account remains secure against future attempts, we recommend three standard practices:
- Switch to App-Based 2FA: SMS-based codes are vulnerable to interception. Please switch to a TOTP Authenticator App (like Google Authenticator or Authy) in your Rebel security settings.
- Verify the URL: Always ensure you are on
https://www.rebel.com before entering credentials.
- Report, Don't Click: If an email seems suspicious, do not click the link. Forward the email headers to our support team for verification.
Final Statement
Protecting your digital identity is our highest priority. We thank our community for their vigilance and quick reporting, which allowed us to resolve this matter swiftly.
The Rebel Team