The recent brand impersonation phishing campaign targeting Rebel.com clients has been fully mitigated and the incident is officially resolved. Over the past week, our Security Operations team has actively monitored all mail relays, infrastructure nodes, and threat telemetry channels, confirming zero new unauthorized email dispatches or active phishing endpoints. All systems and customer accounts are secure and fully operational.
Following our coordinated abuse escalations, upstream infrastructure partners, web hosts, and domain registries successfully dismantled the malicious sending network behind these unauthorized emails. The LK Domain Registry and HostPinnacle Compliance executed formal suspensions against the primary sending hosts, including serverclub.lk, vpshosting.lk, and hostpinnacle.co.ke, effectively dropping DNS resolution for those nodes. Additionally, AWS Abuse and Cloudflare terminated the underlying outbound server relays, proxies, and phishing links associated with emkt.axiroz.com, afdvmail.com, rws-mail.com, and thejoepavichpodcast.com.
While the incident is closed and our monitoring shows that traffic telemetry remains completely clean, we encourage all clients to remain vigilant. Please remember that official communications from Rebel always originate from valid @rebel.com or @rebel.ca addresses. If you previously entered your account credentials on a suspicious link, we strongly advise updating your Rebel.com account password right away and turning on two-factor authentication for added security.
We sincerely appreciate our clients' prompt reports and cooperation throughout this response effort.
Rebel.com Security & Support Team
Posted Oct 06, 2026 - 15:12 EDT
Monitoring
We are actively responding to the ongoing brand impersonation phishing campaign targeting Rebel.com clients and coordinating directly with upstream registries, web hosts, and cloud infrastructure providers to dismantle the malicious sending network behind these unauthorized emails.
Our security team has secured full technical header evidence for the primary sending domains associated with this campaign, including thejoepavichpodcast.com, rws-mail.com, serverclub.lk, vpshosting.lk, hostpinnacle.co.ke, and afdvmail.com. Formal abuse escalations have been submitted to AWS Abuse targeting the underlying outbound relay infrastructure, alongside active notifications to Cloudflare and domain registries to disable DNS routing and enforce domain suspensions.
Progress is actively underway across these infrastructure providers. The LK Domain Registry has initiated a formal investigation and issued compliance notices to the operators behind serverclub.lk and vpshosting.lk to halt unauthorized email dispatches. HostPinnacle Compliance has also received our escalation to suspend the sending accounts and signing keys associated with hostpinnacle.co.ke.
As a critical safety reminder, any email with the subject line "Action required: Please confirm your contact info." that directs you to external links such as emkt.axiroz.com is 100% fake. Please do not click any links and delete these emails immediately. If you previously entered your account credentials on a suspicious link, we strongly advise you to reset your Rebel.com account password right away.
We remain in active incident response mode and will post further updates here as providers confirm server takedowns and domain suspensions.
Rebel.com Security & Support Team
Posted Sep 28, 2026 - 11:44 EDT
Update
We are actively monitoring this ongoing phishing campaign and working directly with external providers to shut down the malicious infrastructure.
Formal abuse escalations have been filed with AWS, GoDaddy, Cloudflare, and the LK Registry to suspend sending accounts and domains behind these emails (thejoepavichpodcast.com, rws-mail.com, serverclub.lk, and vpshosting.lk).
Important Safety Reminders:
- Emails asking to "confirm your contact info" that direct to emkt.axiroz.com are 100% fake.
- Do not click any links; delete these emails immediately.
- If you entered your credentials on a fake link, please reset your Rebel account password right away.
We will post further updates as providers confirm server takedowns.
Rebel.com Team
Posted Sep 22, 2026 - 15:32 EDT
Identified
We have been notified of a recent phishing attempt being received by our customers.
"Your domain will go on hold if we can't confirm your contact information, please take care of this right away so you can use your account.
Verify My Account
If you're having trouble, try copy-pasting the full link into your browser: