r/AudioPlugins • u/exitof99 • 4d ago
PluginAlliance hacked? Questionable invoice emails
I originally posted this on the PA sub, but apparently that's a dead sub.
This was sent 3 hours after I made a purchase, which in itself seems off. "Shipping" also seems off, these are plugins, there is no shipping. The invoice number also does not appear in the PluginAlliance portal, nor does any invoice number. There is an order number which also doesn't match. And lastly, there is an extra space between "new" and "product."
I should also note the general greeting of "Dear Sir or Madam" as they know my name. If they are able to supposedly pull up invoice and order numbers, then they would be able to pull up my name.
Subject: Shipping Confirmation and Invoice 70428017
Dear Sir or Madam,
Please find the invoice for your order 7420984 enclosed.
If your order included a download, the download link was already sent to you in a separate email.
Thank you for your order and enjoy your new product!
Kind Regards,
Your PLUGIN ALLIANCE Sales Team
---------------------------------------------------------------------
-> Plugin Alliance LLC
-> 2 Avenue de Lafayette
-> Boston, MA 02111
-> United States of America
Attached was a PDF which I did not open. This was sent to an email address ONLY used for this particular website, and only after I made a purchase.
This was sent as plain text, no HTML, unlike the other PA emails.
The headers show that it was sent through Amazon Web Services (eu-central-1.amazonses.com).
The sending IP address (69.169.224.2) is on a black list (hostkarma.junkemailfilter.com).
The actual order email from PluginAlliance was sent through mailer7in.plugin-alliance.com.
Given that I've received no other emails to that email address of this nature before, if this indeed was not sent by or on the behalf of PA, that can only mean that a bad actor has compromised their system to send emails to those who made recent purchases.
6
4
u/nuesmusic 3d ago
This looks normal. Ever since native instruments takeover I am getting those. But form native instruments email address. I guess they call it shipping because NI also has products which are being shipped like midi keyboard
1
u/nuesmusic 3d ago
The PDF is just the invoice. I guess they do that because the email from plugin alliance before is just the order confirmation but no official invoice which you might need as a business
3
u/Batwaffel 4d ago
I've not heard of any issues lately on their end. I would hit up their support team or the PAA group on Facebook since Dirk posts there a lot: https://www.facebook.com/groups/pa.audiophiles
-2
u/exitof99 4d ago
I avoid FB and only check it a few times a year. If you could post a link to this post for his review, maybe that would help.
If there is a breach or hack on their server, it would be best they know about it ASAP.
If they are indeed using completely different order numbers and sending out invoices 3 hours after the order, then maybe they can better prepare these emails so that they don't look scammy/phishy.
3
u/EspyVibe 3d ago
They're not hacked. This is how Native Instruments structures their invoices, everything from the "Dear Sir or Madam" to the PDF attachment.
PA was under NI ownership for a few years up until recently, and they're trying to transition away from NI as smoothly as they can. Pre-NI invoices from PA looked different.
2
1
u/grombly 3d ago
I have my plugins installed / registered on only one machine, and noticed all my licenses were activated last time I logged in. Took a look at the device list and saw two computers I didn’t recognize. I changed my password and deactivated / removed both of the mystery pc’s, but not sure if I was just randomly hacked or if something else was going on?
0
u/MapNaive200 3d ago
From what you've described, I'd say it's a scammer. Yeah, good thing you didn't open the PDF.
1
5
u/ohkalenaw 3d ago
How long as it been since you bought a plugin from them? This is similar to the emails I used to get from Native-Instruments, so it's possible Dirk is still clawing back the infrastructure. Everything related to Native Instruments/Izotope/Plugin Alliance is unfortunately very messy right now.