filed 2026-09-09 still live2026-10-25

Mercuryo ESP account abuse -> lookalike wallet-signature page

redirect-mercuryo.com

7 critical5 high3 medium2 infostill up 45 days after filing

Docket 17 checks

critical · 7

01The message's DKIM signature (d=mercuryo.io, s=mail) cryptographically verifies against the key currently published in Mercuryo's own DNS

dkim.verify() returns True. Live selector mail._domainkey.mercuryo.io publishes k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeMVIzrCa3T14JsNY0IRv5/2V1/v2itlviLQBwXsa7shBD6TrBkswsFUToPyMRWC9tbR/5ey0nRBH0ZVxp+lsmTxid2Y2z+FApQ6ra2VsXfbJP3HE6wAO0YTVEJt1TmeczhEd2Jiz/fcabIISgXEdSpTYJhb0ct0VJRxcg4c8c7wIDAQAB. Signature b=DdjtlO+k..., t=1788984914 (2026-09-09 20:15:14 UTC). The message body was therefore not modified in transit and was signed by a system holding Mercuryo's DKIM authority.

Method pip install dkimpy; python3 -c "import dkim; print(dkim.verify(open('email.eml','rb').read()))"; dig +short TXT mail._domainkey.mercuryo.io · Observed · § line 01
03The payload domain redirect-mercuryo.com was registered 19 hours 21 minutes before the phishing email was sent

Creation Date 2026-09-09T00:54:26Z (registry and registrar WHOIS agree); Registry Expiry 2027-09-09 (one-year registration). Email Date/DKIM t= 2026-09-09 20:15:14 UTC = 19h20m48s after creation; delivery to the victim 2026-09-09 21:12:29 UTC = 20h18m03s after creation. Registrar: Cloudflare, Inc. (IANA 1910). Nameservers: val.ns.cloudflare.com, lochlan.ns.cloudflare.com. Status: clientTransferProhibited, addPeriod.

Method whois redirect-mercuryo.com; dig +short NS redirect-mercuryo.com; date arithmetic against the Date header and DKIM t= value · Observed · § line 03
04The campaign was sent from Brevo account 7370981, campaign 225, contact list 3315982, and Mercuryo has three Brevo domain-verification tokens live in its DNS

Headers: X-Mailin-Client: 7370981; X-Mailin-Campaign: 225; Feedback-ID: 172.246.43.93:7370981_225:7370981:Sendinblue; X-Mailer: Sendinblue. List-Id "NzM3MDk4MS0zMzE1OTgyLTExNA==" base64-decodes to "7370981-3315982-114" (account 7370981, list 3315982). Message-Id <202609092015.1dlx8kjcsp8kavj@maillist1.mercuryo.io>; unsubscribe token 1dlx8kjcsp8kavj. mercuryo.io publishes three brevo-code TXT records (7c43c15fa98148958a689d35761b19e4, 8b3dccbb13aaf83aca58ee0741ad686c, a2020dce9329368824e4f1aeb3914a53), i.e. the domain is genuinely enrolled for Brevo sender authentication.

Method Header inspection of email.eml; python3 base64 decode of List-Id; dig +short TXT mercuryo.io | grep -i brevo · Observed · § line 04
06CT logs place a second certificate issuance eight minutes before the phishing email reached the victim, giving a sub-24-hour build-and-send timeline

Certspotter returns exactly two issuances for redirect-mercuryo.com: (1) not_before 2026-09-08T23:55:50Z, Google Trust Services CN=WE1, names redirect-mercuryo.com + *.redirect-mercuryo.com (Cloudflare Universal SSL, provisioned at registration); (2) not_before 2026-09-09T21:04:36Z, Let's Encrypt CN=YE2, names redirect-mercuryo.com + www.redirect-mercuryo.com. Timeline relative to WHOIS creation (2026-09-09T00:54:26Z): cert 1 at T-0:58:36, creation T0, email sent T+19:20:48, Let's Encrypt cert at T+20:10:10, delivery to victim T+20:18:03. The second, Let's Encrypt certificate naming www indicates origin-side provisioning distinct from Cloudflare's edge certificate. Control: the same API returns issuance history for mercuryo.io, so the two-record result is not an empty query.

Method curl "https://api.certspotter.com/v1/issuances?domain=redirect-mercuryo.com&include_subdomains=true&expand=dns_names&expand=issuer"; control query for mercuryo.io; date arithmetic in python3 · Observed · § line 06
07The verified signature has no body-length limit and covers the From, Subject and the entire phishing body, so the content cannot have been appended after signing

The DKIM-Signature carries no l= tag, so the whole body is included in the bh= hash — the phishing text and the redirect-mercuryo.com string were present when the message was signed. Signed header list h= includes to:cc:from:reply-to:subject:date:mime-version:content-type:list-id:list-unsubscribe:x-csa-complaints:list-unsubscribe-post:message-id:sender:x-sib-id:x-mailin-client:x-mailin-campaign:feedback-id:bimi-selector. From: Mercuryo <noreply@mercuryo.io>, Subject, Date and Reply-To are all covered, and the Brevo account headers (x-mailin-client, x-mailin-campaign, x-sib-id, feedback-id) are signed too, so the account attribution is itself inside the signature. This rules out header injection or body substitution downstream of Brevo.

Method Regex extraction of DKIM-Signature tags from email.eml; check for absence of l= tag; cross-reference h= list against headers present in the message · Observed · § line 07

high · 5

08The sending IP is a Brevo (Sendinblue) address with reverse DNS customised to Mercuryo, inside Brevo's published SPF range

Sending IP 172.246.43.93. PTR = maillist1.mercuryo.io. A record for maillist1.mercuryo.io = 172.246.43.93 (matches). spf.brevo.com includes ip4:172.246.0.0/18, which contains the sending IP. maillist1.mercuryo.io TXT = "v=spf1 include:spf.brevo.com mx ~all". Netblock 172.246.0.0/18 is RIPE-administered.

Method dig +short -x 172.246.43.93; dig +short A maillist1.mercuryo.io; dig +short TXT maillist1.mercuryo.io; dig +short TXT spf.brevo.com · Observed · § line 08
09The TLS certificate served by the payload domain was provisioned at registration time, confirming the host is under a day old

CN=redirect-mercuryo.com, SAN: redirect-mercuryo.com, *.redirect-mercuryo.com. Issuer: C=US, O=Google Trust Services, CN=WE1 (Cloudflare Universal SSL). notBefore = Sep 8 23:55:50 2026 GMT, notAfter = Dec 8 00:54:27 2026 GMT — the notAfter second-for-second matches the WHOIS creation timestamp plus 90 days. Note: crt.sh was unusable from this host (a control query for mercuryo.io also returned empty), so no CT-log claim is made.

Method echo | openssl s_client -connect redirect-mercuryo.com:443 -servername redirect-mercuryo.com | openssl x509 -noout -subject -issuer -dates -ext subjectAltName · Observed · § line 09
10Cloudflare already serves a "Suspected Phishing" interstitial instead of the payload domain's content

HTTP 403 from server: cloudflare, title "Suspected Phishing | Cloudflare", body: "This website has been reported for potential phishing." Cloudflare Ray ID a38974441fde0e7e, observed 2026-09-09 21:58:24 GMT. The real content sits behind a Turnstile-gated "Ignore & Proceed" form (/cdn-cgi/phish-bypass), which was deliberately not submitted, so the landing page itself was not retrieved. Body sha256 f0477a0e3babb9db45b75f53450e11d5f350d00068405e8bf7212561d1214e72.

Method fetch/capture hxxps://redirect-mercuryo[.]com (GET only, no form submission or bypass token use) · Observed · § line 10
11The email disclaims asking for credentials while directing the user to perform a wallet signature, the mechanism by which approval-drainer theft occurs

Body text: "Mercuryo will never ask for your seed phrase, private keys, or passwords via email. This verification is completed entirely through your wallet's native signing interface." It simultaneously claims the action will "revoke any potentially exposed token permissions and re-establish a secure session" — an inversion, since revoking approvals cannot be performed by a third-party page on the user's behalf without the user signing a transaction that the page composes. Wallets named as "affected": MetaMask, WalletConnect, Coinbase Wallet, Trust Wallet — all self-custody wallets whose sessions Mercuryo, as a fiat on/off-ramp, does not hold or re-verify. Consequence pressure: "Wallets that have not been re-verified will be required to re-authenticate before processing any future transactions." Trust badges appended: "ISO 27001 Certified · PCI DSS Level 1".

Method Verbatim reading of the decoded text/plain and text/html parts of email.eml · Observed · § line 11
12Both payload hostnames resolve only to Cloudflare proxy addresses, hiding the origin server

redirect-mercuryo.com and www.redirect-mercuryo.com both resolve to 104.21.55.194 and 172.67.172.110 (Cloudflare anycast). Authoritative nameservers are val.ns.cloudflare.com and lochlan.ns.cloudflare.com; the sponsoring registrar is also Cloudflare, Inc. The domain publishes no MX, no TXT and no CAA records. Cloudflare is therefore simultaneously registrar, DNS operator and reverse proxy, and holds the only records identifying the origin host and the registrant account.

Method dig +short A/MX/TXT/CAA redirect-mercuryo.com; dig +short A www.redirect-mercuryo.com; dig +short NS redirect-mercuryo.com; whois redirect-mercuryo.com · Observed · § line 12

medium · 3

13The payload domain has no archived history, consistent with a purpose-built single-use domain

Wayback availability API returns "archived_snapshots": {} for redirect-mercuryo.com and the CDX API returns no rows for redirect-mercuryo.com*. Control: the same CDX endpoint returns snapshots for mercuryo.io back to 2019-04-16, so the endpoint is functioning. A web search for the string "redirect-mercuryo.com" also surfaced no existing abuse reports.

Method curl "http://archive.org/wayback/available?url=redirect-mercuryo.com"; curl "http://web.archive.org/cdx/search/cdx?url=redirect-mercuryo.com*"; same CDX query for mercuryo.io as control · Observed · § line 13
14The cited advisory identifier MRC-2024-09 carries a 2024 series number in a message sent in September 2026 and has no public trace

Subject: "Critical Vulnerability Alert: MRC-2024-09 May Affect Previously Authorized Wallet Sessions"; body refers to "a vulnerability in our token approval handler MRC-2024-09". Message Date and DKIM t= both place the send at 2026-09-09. A web search for "MRC-2024-09" together with Mercuryo and "token approval handler" returned no matching advisory from Mercuryo or any CVE/security source. Absence from search is weak evidence on its own; the date/series mismatch is on the face of the message.

Method Subject/body reading; web search for the advisory identifier · Observed · § line 14
info · 2
16Victim interaction is routed entirely through the web link; the reply addresses resolve to Mercuryo's real Microsoft 365 and Brevo infrastructure

Reply-To: no-reply@mercuryo.io — mercuryo.io MX is mercuryo-io.mail.protection.outlook.com (Microsoft 365), and mercuryo.io SPF is "v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com mx -all". List-Unsubscribe mailto goes to unsubscribe@maillist1.mercuryo.io, whose MX is maillist1.mercuryo.io -> 172.246.43.93 (Brevo). No mailbox in the message is under third-party attacker control, so the sole victim-facing channel is the redirect-mercuryo.com landing page reached via the Brevo click-tracker.

Method dig +short MX mercuryo.io; dig +short TXT mercuryo.io; dig +short MX maillist1.mercuryo.io; dig +short A maillist1.mercuryo.io · Observed · § line 16
17The impersonated brand's UK entity is Monetley LTD, an FCA-authorised Electronic Money Institution, reference 900921

Mercuryo's own help centre states: "Monetley LTD (Mercuryo) (Reference Number: 900921, registered company number 10978538) is licences [sic] as an authorised E-Money Institution (EMI) and regulated by the Financial Conduct Authority (FCA)." Mercuryo's legal terms additionally identify MONEYMAPLE TECH LTD (Canada, BC1306168, FINTRAC MSB M21565803) for crypto-asset exchange and custody, and MONEYCHURROS S.L. / Criptan Trade S.L. under Spain's CNMV. The brand is therefore a real, regulated financial services provider, and this campaign was sent from its own authenticated domain.

Method curl https://mercuryo.io/legal/terms/ and text extraction; web search of the FCA register for Monetley LTD / FRN 900921 · Observed · source (check 17) · § line 17

Notified 4 parties

Who was told, and whether they answered. The letters themselves stay in the file; each party decides for itself what to do.

other partyCertified Senders Alliance (eco e.V.) — complaint address designated in the message itself — informed by letter ; awaiting reply
mailbox providerApple iCloud Mail — abuse desk (receiving mailbox provider) — informed by letter ; acknowledged; reference issued
impersonated partyMercuryo / Monetley LTD — customer support and security — informed by letter ; replied; reports action taken
regulatorFinancial Conduct Authority (UK) — supervisor of the impersonated firm — informed by letter ; awaiting reply

Assessment

Withheld. The verdict stays in the file. Each line above is one check — what was tested, how, and when.

Surveillance log · live · watched since 2026-09-09
2026-09-18 17:17Zlive — HTTP 200
2026-09-18 16:17Zoffline — no answer (timed out)
2026-09-16 16:17Zlive — HTTP 200
2026-09-16 15:17Zoffline — no answer (timed out)
2026-09-14 13:17Zlive — HTTP 200
2026-09-14 12:17Zoffline — no answer (timed out)
2026-09-10 15:17Zlive — HTTP 200
2026-09-10 14:17Zoffline — no answer (timed out)
2026-09-10 12:17Zdns pulled — no A/MX records; domain still registered
2026-09-09 23:17Zcdn flagged — HTTP 403 (provider interstitial)
2026-09-09 22:17Zlive — HTTP 200
Fraud Register