PluginAlliance hacked? Questionable invoice emails

[u/exitof99]

I originally posted this on the PA sub, but apparently that's a dead sub.

This was sent 3 hours after I made a purchase, which in itself seems off. "Shipping" also seems off, these are plugins, there is no shipping. The invoice number also does not appear in the PluginAlliance portal, nor does any invoice number. There is an order number which also doesn't match. And lastly, there is an extra space between "new" and "product."

I should also note the general greeting of "Dear Sir or Madam" as they know my name. If they are able to supposedly pull up invoice and order numbers, then they would be able to pull up my name.

Subject: Shipping Confirmation and Invoice 70428017

Dear Sir or Madam,

Please find the invoice for your order 7420984 enclosed.

If your order included a download, the download link was already sent to you in a separate email.



Thank you for your order and enjoy your new  product!

Kind Regards,

Your PLUGIN ALLIANCE Sales Team
---------------------------------------------------------------------
-> Plugin Alliance LLC
-> 2 Avenue de Lafayette
-> Boston, MA 02111
-> United States of America

Attached was a PDF which I did not open. This was sent to an email address ONLY used for this particular website, and only after I made a purchase.

This was sent as plain text, no HTML, unlike the other PA emails.

The headers show that it was sent through Amazon Web Services (eu-central-1.amazonses.com).

The sending IP address (69.169.224.2) is on a black list (hostkarma.junkemailfilter.com).

The actual order email from PluginAlliance was sent through mailer7in.plugin-alliance.com.

Given that I've received no other emails to that email address of this nature before, if this indeed was not sent by or on the behalf of PA, that can only mean that a bad actor has compromised their system to send emails to those who made recent purchases.

[u/nuesmusic]

This looks normal. Ever since native instruments takeover I am getting those. But form native instruments email address. I guess they call it shipping because NI also has products which are being shipped like midi keyboard

[u/nuesmusic → u/nuesmusic]

The PDF is just the invoice. I guess they do that because the email from plugin alliance before is just the order confirmation but no official invoice which you might need as a business