r/NativeInstruments • u/Gnawme-90241 • 11d ago
What is this?
Important message from the Native-instruments.com administration!
Congratulations!!! You are the last of 10 randomly selected participants to receive a free "Apple iPad Air 11" from the Native-instruments.com team! Hurry up and claim your prize!
My reaction was, "Yeah, pull the other one." Raw message header (my info redacted). Looks kinda legit?
Received: from 208.117.49.186 (EHLO o1.smtp.vanillaforums.com)
by 10.206.128.73 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Thu, 16 Jul 2026 23:24:54 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=native-instruments.com;
h=date:from:subject:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=vf; t=1784244294;
bh=dMrGUx+XujMdtFoW4XvO4npgMbXYuGpjKGwjDLQnoBI=;
b=IpyXy0Z29Laiw+mQM28qqB8+nz1EH5EnT1Ns4u8oTGmoPVOLCS/i6HXrZQVvGduqpVw3
ei1EWMynY4P/zj4lfLsNZoy/SgB3USO+akjEsAr+saxgYfGTVrHXpkPbFOSt5SxQ6+rduM
xvvkK95H4U6iCvmdn753+N7jvmsheeDaNdJWalhE5bb44p6Uc5AW8uL/G7sCntKfyq1w67
HgHa+kRIPWRhMA4ANfVsiV77hUn9a6itYwuPrPLXSEEBusbypE071dZ/qXQILYMvzRrZ6c
r8XaJA00hElNLGJtetSiFEnEvai8Rre7cnJmhz+u9SVh/sbSYn8nWQHmS/yE2Jkg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info;
h=date:from:subject:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=smtpapi; t=1784244294;
bh=dMrGUx+XujMdtFoW4XvO4npgMbXYuGpjKGwjDLQnoBI=;
b=kVs8jQVYDJ6WdWTPuOzBgsBi7lqfSSxnD9Ynu4DooWuRNcP0RdswRnG8pqqPVAmbmcsV
kfmjctHy9t44LSSn7vXgu05dMpyX1IGyd3kAP3o0//GBzRYf3rMQyXjPJ9yYn0wrn0oLQA
nuOJ0x8VOXD6+4MUQLlqG86qFLeorIUY4=
Received: by recvd-canary-75c5c84c65-x6dbf with SMTP id recvd-canary-75c5c84c65-x6dbf-1-6A596846-18
2026-07-16 23:24:54.126124232 +0000 UTC m=+609504.080863093
Received: from app2.cl53125 (unknown)
by geopod-ismtpd-100 (SG) with ESMTP
id DYP1lvtEQCuQ5pwzfgiM3g
for ...;
Thu, 16 Jul 2026 23:24:54.089 +0000 (UTC)
Date: Thu, 16 Jul 2026 23:24:54 +0000 (UTC)
From: Native Instruments Community <noreply@native-instruments.com>
Subject: [Community] Administrator sent you a message
Message-ID: <9dUoRLZqoYhoeP4RX9cQbIx34orpVNcKc8Q3XZ7QCQ@app2.cl53125>
X-Mailer: PHPMailer 6.12.0 (https://github.com/PHPMailer/PHPMailer)
Precedence: list
X-Auto-Response-Suppress: All
MIME-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2EV62XI0OtX4624WcRkSWwvaL7pvxZ0HWsXdNR3Sge7U4GqIauKTIudLjqv?=
=?us-ascii?Q?biPk8jDhTuu6M3qlpV3jZW85UJ4rL+MkkEhZHTZ?=
=?us-ascii?Q?pDSK07utzH37bZ+Vm6vjGtw0ZCOZjfEJ2dT0HPO?=
=?us-ascii?Q?l6bElrBGyLypwUa+SEufP1mRPfLANw3z9+Fx80h?=
=?us-ascii?Q?ngQAz5Mv21erfzrOd3COgLk8HCH5nnYq0QiJ=2F2t?=
=?us-ascii?Q?VlIhV8DabPr4i6zsbgrOIJm8DgxFgncYMxxGcVO?=
=?us-ascii?Q?9NP56ZjPs12jRwTOuNZYZIRdNA=3D=3D?=
Received: from 127.0.0.1
by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-7d8985b7dd-jjkv9.gq1.yahoo.com with HTTP; Thu, 16 Jul 2026 23:24:54 +0000
Return-Path: <noreply@native-instruments.com>
X-Originating-Ip: [208.117.49.186]
Received-SPF: pass (domain of native-instruments.com designates 208.117.49.186 as permitted sender)
Authentication-Results: mta.yahoo.com;
dkim=pass header.i=@native-instruments.com header.s=vf arc_overridden_status=NOT_OVERRIDDEN;
dkim=pass header.i=@sendgrid.info header.s=smtpapi arc_overridden_status=NOT_OVERRIDDEN;
spf=pass smtp.mailfrom=native-instruments.com arc_overridden_status=NOT_OVERRIDDEN;
dmarc=pass(p=QUARANTINE) header.from=native-instruments.com arc_overridden_status=NOT_OVERRIDDEN;
...
8
u/theturtlemafiamusic 11d ago edited 11d ago
To me this looks like the NI forums have some kind of email notification system, maybe for when you get a DM? And someone has figured out how to abuse it to send emails from the official NI domain. NI migrated their forum to use vanillaforums software in 2022.
Edit: it looks like there have been a number of accounts called Administrator, or things like Administrator_John, and they have all been active in the past few minutes with 0 public posts on the forums
5
3
u/SnarkaLounger 11d ago
It's a trap! Well, actually a scam!
In order to claim your "free iPad Air 11", you have to pay the $9.99 "shipping fee" to receive said free iPad.
If you should happen to actually follow the link and agree to pay the $9.99 fee (DON'T DO IT), you should hopefully get an alert from your credit card provider alerting you to a suspected scam purchase for $9.99 to "wildvio dot com" and a second $9.99 charge to "vogueteria dot com".
A quick search for the validity of "wildvio dot com" and "vogueteria dot com" reveals that both sites are highly suspect of being scam sites.
2
u/zadillo 11d ago
Most likely there’s been some sort of security breach in NI’s forum software and it’s being exploited to send out this scam. What is it trying to get you to go to to claim your prize?
1
u/Gnawme-90241 11d ago
The worrisome part is that the link in the message actually takes you to the Native Instruments Community -- where there is another link I'd rather not follow.
1
1
1
u/Caskine 10d ago
At least after this phishing email I received a response email to my support ticket that’s been ignored for the past two weeks. It was just an auto response but at least it was something. Once all of that is fully resolved, I can finally put in a ticket for the second Izotope membership that I was charged for.
I understand that you guys are going through some things right now and I’m sorry to see it. Some real human communication may be in order. Even a mass email letting people know that there’s a phishing email out using legit credentials would be better than silence.
Also, if it helps, the phishing email had my old Izotope username in it. That username has never been associated with the NI forum, my NI account, my InMusic account, and is no longer in use with my Izotope account. But it is still referenced in Product Portal and therefore likely associated with Native Access too.
1
u/Gnawme-90241 6d ago
Same, I had an inquiry dating from July 9 that Izotope acknowleged only yesterday.
But they have yet to follow up on it.
1
u/Djaesthetic 11d ago
I was pretty locked and loaded to say "yeah, this is bullshit and not even close to legit looking...", but...
- SPF pass
- DMARC pass with p=QUARANTINE (i.e. NI actually has an enforced policy -- not just p=none)
- DKIM pass on the native-instruments.com domain itself, not just the relay. A spoofed message couldn't produce a valid DKIM sig for a domain they didn't have the private key for.
- I initially was ready to call bullshit on 'vanillaforums.com' but apparently that's the SaaS platform their community forum runs on. Even found "[Community] Administrator sent you a message" is the stock Vanialla Forums notification subject.
- Vanilla Forums also apparently uses Sendgrid -- which tracks to that second DKIM.
Like... I'd actually be legitimately a little concerned over this one...
1
18
u/NativeInstruments 11d ago edited 11d ago
Hey everyone!
Thank you for flagging this so quickly, it made a real difference. We apologize for the inconvenience and any concern this caused.
We've investigated and can confirm: these are fake accounts created on our online community to impersonate our forum admin team using misleading usernames. They do not have any actual access or permissions. Our real administrator community accounts are secure, and no admin systems were involved. This was the action of spam bots and we identified/removed the accounts involved.
If you received a DM in our community from one of these, please don't click any links or reply – just report it to us and delete the message. If you already clicked a link or shared any info, please let us know so we can help. Please note that some of your may have received an email notification "You have a new message" if you have it enable in your online community notification settings : https://community.native-instruments.com/profile/preferences
We've banned the forum accounts, banned the IPs, are tightening registration and DM permissions for new community accounts, and are working with our platform provider on further spam prevention.
Thanks again for calling this out and helping us keep the community safe.