The Renewal Notice for a Domain That Could Not Be Renewed

A late-August 2026 phishing campaign sent a fake Squarespace domain-renewal invoice to a global digital advertising agency, leveraging a personalized legacy domain to increase plausibility and a Google shortlink that redirected to a Cloudflare-fronted malicious host; the message authenticated (SPF/DKIM/DMARC) for the attacker-controlled sending domain and used an Exim-managed VPS, with indicators including the attacker domain hotellarue.com, the shortlink, resolved malicious URL, and sending IP 78.128.60.31, and the apparent objective is credential theft.