Alternative 'bug-bounty' email scam originating from a random email address associated with the University of Science and Technology of China (USTC) - *@mail.ustc.edu.cn. Message is worded to create alarm and a sense of urgency, hijacking security concerns over potential SSL certificate authority and/or misconfigurations. Message includes a *.txt attachment titled "misconfiguration_details.txt".
Hi Admin,
Our research team at USTC recently conducted a large-scale scan of certificate configurations in July 2025. During our analysis, We identified a potential misconfiguration for a service associated with your domain. This issue could compromise the security and trustworthiness of your services and (or) your customers.
The attached file contains the details of all misconfigured services we found. We recommend you review and resolve these issues as soon as possible.
**Next Steps**
The fields in the attachment provide the technical information needed to diagnose the problem. We recommend the following actions:
1. **Review the details:** Use the information provided in the attachment to locate the affected service.
2. **Investigate the cause:** Address the root cause of the misconfiguration of certificates (e.g., manual errors, load balancer settings).
3. **Correct the configuration:** Update the service to ensure the certificate is always trusted and correctly matched for the domain. Links to EFF to create sense of authority.
---
**Suggestions for Prevention**
Based on our findings, we would like to offer two suggestions to help you prevent similar issues in the future:
* **Adopt an ACME Automated Tool:** Consider using an automated tool like Certbot [1]. These tools can automatically manage the entire certificate lifecycle - issuance, renewal, and deployment - reducing the chance of human error.
* **Reconsider Certificate Deployment Strategy:** The 'Hostname Matched' error suggests a potential hostname mismatch. We recommend reviewing your certificate deployment strategy to ensure the certificate being served is configured for the correct domain and any subdomains it is intended to secure.
If you have any questions or require further assistance, please contact us. If this issue has already been resolved, please disregard this email. We apologize for any inconvenience.
Thank you for your attention to this matter.
Best regards,
Email Security Group.
[1] https :// certbot.eff. org
