[derefr]

I have pretty good reason to believe that scammers are using purchased Hetzner credentials — which is that some scammers are just right out there in the open, talking about how they do what they do: https://teletype.in/@slivmens/LjPaei8pMTT

Translated quote:

> To do this, we go here: [link to carding forum] and create a topic in the section "verified Hetzner accounts."

> Offer price — no more than 400 rubles is needed. The priority is people from Ukraine, as they have benefits. GEO of the person who verifies the account - any, excluding Russia due to sanctions.

> Another important detail: the seller must register a fresh GMail account, use that account to create an account on Hetzner, and verify it themselves.

> After verification, we wait 3 days before the creation of the new server — otherwise the likelihood of the account being blocked for abuse increases.

> After purchasing the account credentials, we change the password, both on the Gmail account, and on the Hetzner account.