Fake quote requests via business contact forms from prodmail.online lead to document-sharing phishing pages
Since the evening of 28 October 2026 small businesses have received fake quote requests via contact forms from prodmail.online, with links to document-sharing phishing pages, according to Signal-Arnaques.
- First reported
- Reports
- 1
Source: info.signal-arnaques.com · published
What happened
French scam-reporting site Signal-Arnaques reported in its live feed on 29 October 2026 (11h07) that since the previous evening small-business websites have been receiving quote requests through their contact forms, signed with the name "Nicolas Hocquet" (a sender name used in the messages, which may be invented or borrowed; no real person of that name is implicated) and reusing the recipient's company name and line of business. The sending address changes from message to message on the domain prodmail.online (e.g. nicolas.hocquet7308@, nicolas.hocquet9140@, nicolas.hocquet4207@prodmail.online), and the link leads to a document-sharing space presented in the recipient company's name on monpartage.online or mondocs.my.id. Several recipients said they clicked, including one business owner asking what to do after opening a file. Signal-Arnaques says its report page for this sender collected about thirty testimonies within a few hours. The message reuses the business's own name and line of work, so it looks tailor-made.
How the scam works
The scheme uses a contact form as the delivery route. Small businesses publish a form so customers can ask for quotes, and many staff open such requests without suspicion. The fake request is short and ordinary, asks for a quote, and points to a shared "document space" where the supposed specification is kept. That space is branded with the recipient company's own name, which makes it look like a legitimate file-sharing page, but it sits on throwaway domains (monpartage.online and mondocs.my.id). Signal-Arnaques does not say in its live-feed entry what the pages do once opened. Pages like this are typically used to harvest email or Microsoft/Google logins or to push a download, so anyone who opened a file or typed credentials should assume the worst.
Using a different sender address in each message, all on prodmail.online, is a way to get past block lists. This entry is based on a single French scam-reporting site's live feed and the testimonies it links to; the site says its report page collected about thirty testimonies within a few hours, but we have not seen the pages ourselves.
Source
Signal-Arnaques, live scam-news feed, entry of 29 October 2026 (11h07), and the testimonies it links to.
Red flags
- A quote request through your website contact form signed "Nicolas Hocquet" that copies your company name and trade.
- Sender addresses on prodmail.online that change from one message to the next (for example nicolas.hocquet7308@, nicolas.hocquet9140@, nicolas.hocquet4207@).
- A link to a "document sharing space" on monpartage.online or mondocs.my.id, not a service you know.
- A request for a quote with no phone number, project detail or company information.
- A file-sharing page branded in your own company name that you never set up.
If you were targeted
- 1Do not open links or files from unexpected contact-form requests; check the sender's domain first.
- 2If you clicked, disconnect the device, run a security scan and change passwords for email and cloud accounts from a clean device.
- 3Warn colleagues and block prodmail.online, monpartage.online and mondocs.my.id on your mail filter and firewall.
- 4Report the message to your IT provider and on signal-arnaques.com or the national platform Cybermalveillance.gouv.fr.
- 5If you typed a password on the page, change it everywhere you reuse it and turn on two-step verification.