We noticed a login to your Acme account from a new location. #4452

camemb3rt · 2025-03-26T01:30:30Z

I just received an odd e-mail from my server claiming that "We noticed a login to your Acme account from a new location."
I've never received such a notification before and I'm not quite sure what this could mean.
My best guess is that this was caused by NGINX Proxy Manager.
Despite it being in a docker container, the support at OMV claimed it's possible NPM used postfix to notify me throu an e-mail.
Here's the header of the e-mail

Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Content-Type: text/html; charset=UTF-8
From: "Support" <[email protected]>
Subject: [brie] Login from a new location
To: [email protected]
Message-Id: <[email protected]>
Date: Mon, 24 Mar 2025 21:33:02 -0300 (-03)


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta name="viewport" content="width=device-width,initial-scale=1" />
    <style>
        body, html {
            padding: 0;
            margin: 0;
            border: 0;
            color: #16161a;
            background: #fff;
            font-size: 14px;
            line-height: 20px;
            font-weight: normal;
            font-family: Source Sans Pro, sans-serif, emoji;
        }
        body {
            padding: 20px 30px;
        }
        strong {
            font-weight: bold;
        }
        em, i {
            font-style: italic;
        }
        p {
            display: block;
            margin: 10px 0;
            font-family: inherit;
        }
        small {
            font-size: 12px;
            line-height: 16px;
        }
        hr {
            display: block;
            height: 1px;
            border: 0;
            width: 100%;
            background: #e1e6ea;
            margin: 10px 0;
        }
        a {
            color: inherit;
        }
        .hidden {
            display: none !important;
        }
        .btn {
            display: inline-block;
            vertical-align: top;
            border: 0;
            cursor: pointer;
            color: #fff !important;
            background: #16161a !important;
            text-decoration: none !important;
            line-height: 40px;
            width: auto;
            min-width: 150px;
            text-align: center;
            padding: 0 20px;
            margin: 5px 0;
            font-family: Source Sans Pro, sans-serif, emoji;;
            font-size: 14px;
            font-weight: bold;
            border-radius: 6px;
            box-sizing: border-box;
        }
    </style>
</head>
<body>
    <p>Hello,</p>
<p>We noticed a login to your Acme account from a new location.</p>
<p>If this was you, you may disregard this email.</p>
<p><strong>If this wasn't you, you should immediately change your Acme account password to revoke access from all other locations.</strong></p>
<p>
  Thanks,<br/>
  Acme team
</p>
</body>
</html>

And the e-mail itself:

Here's what I assume happened:

NPM generates a certificate through my domain provider's API (porkbun in this case) and on porkbun's UI there's another place where you can generate certificates;
My NPM uses one of them and the other was created automatically when I registered a redirect record (URL forwarding) in the afternoon;
Seeing that both the API and the manual way are generating certificates on my porkbun account, it's using the same email and NGINX consideres that "logins from different locations"
The second one seems to have taken quite a while to propagate so that's why me getting this message in the middle of the night worried me;

Anyways, if that's really what it is, I still find it surprising that searching for the exact string "We noticed a login to your Acme account from a new location." gives me nothing. Feels like I'm the only person that's ever gotten this e-mail.
If possible, I want to know if it this is part of NPM's behaviour and if my assumptions are correct, and, if not, what should I be doing to remedy it.
Thanks

The text was updated successfully, but these errors were encountered:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

We noticed a login to your Acme account from a new location. #4452

We noticed a login to your Acme account from a new location. #4452

camemb3rt commented Mar 26, 2025 •

edited

Loading

We noticed a login to your Acme account from a new location. #4452

We noticed a login to your Acme account from a new location. #4452

Comments

camemb3rt commented Mar 26, 2025 • edited Loading

camemb3rt commented Mar 26, 2025 •

edited

Loading