# \[Resolved\] Phishing campaign targetting SourceHut users

- Provider: [SourceHut](https://down.guide/sourcehut)
- Level: confirmed
- Impact: Degraded
- lasted 0m
- started 2026-04-27 05:00 UTC
- us
- id: DWN-e836781ece
- Official page: https://status.sr.ht/issues/2026-04-27-phishing-campaign/

## Updates from SourceHut
### 2026-04-27 05:00 UTC: resolved
A phishing campaign is targetting SourceHut users, impersonating SourceHut
founder Drew DeVault and stating that SourceHut plans to be shut down following
the DDoS attacks which have been affecting service recently.
 These emails are not authentic. Emails sent by SourceHut are sent from addresses
at sr.ht or a subdomain of sr.ht, and signed with our public key . Drew
DeVault uses drew@ddevault.org and signs his emails with his own key .
Occasionally we will use @sourcehut.org as well. The best way to assess the
authenticity of an email from us is by verifying our PGP signatures.
 We have no plans of shutting down, and we are not soliciting Bitcoin donations.
We have contacted the mail provider responsible for these emails and they have
suspended the sender’s account.
 Some users are concerned that their personal information has been leaked. We are
not aware of any large-scale leak of user data on SourceHut. However, we remind
users that, while we take some measures to prevent large-scale scraping and
collection of SourceHut user email addresses, your email address can be exposed
to the public in the course of your work, for example in your git logs or in the
archives of mailing lists.
 (05:00 UTC — Apr 27)

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).