Warning: Fake “SEO-DAY delegate pass” emails – how to spot the spam wave

On 7 October 2026 – and, in a tight window around that date, also on 8 October – many companies were hit by a professional-looking spam wave: emails with subject lines such as “[First name Last name], your SEO-DAY delegate pass is here.” SEO-DAY did not send these emails. We are publishing this warning so the technical pattern is clear, and so you can protect yourself and your teams.

In short: Do not click the links in these emails. They exist to verify addresses so those addresses can be sold to data buyers or used for more spam. The 7 October wave used a “delegate pass”; the 12 October wave uses an alleged free “guest ticket”.

Update of 12 October 2026: fake “guest ticket”, sender line presents itself as no-reply@meetmaps.com

A few days after the delegate-pass wave, another email turned up that again pretends to come from SEO-DAY. Timestamp: 12 October 2026, 11:39 CEST. Subject: “Ihre Gastkarte für den SEO-Day Germany 2026” (“Your guest ticket for SEO-Day Germany 2026”). What stays visible is only how the mail presents itself: display name SEO-DAY, address no-reply@meetmaps.com. That is not a seo-day.de domain. After speaking with them, we can say this definitively: meetmaps.com has nothing to do with this mail. The From line only shows who the spam claims to be. It can be forged or set through someone else’s account. Contact details of recipients and their companies are redacted and are not named here. The HTML shows the “SEO-DAY Cologne” wordmark with a graduation cap, which is why the mail looks official at first glance.

The text claims that the participant list for “SEO-Day Germany 2026” is being compiled and that an invitation follows from the recipient’s professional background. The stated focus is “Search in the age of AI”. A free guest ticket is supposedly reserved: full access including keynotes, interactive workshops, and a networking dinner with search-marketing experts. A link labelled “Registrieren” (“Register”) is said to lead to the agenda and further information. The number of participants is described as deliberately limited. The mail is signed “Das SEO-Day Germany Team”.

Warning sign in the footer: Under the German text, a Spanish line reads: “Has recibido este correo porque formas parte de Prueba mailjet” – in plain language, the mail went out because the address belongs to a Mailjet test list named “Prueba mailjet”. Below that: a note to contact the organisation with questions, plus “© 2026 Meetmaps” and “powered by meetmaps”. An official SEO-DAY email does not carry this footer. After direct contact, meetmaps.com has nothing to do with this wave. The footer remains part of how the mail presents itself.

SEO-DAY did not send this message either. Personal data, recipient addresses, and company names from the forward stay unpublished; in the image only the sender line is readable. The basic pattern matches 7 October: the event brand is the bait, and the footer does not match the brand. What is new is the lure (“guest ticket” instead of “delegate pass”) and a sender line that this time presents itself as no-reply@meetmaps.com. We deliberately did not open the “Registrieren” link.

After the contact, we are now looking into the origin of this spam attack together with Meetmaps. The chance of finding the source is low. For now, waiting is all that remains.

Do not click the links in these emails. They only verify email addresses. Verified addresses can be sold to data buyers or used to send more spam.

Update of 12 October 2026, 16:31: Luma blocked it immediately

On 12 October 2026 at 16:31, Luma (lu.ma) replied to our report of a fake SEO-DAY event. The response was fast and exemplary.

Luma says: the account behind the listing had already been blocked before our report, and the event page is no longer reachable. Luma also disabled the join link from those emails. It no longer forwards anyone. The invitations themselves were not sent through Luma. The examples we forwarded came through a different email service and only included a Luma link. Luma cannot stop those emails. Anyone who clicks the link now sees a warning page instead.

Luma does not check events with the brand owners before they are published. Further Luma links that use the SEO-DAY name can be added to the same thread.

What happened technically on 7 October

Reconstructed mailbox data from affected companies shows a clear picture: in two very short waves – each within about 25 seconds – hundreds of personalized emails went out. In one documented case with a catch-all domain, that was 250 individual emails (about 107 around 11:40 and 143 around 12:03 CEST). Each email went to exactly one address.

The address construction stands out: the large majority followed the pattern firstname.lastname@company-domain. Umlauts were typically transliterated (ä→ae, ö→oe, ü→ue, ß→ss), and hyphens in double names were kept. A few outliers looked like shortened profile names – a sign that lists were scraped from business networks and then combined with domains by a pattern generator, without first checking whether the address actually exists.

That is also why these waves land in catch-all mailboxes: the domain “swallows” invented addresses. For attackers, every click or bounce/open metric is still valuable.

Why nobody should click the links

The lure is classic: a personal greeting, a reference to your “professional background”, a checklist promising “free entry”, artificial scarcity (“first come, first served”), and a large confirmation button.

We deliberately did not test what sits behind those links – and that is our recommendation to you as well. Even a click on tracking links (here via typical ESP redirect domains) can signal: “This address is active and the mail is being read.” That is exactly what address brokers and follow-up campaigns need. In the worse case, the link leads to credential harvesting, malware, or further social-engineering steps.

In other words: the conference brand is the bait. The actual product of the campaign is often the validated email address.

What the sender infrastructure looked like

Technically, the sending looked “clean” – and that is exactly what makes this kind of attack dangerous:

• Sent through a real ESP account (here: dotdigital), including SPF/DKIM/DMARC that passed for the ESP domain
• A display name in the style of “SEO-DAY”, even though the technical sender belonged to the ESP infrastructure
• A footer pointing to brightonSEO / Friday Media Group (including the typo “birghtonSEO”) – a different conference brand in the sender footer
• Links via ESP tracking domains (for example typical redirect hosts such as ddlnk.net)

The pattern is this: attackers abuse or compromise accounts at legitimate marketing providers and use well-known event brands as bait. For recipients, the mail therefore looks more “official” than classic spam from a free domain.

Not a one-off: OMR, Adobe Summit, and other event lures

The same address list, or the same playbook, had already appeared earlier. On 13 July 2026, waves went out with subject lines such as “Exclusive Invitation to OMR Festival” and “Your Invitation Awaits: Adobe Summit” – again with a personal greeting, a checklist, scarcity, and an “Accept Invitation” button. That time via a different ESP (SendGrid) and tracking through event-marketing domains.

Large conferences and brands such as Online Marketing Rockstars (OMR) and BrightonSEO have also been victims, or the named bait, of exactly this kind of spam and validation attack. It is rarely about the conference itself. It is about the trust attached to well-known event names.

So if you receive an “exclusive invitation” to a well-known marketing conference that you were not expecting: pause, check the sender, and only hover the links – do not click.

How to recognize these fake emails

1. Display name ≠ technical sender domain. “SEO-DAY” in the From name is not enough. Look at the actual sender address and the Reply-To domain. On 7 October the visible sender line belonged to ESP infrastructure; on 12 October it reads no-reply@meetmaps.com. That shows how the spam presents itself. After direct contact, meetmaps.com has nothing to do with it.
2. The footer does not match the brand. An SEO-DAY subject line with a brightonSEO / UK-company footer is a warning sign. So is a German guest-ticket text with a Spanish note about a Mailjet test list (“Prueba mailjet”) and the line “powered by meetmaps”.
3. Hover before you click. Move the pointer over the button (on a phone: long-press / link preview). If the status bar shows a tracking domain instead of an official SEO-DAY URL, treat it with caution.
4. Scarcity plus a free ticket. “Only a limited number of free tickets”, an unsolicited “reserved guest ticket”, or an instant button is a classic – especially if nobody requested a ticket.
5. Mass invented addresses. IT teams with catch-all often see dozens of firstname.lastname@ variants that belong to nobody in the company.
6. Typos and stylistic breaks in the footer or in mixed English/German text blocks.

What you should do now

• Do not click, and do not “unsubscribe” via the spam footer if you believe the mail is fake – unsubscribe links can be tracking too.
• Report it as phishing/spam in your mail client (Outlook, Gmail, Apple Mail) and forward it internally to IT.
• Warn colleagues – sales, marketing, and assistants in particular receive this kind of event lure often.
• Use official channels: tickets and pass information for SEO-DAY come through our known channels and domains under seo-day.de – not through unexpected “delegate pass” or “guest ticket” buttons, and not through senders that only pretend to be SEO-DAY.
• If it is your own domain: question catch-all on purpose; keep SPF/DKIM/DMARC strict for your own brand so third parties have a harder time abusing your name.

Where you can check and report spam

Useful places to start (a selection, not a complete list):

• BSI – information on phishing and the reporting guidance for members of the public
• Central Cybercrime Office / police – if you suspect actual fraud
• Google Safe Browsing / transparency reports on dangerous URLs
• urlscan.io – analyse a URL before you click it yourself
• VirusTotal – multi-engine check for suspicious links and files
• Microsoft – report an unsafe website
• The ESP abuse contact (for example the abuse address of the email provider that was used) and – if named in the footer – the supposed sender company, so compromised accounts can be shut down

Important: pass suspicious links on ideally only through “safe analysis” services, or as the forwarded original mail to IT – not as your own test click in a production browser.

Conclusion

The fake “delegate pass” emails of 7 October 2026 and the fake “guest ticket” of 12 October 2026 are part of a broader attack pattern: well-known marketing events as bait, sender lines that present themselves as other platforms, and a goal that is often the validation of scraped B2B addresses. SEO-DAY expressly distances itself from these messages. A sender line such as no-reply@meetmaps.com with a Spanish Mailjet test footer is not an official channel. It shows how the spam presents itself. After direct contact, meetmaps.com has nothing to do with it. On 12 October 2026 at 16:31, Luma blocked the affected account and switched off the join link. Together with Meetmaps we are checking where the attack came from. The chance of a result is low, so for now we can only wait. Do not click the links in the emails: they verify addresses for sale to data buyers and for more spam.

If you received such an email: ignore it, report it, forward it to IT – and leave the button alone. When in doubt, trust the hover text in the status bar more than the polished conference layout in the HTML.

Have you seen further waves that use the SEO-DAY name? You can write to us through the known contact paths on seo-day.de/contact – ideally with a header excerpt and personal details redacted.