Lucas Calder

[Paul Chi Hoang]

Hello,

My office has received an email from a LucasCalder@Trello.com claiming that our company website has images violating the copyright protected images owned by Trello. Our company's website was built by a 3rd party using all stock photos or photos purchased by them. He included a link for us to access to view the images claimed to be a violation. I'm not downloading or clicking on any link since our system flagged the email as possible phishing email. Can anyone from Trello confirm 1) a Lucas Calder works at Trello as Legal Officer, and 2) the email sent to us is legit. I've forwarded the email to our website developer and management agency for review as well. 

Thank you

Paul

[Andy Heinzer]

Hi @Paul Chi Hoang 

To the best of my knowledge, no one by that name is employed by Atlassian or Trello.  I would ask that you forward the message you received to our abuse@atlassian.com address.  If you do so, please understand that you won't receive any reply, but this is at least one way to help our abuse team to become better aware of suspicious and/or malicious emails that appear to be sent on behalf of Atlassian.

As @Nic Brough -Adaptavist- stated, it might be best to reach out in https://support.atlassian.com/contact to create a support case here.  This is a different channel you can use to engage with us and possibly share more information about the message you received.

Andy

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

This sounds like a malicious attack or scam to me.  There's a whole load of warning points in here

• Look at the URL they've given you.  Do not visit it, but just look at the domain name in the URL.  If it is not atlassian.com (note, not atlassian.net - they're customer sites, an Atlassian would not use an atlassian.net site to do this sort of thing) or trello.com based, then there's a >99% chance this is an attack. 
• Do they tell you how to log in and give you the credentials to do so?  No one complaining about copyright or IPL would make more copies publically available, they would be directly pointing to the content on your site that may be contested.
• Check the email headers.  The "from" field is easy to change to pretend to be someone else.  Who actually sent it?

Based on those flags, the official route would be to "raise it with https://support.atlassian.com/contact", but ...

• Raising it here is a good thing, as it publicises it to the Community who may also get attacked (if it is an attack)
• We should be able to get an Atlassian to comment here, publically, to tell everyone if it is dodgy or not
• I've asked Atlassians to take a quick look (even if it's as simple as "that name is not in our internal directory", it can be quicker than a support request)

You might also want to forward the email to abuse@atlassian.com - for this case, they would need a bit more detail than usual.  As this is a public forum, I'd just give the link to this question; it's got all the info they need in it.

(Finally, yes, I removed your email address.  Atlassian can see it from your post, so they don't need it, and public fora regularly get scraped for email addresses to be added to spam lists)