The strangest thing about the attached PDF is that it seems to have the footer from Reddit’s Zendesk system attached. I don’t really understand how or why the attacker would have either edited a Zendesk page, or submitted a ticket, then exported the PDF, and then sent it to the hosting provider. Further, how did the hosting provider evaluate this notice and why did they determine that it was legitimate? It seems to commingle vague legal threats and the Reddit Terms of Service, when the trademark violations enough would normally warrant some action.

What compliance or security team evaluated this? There isn’t even a physical address for legal correspondence, or any letterhead from a law firm? It doesn’t even include boilerplate invoking DMCA! It just references 15 USC section 1063, which is trademark law!

I could see a provider reacting to a fake notice that’s seemingly real, but forged. But the fact that they reacted without any mention of DMCA and vague perceived references to ToS makes me think the provider dropped the ball badly here. I don’t see why they would have taken action or forwarded it.

Edit: I guess I could see forwarding akin to “we got this thing that doesn’t seem legit?” but that’s about it. If they wanted to invoke the ICANN domain trademark conflict process, they would have sent it to the registrar or another governing body. The whole thing is just really odd.