> Your concerns are valued! Let me check this for you.

Let's see what comes next.
My guess: nothing.

They now tried to blame the registrar for the domain. (Which also didn't respond to my abuse-email so far)

I went on and told them that knowingly hosting scammers is illegal and asked again to take down whatever service it is they run on the IP.

At least it's not a bot I'm talking to.

Just some overworked support worker with below average reading comprehension.

They confirmed the domain is on an account with them, but seem confused about what I want.

It would be crazy to play owner of it and shut it down, but I'm not that bold.

since they didn't really do anything based on my abuse report yesterday, maybe the live chat does something.

FFS, it's the same company that hosts the nameserver they use.

Trying to log into any of the available services is legally considered hacking, so I won't do that because the IP is a shared host with a bunch of other legit stuff on it.

Based on a random reverse-dns site I found it's more than 500 domains (because that's the limit of their free plan)

I fond out who hosts the VM the destination site runs on.

They changed the cert to use Let's Encrypt for Apache, but not for Pure-FTP or Dovecot.

Those still use a default cert from the provider.

Let's send them that info and see what happens.

I'm not naming any names while I play around with it.

When I'm done or the thing is offline I will.

They're using a PhisKit to do the heavy lifting.
The email-address of the author is still in there and I found a Portuguese security website talking about similar scams targeting other banks.

They won't let me open debug tools with the normal shortcut.

Had to open them beforehand and then navigate there.

I wonder how well the phishers protect their infrastructure.

The webhoster I contacted on linkedin responded earlier today btw.

Told me they'll look into it and let me know.

Since the inbetween-URL is already in their list, I sent them a request to add the destination domain too.

This time I got a Google Save Browsing When clicking the link.

I didn't even know Firefox hat that.

The WordPress site is offline now.

So they changed to a different vendor and sent out another phishing mail using that one.

Let's see if anything happens.

I'm going to bed now.

Webhosters without abuse contact.

Lovely.

Their only contact-form has mandatory fields like budget. There's no way I'm filling that out.

But they have LinkedIn. Guess I'll contact them there?

Ok, messaged them.
Time to look at wordpress.

There's also an empty WordPress site between the college-website and the phishing-site, but I've yet to look at that one.