I wonder why there are no CD players with a rotating laser-assembly and a stationary disk.

For display-purposes this would be amazing.

Let's contact the mother company on LinkedIn instead.

Why not.

I was just about to contact the registrar on LinkedIn as well, just to be annoying.

Then I saw that the VPN-hoster and the registrar are owned by the same fucking company.

I was right.

They assured me that someone will look at my report from yesterday in due time.

I contacted that company over LinkedIn as well now. Since that actually seemed to work last time.

> Your concerns are valued! Let me check this for you.

Let's see what comes next.
My guess: nothing.

They now tried to blame the registrar for the domain. (Which also didn't respond to my abuse-email so far)

I went on and told them that knowingly hosting scammers is illegal and asked again to take down whatever service it is they run on the IP.

At least it's not a bot I'm talking to.

Just some overworked support worker with below average reading comprehension.

They confirmed the domain is on an account with them, but seem confused about what I want.

It would be crazy to play owner of it and shut it down, but I'm not that bold.

since they didn't really do anything based on my abuse report yesterday, maybe the live chat does something.

FFS, it's the same company that hosts the nameserver they use.

Trying to log into any of the available services is legally considered hacking, so I won't do that because the IP is a shared host with a bunch of other legit stuff on it.

Based on a random reverse-dns site I found it's more than 500 domains (because that's the limit of their free plan)

I fond out who hosts the VM the destination site runs on.

They changed the cert to use Let's Encrypt for Apache, but not for Pure-FTP or Dovecot.

Those still use a default cert from the provider.

Let's send them that info and see what happens.

I'm not naming any names while I play around with it.

When I'm done or the thing is offline I will.

They're using a PhisKit to do the heavy lifting.
The email-address of the author is still in there and I found a Portuguese security website talking about similar scams targeting other banks.

They won't let me open debug tools with the normal shortcut.

Had to open them beforehand and then navigate there.

I wonder how well the phishers protect their infrastructure.

The webhoster I contacted on linkedin responded earlier today btw.

Told me they'll look into it and let me know.

Since the inbetween-URL is already in their list, I sent them a request to add the destination domain too.

This time I got a Google Save Browsing When clicking the link.

I didn't even know Firefox hat that.

The WordPress site is offline now.

So they changed to a different vendor and sent out another phishing mail using that one.