Dekkiadekkia
Jul 15, 2025, 7:23 PMLet's see if anything happens.
I'm going to bed now.
Replies
- DekkiadekkiaJul 16, 2025, 2:43 PM
The WordPress site is offline now.
So they changed to a different vendor and sent out another phishing mail using that one.
- DekkiadekkiaJul 16, 2025, 2:44 PM
This time I got a Google Save Browsing When clicking the link.
I didn't even know Firefox hat that.
- DekkiadekkiaJul 16, 2025, 2:44 PM
Since the inbetween-URL is already in their list, I sent them a request to add the destination domain too.
- DekkiadekkiaJul 16, 2025, 2:45 PM
The webhoster I contacted on linkedin responded earlier today btw.
Told me they'll look into it and let me know.
- DekkiadekkiaJul 16, 2025, 2:46 PM
I wonder how well the phishers protect their infrastructure.
- DekkiadekkiaJul 16, 2025, 2:52 PM
They won't let me open debug tools with the normal shortcut.
Had to open them beforehand and then navigate there.
- DekkiadekkiaJul 16, 2025, 2:54 PM
They're using a PhisKit to do the heavy lifting.
The email-address of the author is still in there and I found a Portuguese security website talking about similar scams targeting other banks. - DekkiadekkiaJul 16, 2025, 2:54 PM
I'm not naming any names while I play around with it.
When I'm done or the thing is offline I will.
- DekkiadekkiaJul 16, 2025, 5:07 PM
I fond out who hosts the VM the destination site runs on.
They changed the cert to use Let's Encrypt for Apache, but not for Pure-FTP or Dovecot.
Those still use a default cert from the provider.
Let's send them that info and see what happens.
- DekkiadekkiaJul 16, 2025, 5:15 PM
Trying to log into any of the available services is legally considered hacking, so I won't do that because the IP is a shared host with a bunch of other legit stuff on it.
Based on a random reverse-dns site I found it's more than 500 domains (because that's the limit of their free plan)
- DekkiadekkiaJul 16, 2025, 5:22 PM
FFS, it's the same company that hosts the nameserver they use.
- DekkiadekkiaJul 16, 2025, 5:23 PM
since they didn't really do anything based on my abuse report yesterday, maybe the live chat does something.
- DekkiadekkiaJul 16, 2025, 5:26 PM
They confirmed the domain is on an account with them, but seem confused about what I want.
It would be crazy to play owner of it and shut it down, but I'm not that bold.
- DekkiadekkiaJul 16, 2025, 5:30 PM
At least it's not a bot I'm talking to.
Just some overworked support worker with below average reading comprehension.
- DekkiadekkiaJul 16, 2025, 5:38 PM
They now tried to blame the registrar for the domain. (Which also didn't respond to my abuse-email so far)
I went on and told them that knowingly hosting scammers is illegal and asked again to take down whatever service it is they run on the IP.
- DekkiadekkiaJul 16, 2025, 5:39 PM
> Your concerns are valued! Let me check this for you.
Let's see what comes next.
My guess: nothing. - DekkiadekkiaJul 16, 2025, 5:50 PM
I was right.
They assured me that someone will look at my report from yesterday in due time.
I contacted that company over LinkedIn as well now. Since that actually seemed to work last time.
- DekkiadekkiaJul 16, 2025, 5:54 PM
I was just about to contact the registrar on LinkedIn as well, just to be annoying.
Then I saw that the VPN-hoster and the registrar are owned by the same fucking company.
- DekkiadekkiaJul 16, 2025, 5:57 PM
Let's contact the mother company on LinkedIn instead.
Why not.
- DekkiadekkiaJul 20, 2025, 6:57 AM
Those fucks finally replied to the abuse reports I sent them.
The phishers have now 48 hours to stop phishing, or they'll get deleted.
I sent back an email asking if they get commission for being slow from the scammers or if they just don't care.