Dekkiadekkia
Jul 16, 2025, 2:54 PMI'm not naming any names while I play around with it.
When I'm done or the thing is offline I will.
Replies
- DekkiadekkiaJul 16, 2025, 5:07 PM
I fond out who hosts the VM the destination site runs on.
They changed the cert to use Let's Encrypt for Apache, but not for Pure-FTP or Dovecot.
Those still use a default cert from the provider.
Let's send them that info and see what happens.
- DekkiadekkiaJul 16, 2025, 5:15 PM
Trying to log into any of the available services is legally considered hacking, so I won't do that because the IP is a shared host with a bunch of other legit stuff on it.
Based on a random reverse-dns site I found it's more than 500 domains (because that's the limit of their free plan)
- DekkiadekkiaJul 16, 2025, 5:22 PM
FFS, it's the same company that hosts the nameserver they use.
- DekkiadekkiaJul 16, 2025, 5:23 PM
since they didn't really do anything based on my abuse report yesterday, maybe the live chat does something.
- DekkiadekkiaJul 16, 2025, 5:26 PM
They confirmed the domain is on an account with them, but seem confused about what I want.
It would be crazy to play owner of it and shut it down, but I'm not that bold.
- DekkiadekkiaJul 16, 2025, 5:30 PM
At least it's not a bot I'm talking to.
Just some overworked support worker with below average reading comprehension.
- DekkiadekkiaJul 16, 2025, 5:38 PM
They now tried to blame the registrar for the domain. (Which also didn't respond to my abuse-email so far)
I went on and told them that knowingly hosting scammers is illegal and asked again to take down whatever service it is they run on the IP.
- DekkiadekkiaJul 16, 2025, 5:39 PM
> Your concerns are valued! Let me check this for you.
Let's see what comes next.
My guess: nothing. - DekkiadekkiaJul 16, 2025, 5:50 PM
I was right.
They assured me that someone will look at my report from yesterday in due time.
I contacted that company over LinkedIn as well now. Since that actually seemed to work last time.
- DekkiadekkiaJul 16, 2025, 5:54 PM
I was just about to contact the registrar on LinkedIn as well, just to be annoying.
Then I saw that the VPN-hoster and the registrar are owned by the same fucking company.
- DekkiadekkiaJul 16, 2025, 5:57 PM
Let's contact the mother company on LinkedIn instead.
Why not.
- DekkiadekkiaJul 20, 2025, 6:57 AM
Those fucks finally replied to the abuse reports I sent them.
The phishers have now 48 hours to stop phishing, or they'll get deleted.
I sent back an email asking if they get commission for being slow from the scammers or if they just don't care.
- DekkiadekkiaJul 22, 2025, 5:37 PM
Good news everyone:
The people who ran the first jump-off point finally fixed the issue with what looks like a filter returning a 403 for every forwarding-request that doesn't start with "https://<their-domain>/"
The slash at the end makes it so that one can't just register <their-domain>.example.org and keep going.
- DekkiadekkiaJul 22, 2025, 5:38 PM
They also emailed me asking me for my government name and I told them that all the information is in the task.
- DekkiadekkiaJul 22, 2025, 5:40 PM
The harborers of the scammers also finally did something and the page now returns a 503.
Sadly they didn't answer my question about the commission.
- DekkiadekkiaJul 22, 2025, 5:46 PM
Completely unrelated to that thread: Fuck Newfold and especially their subsidiary Hostgator.
They _didn't_ knowingly host a Phishing-Scam for a Week and also did _not_ give the scammers a heads-up before shutting them down. Because that would be unethical.