Theo Plooij

Voormalig Tzorg medewerker in Delft (now retired)

[Theo Plooij @TheoPlooij]

@CloudflareHelp Where can I report abuse of a Turnstile sitekey (0x4AAAAAAFVaPQ-_-jw2DZze)? It’s used as a gate on a phishing redirector hosted off Cloudflare (https://t.co/Hyi2Rt7Ssl). Abuse form auto-closed: “not served by Cloudflare” (Report ID 71b71e24406f942f)

[Theo Plooij @TheoPlooij]

GCP scanners are bypassed via a Turnstile cloak on this bucket. It dynamically routes to phishing domains using one .txt file. Tickets are stalled, please investigate. @Mandiant @GoogleCloudSec #Phishing #Infosec #CTI

[Theo Plooij @TheoPlooij]

GCS bucket “forgeone” powers a Dutch phishing campaign. Its code (Turkish comments): one file, domain.txt, steers all redirect pages. 18 Oct: switched to a new domain 16 min after two campaign domains went on hold. Please disable + purge. @googlecloud @GoogleCloudTech

[Theo Plooij @TheoPlooij]

@grok Hey @Grok, what will happen if Trump loses the midterms for the House and Senate

[Theo Plooij @TheoPlooij]

Hey @grok who will win the midterms?

[Theo Plooij @TheoPlooij]

@grok Hey @Grok what's going on with Trump and Putin, is Putin blackmailing him? Are they friends?

[Theo Plooij @TheoPlooij]

@grok Hey @Grok Is the oil deal between Russia and the U.S. making a difference in gasoline prices

[Theo Plooij @TheoPlooij]

GCS bucket “forgeone” powers a Dutch phishing campaign. Its code (Turkish comments): one file, domain.txt, steers all redirect pages. 18 Oct: switched to a new domain 16 min after two campaign domains went on hold. Please disable + purge. @googlecloud @GoogleCloudTech

[Theo Plooij @TheoPlooij]

Update: ‘forgeone’ is still live. On 17 Oct (00:33 UTC) its domain.txt was switched to a new .sbs phishing domain, about 9 hours after the previous one went on hold (16 Oct). One file reroutes all redirect pages. Ticket Z7NFM5BVHH6QSUP53G6RYGEAPE @GoogleCloudTech @googlecloud

[Theo Plooij @TheoPlooij]

Update: ‘forgeone’ is still live. On 17 Oct (00:33 UTC) its domain.txt was switched to a new .sbs phishing domain, about 9 hours after the previous one went on hold (16 Oct). One file reroutes all redirect pages. Ticket Z7NFM5BVHH6QSUP53G6RYGEAPE @GoogleCloudTech @googlecloud

[Theo Plooij @TheoPlooij]

Phishing redirectors on a public Google Cloud Storage bucket ('forgeone') have been live since at least 21 Aug 2026. Repeatedly reported to Google Cloud abuse; no action visible, bucket still growing (140 objects on 14 Oct). @GoogleCloudTech 1/3

[Theo Plooij @TheoPlooij]

@googlecloud Thanks @googlecloud. I answered in DM (ticket Z7NFM5BVHH6QSUP53G6RYGEAPE), no reply since 15:52. Bucket "forgeone" is still live (checked 15 Oct, 18:31 UTC). Could a human reviewer pick it up there?

[Theo Plooij @TheoPlooij]

Phishing redirectors on a public Google Cloud Storage bucket ('forgeone') have been live since at least 21 Aug 2026. Repeatedly reported to Google Cloud abuse; no action visible, bucket still growing (140 objects on 14 Oct). @GoogleCloudTech 1/3

[Theo Plooij @TheoPlooij]

Could a human Trust & Safety engineer at @GoogleCloudTech review bucket 'forgeone'? Details are in my Google Cloud abuse tickets, latest Z7NFM5BVHH6QSUP53G6RYGEAPE. Happy to share more. 3/3

[Theo Plooij @TheoPlooij]

Each page shows a Cloudflare Turnstile, then reads its target from domain.txt. A Turkish code comment says changing only domain.txt is enough for all pages (my translation). It now points to a new .sbs phishing domain. 2/3

[Theo Plooij @TheoPlooij]

Could a human Trust & Safety engineer at @GoogleCloudTech review bucket ‘forgeone’? Details are in my Google Cloud abuse tickets, latest Z7NFM5BVHH6QSUP53G6RYGEAPE. Happy to share more. 3/3

[Theo Plooij @TheoPlooij]

Hi @Cloudflare what is the correct official channel to follow up on an existing abuse report when a reply to [email protected] bounces due to a recipient rate limit?

[Theo Plooij @TheoPlooij]

Hi, I’m looking for the correct OVHcloud contact route for a registrar complaint. The abuse form requires an OVH-hosted service, but this concerns registrar verification. What is the appropriate channel for this?@ovhcloud_status

[Theo Plooij @TheoPlooij]

@dijkshoorn Nico, heb je al eens naar De Schatkamer gekeken? Ik kwam deze tv-reportage over Louis van Gaal tegen. Vanaf 7.05 minuten kijken.
https://t.co/mPaDoe4LYy

[Theo Plooij @TheoPlooij]

And here's, another one:

Submitted: 23-5-2026, 14:41:26 +0200:
500% Bonus with 100 Free Spins in "Gates of Olympus"
7400943464 ( 107.155.116.6 ) To: [email protected]

[Theo Plooij @TheoPlooij]

Servers on your network are repeatedly used as a phishing relay. Tons of abuse reports filed
Still active. Time for action AND a response.
Received another phishing message moments ago
@hivelocity

[Theo Plooij @TheoPlooij]

@googlecloud @sundarpichai @Google Update #7: Same bucket 'lastkljferofg' still online. Now impersonating
Costco/YETI. New IP: 193.111.77.84, still AS212219 HostingDunyam Turkey.
Same bucket, 3rd different brand today. @GoogleCloud @sundarpichai
a human needs to look at this. Now.

[Theo Plooij @TheoPlooij]

.@GoogleCloud active phishing page on Cloud Storage, bucket 'dljeookdjkweh' still online. Abuse ticket 2ucp8b6umy9vi08 — bot reply told me to contact the webmaster, who IS the phisher. @sundarpichai is this Trust & Safety?
@google @googlecloud

[Theo Plooij @TheoPlooij]

@googlecloud @sundarpichai Update #5: Now filing formal abuse report with @GoogleCloud Trust & Safety. 4 buckets, same threat actor. Now switched to https://t.co/LmujIogpSn — identical fingerprint (https://t.co/WF2nUPr4n5) gives them away. Ticket 2ucp8b6umy9vi08 still bot-replied. @sundarpichai @Google

[Theo Plooij @TheoPlooij]

@googlecloud @sundarpichai @Google Update #6: Same threat actor, same bucket 'lastkljferofg', now impersonating AAA (American Automobile Association). New IP:
193.111.78.160, still AS212219 HostingDunyam Turkey. Bucket still online despite multiple reports.
@GoogleCloud @sundarpichai When are you acting???