TCS-CERT

TCS-CERT - Thales Cyber Solutions Luxembourg CSIRT
(ex Excellium Services CERT-XLM)

[TCS-CERT @tcs_cert]

CERT-XLM has been notified regarding a Masquerade and Malware page hosted on hxxp://bilnet-lu-config[.]com

@openprovider We have sent you multiple reports and tried to call you, but the domain remains active.

Could you please take action to have this domain shut down?

[TCS-CERT @tcs_cert]

Hello @awscloud
TCS-CERT has been notified regarding a Phishing page hosted on hxxps[.]//ethias2ndopinion.spbcloud.eu
We have sent you many abuse reports, but we have yet to receive any feedback. Could you answer us please ?

[TCS-CERT @tcs_cert]

TCS-CERT has been notified regarding a Phishing page hosted on https://t.co/CaK7UAKfwI @squarespace @SquarespaceHelp .
We have sent you many abuse reports, but we have yet to receive any feedback.
Could you answer us please ?

[TCS-CERT @tcs_cert]

Hello @gnamedotcom

A phishing website is currently on your servers:
hxxp://swiss-quote[.]asia/

We've already contacted you, but you haven't responded or taken any action.

Please handle this issue ASAP

[TCS-CERT @tcs_cert]

@Cloudflare @CloudflareDev @CloudflareHelp
Hello,

We have reported Microsoft phishing to you several times without any action on your part.

Please take immediately the necessary action :
https://z8aov.uzydzgw[.]es

[TCS-CERT @tcs_cert]

Hello @vercel, @vercel_support, @vercel_status, @vercel_changes, and @gandi_net,

A phishing website is currently on your servers:
hxxps[:]//ethias.dpp.be

We've already contacted you, but you haven't responded or taken any action.

Please handle this issue ASAP

[TCS-CERT @tcs_cert]

Hello,
@GoDaddyHelp,@GoDaddyLife, @GoDaddyRegistry
We have reported a M365 phishing link for which you are the registrar... hxxps[://]kylehitz[.]org
Please process our requests as soon as possible

[TCS-CERT @tcs_cert]

Hello
@Cloudflare,@CloudflareDev,@CloudflareHelp,@CloudflareTV,@CloudflareLove and @openprovider, @openprovider_ru

There is a phishing website on your servers: hxxps[://]qwhzhfyr[.]ru We have already tried to contact you by email ! Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello @vertozgroup

We reported several phishing domains registered via your subsidiary OwnRegistrar

Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello
@Cloudflare,@CloudflareDev,@CloudflareHelp,@CloudflareTV,@CloudflareLove
and @ultahost

There is a phishing website on your servers: hxxps[:]//bilnet-lux.com We have already tried to contact you by email but without response!
Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello
@Cloudflare, @CloudflareDev , @CloudflareHelp, @CloudflareTV, @CloudflareLove and @ultahost

There is a phishing website on your servers:

hxxps[:]//squoteconnect.com

We have already tried to contact you by email but without response!

Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello @R01_ru

We have reported a M365 phishing link for which you are the registrar...

hxxps[:]//x3g.tcyoopxg[.]ru/

Please process our requests as soon as possible

[TCS-CERT @tcs_cert]

Hello @locaweb

We have reported a phishing redirect link hosted on your servers:
hxxps[:]//agromarketing[.]com[.]br/pot2/fkfjgjggvfbmdjjjf/%E3%80%82dGVzdEB0ZXN0LmNvbQ==%EF%BF%BD%25

Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello
@Cloudflare , @CloudflareDev , @CloudflareHelp , @CloudflareTV , @CloudflareLove
We reported you a M365 credentials Stealer hosted on yours servers, hxxps[:]//29fe13f2992c[.]atooz[.]lk and hxxps[:]//binaries.pilsnerbil[.]se
Please process our requests ASAP

[TCS-CERT @tcs_cert]

Hello @Cloudflare , @CloudflareDev , @CloudflareHelp , @CloudflareTV , @CloudflareLove

We reported you a credentials drop-server hosted on yours servers, hxxps[:]//3kxi2uz.port-terra[.]fr/app/godag.php

Please process our requests ASAP

[TCS-CERT @tcs_cert]

Dear @automattic and @WordPress teams,

We've been waiting for you since last week to process our abuse request related to a fraudulent website hosted on your servers.
Please take immediately the necessary measures.

Thank you

[TCS-CERT @tcs_cert]

Dear @webnic_cc team,

On last week, we've reported a fraudulent website for which the domain has been registered via your services. Could you process our request more quickly?

We're still waiting for you to take action.

Thank you

[TCS-CERT @tcs_cert]

@SquarespaceHelp @squarespace @SquarespaceHelp

We reported you several abuse report about this fraudulent domain for more than a month with all the evidences:
#11463693, #11341299 , #11335442 , #11324590

What are you waiting for to proceed with the takedown?

domain : fsma-regulatory[.]net

[TCS-CERT @tcs_cert]

Hello @squarespace Could you address the domain that’s do phishing, you got the report #11341299 , #11335442 , #11324590 with all the required proof, for fsma-regulatory[.]net

[TCS-CERT @tcs_cert]

Hello @Cloudflare , @CloudflareHelp , @CloudflareLove , @CloudflareDev ,

We reported you an ongoing phishing webpage hosted on by your services :
hxxps[:]//cloud.rolitone[.]ru/CPq1F/#YWRlbGV2QE0zNjV4NzA5MzEyODgub25taWNyb3NvZnQuY29tCg

Be more efficient with our report please.

[TCS-CERT @tcs_cert]

@SquarespaceHelp We already sent you DM last week with all details... malicious websites are still UP, how long do you need to takedown these?