New category/thread for reporting websites

TSU Community TSU Suggestions
1

Hey TSU, I was watching @ScammerRevolts last video about the crypto-recovery scams (noice btw thanks there’s tons of them around) and have a suggestion for TSU regarding reporting websites like that.

I’ve been reporting lot of fake websites (mostly fake investment sites) in the last couple of weeks and took down a bunch of them by reporting to the Host. This can be effective if we can give them a good explanation why it’s a Scam site (they don’t know much about it so it’s important to be precise).

How about we create a new category “report them” (or something like that) to consolidate forces in taking down websites like that.

  1. The template for a new category could look like this:
    Website: xxx
    Whois: xxx
    Description: xxx (this is the key, if it’s too general they ignore it)
    [Alternative: copy/paste the complete report and the host to report to]
  2. If someone reported the website just give it a like (so we know it’s been reported, the more the better)
  3. We might need a list of Hosts to quickly find the way to contact their abuse team (I already started a spreadsheet and could fill it up so people don’t have to look for it)

Btw: If you are as lazy as me: let chatgpt write these reports for you.

This is the basic instruction for gpt:

I need help reporting a fake website. Here’s the WHOIS data and a brief description. Extract the name of the hosting provider, summarize the report details, and draft a professional text I can use for an email or online abuse reporting form to the hosting provider.

whois:
[here I paste the whois, I use https://whois.domaintools.com/ as it includes thes host/ASN and gpt can extract it from there]

description:
[here I paste a brief description, gpt will do the rest, if it’s a similar pattern I can re-use it]

To give you an example, I used one of the sites from SRs vid:

gpt instruction:

"I need help reporting a fake website. Here’s the WHOIS data and a brief description. Extract the name of the hosting provider, summarize the report details, and draft a professional text I can use for an email or online abuse reporting form to the hosting provider.

whois:

Whois Record for FastDrills.top
How does this work?
Domain Profile
Registrar NameSilo, LLC NameSilo,LLC
IANA ID: 1479
URL: https://www.namesilo.com/,https://www.namesilo.com
Whois Server: whois.namesilo.com

(p)
Registrar Status ok
Dates 285 days old
Created on 2024-05-01
Expires on 2025-05-01
Updated on 2025-02-09
Name Servers NS43.DOVESERVER.COM (has 11,851 domains)
NS44.DOVESERVER.COM (has 11,851 domains)
IP Address 208.115.219.150 - 542 other sites hosted on this server
IP Location United States - Texas - Dallas - Private Customer
ASN United States AS46475 LIMESTONENETWORKS, US (registered Sep 29, 2008)

description:
fake crypto recovery website promoted on various social media platforms. scammers instruct their victims to enter their 12 or 24 word PHRASE on the website which automatically grants them complete access over the victims wallet and the scammers will steal all money from the victims wallet.

and this is report gpt wrote and I sent to the host:

Subject: Fraudulent Crypto Recovery Website – FastDrills.top

Dear Limestone Networks Abuse Team,

I am writing to report a fraudulent website, FastDrills.top, which is hosted on your servers. The site is being used to scam individuals by offering fake crypto recovery services, resulting in the theft of funds from victims’ wallets.

Summary of Scam:

  • Fake Crypto Recovery Service: The website promotes itself as a platform for recovering cryptocurrency. Victims are instructed to enter their 12 or 24-word recovery phrase, which grants scammers full access to their wallets, enabling them to steal all funds.
  • Subdomain Used in the Scam: The subdomain walletrestore.fastdrills.top is specifically used to collect victims’ recovery phrases.
  • Promotion via Social Media: The site is being advertised on various social media platforms, misleading users into believing they can recover lost funds, which ultimately results in the theft of their assets.

Whois & Hosting Details:

Given the fraudulent nature of this website and the potential for significant harm to victims, I request that you investigate and take appropriate action, including suspending the website to prevent further harm.

Please let me know if you require any further information.

Thank you for your attention to this matter.

Best regards

2 Likes
2

Thanks for reporting sites. Let us all know if you have success–or failures. I’ve tried reporting sites to CloudFlare and they usually don’t do anything to take them down.

1 Like
3

this might be interesting:

if I report a site for the first time to cloudflare (which is applies to most sites I report, they are newly created fake investment sites):
you only get a confirmation but no information about the real host.
BUT:
If they flagged the site with a phising warning (which they often do, while they process the report, sometimes they take down the site OR the phishing warning disappears again) and you send another report (I used a different mail), you get an answer with the real host (I thought they never give out that information as it’s their business as a proxy).

For me that means: file the first report, wait for phishing, file the second (receive the real host), file another report to the real host.

Now I’m testing if reporting to the real host as well has an effect… hope dies last.
Cheers

1 Like
4

another interesting finding regarding Cloudflare:

  • after reporting a couple of scam websites to Cloudflare (without the sites been taken down) I re-checked the whois and found something interesting:
  • if Cloudflare received and processed the abuse report succesfullly they terminate their proxy service (which usually hides the real Host) and this results in: the whois now showing the real host (so you can proceed and push the abuse report to the real host)

took between 2-4 weeks until I was able to see this in the whois but might be helpful if you want to shut-down a malicious scam website and due to the (non-existent) Cloudflare feedback you won’t get any notification about this changes (due to this finding I was able to shut down 20 more fake scam websites by putting the pressure to the real host)

(still a pain in the rear but it might be helpful)
cheers

1 Like
5

I am not sure that this would be good as a category but maybe as a singular topic. If I did set this up as a category it would create conflict with the rule TSU has of only keeping scammer information to it’s own topic instead of creating multiple duplicate topics to better help keep everything organized.

This seems like it would be better for a format like the CW list, which I know has not been formally updated in a while but has the added benefit that people can just report with CW instances they find and it really does not even have to have any input from me for people to go and see what websites people have been sharing.

I will have to think about this but I am considering making a post like my CW post( ConnectWise scam domains list - General - TechScammersUnited - Scambait forum) that goes and gives an explanation and tutorial on how to report scam sites to educate and inform and then below people can report the websites for the effort of getting them taken down.

I feel like overall this would be a better approach if implemented.

2 Likes
6

Yeah that makes sense. And it depends on the need as well… tech support / refund scammers don’t use any other websites than the CW landing pages. Not sure if there’s other baits that work via homepages and reporting them would slow them down.

I’ve reported around 100 fake investment scam websites so far (but they only target European countries due to stricter regulations in the US I think) and took down half of them.

The scam scheme for those is:

  • Run fake ads (usually with celebs supposedly having found the new gold mine)
  • lure them to the fake investment site where victims can register
  • after registration you will get lots of calls from call centres (mostly eastern Europe)
  • in the call they promise the big money and try to get an initial investment (after that they either ghost you or manipulate a fake dashboard to get you to invest more and then split)

Reporting these sites is tricky as it’s a grey area:
In the EU investment firms need to be registered with financial regulators (e.g. UK = FCA or Germany = BaFin) if they are not it’s most likely a scam.
Most hosts don’t know what this is or just don’t give a flying fudge.
Cloudflare is the one that requires most of the work as they usually don’t react to a single report (so I always send another one from a different mail).

long story short: not sure if there’s a demand for a thread like that on here