x.co

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!

Received a phishing email, tracked some info down. What can I, and should I, do with it? Hi all, my wife received a phishing email. For fun, I tried to see what I can learn from it. SMTP headers showed the use of SMTP relay, threading the email through gmail and hotmail. At the bottom, however, I found the IP address 5.231.208.76, which is in Germany and owned by GHOSTnet GmbH. A cursory google search showed that this ISP has a very plain website and is connected to phishing. [(example)](https://www.reddit.com/r/vpnreviews/comments/4jt5zh/nordvpn_a_little_review/?st=j3a1oepm&sh=971a3377) (EDIT: the actual geoocoordinates associated with the IP address are 50.2266, 8.6213, if that helps.) The phishing link was: http://x.co/6lsUZ. Using checkshorturl.com, I exploded that to https://apptrustedcloud.komsalam-service.info/. (Google translate tells me "komsalam" means "As a Muslim" in Arabic, possibly suggesting ISIL ties, perhaps?) The domain is registered to one Paula Alper, no organization, 2578 Balwynne Park Road, 19131 Philadelphia. Tech email is oscar_shales@hornyalwary.top. The domain is marked as inactive and on client hold. The site has a Let's Encrypt Authority X3 certificate made out to global-cheat.center (at least the name is honest there), valid from May 22 - August 20, 2017. (Is the short duration indicative of anything, here?) This FQDN is actually resolveable, leading only to a website with a private cgi directory. This is all I squeezed out from this. Is there anything I can do with this information? We're EU residents and citizens. Thanks!