Comments

• beanman109 Member, Host Rep, Megathread Squad

  May 2025 edited May 2025

  @Kevinf100 said:
  Interesting. I didn't get an email and I have a dedi. Either they are not sending to everyone, list they have is old, it's a scam, or just email was hacked maybe?
  

  the dedicated servers are a completely different portal, those normally run under portal.colocrossing.com whereas the VPS products are under cloud.colocrossing.com

  Thanked by 11Blembim lukast__ Decicus admax Kevinf100 mandala borkedascii khalequzzaman geo nghialele ServerBachelor
• Vinegar Member

  May 2025

  Admin opened the Trojan email
• lukast__ Member, Megathread Squad

  May 2025

  @beanman109 said:

  @zed said:
  Yea I'm not sure I see proof of an actual tie to Colocrossing, we might be jumping the gun a bit.

  KEEP CLAM!

  sendgrid IP with a passed SPF isn't a great look

  With SPF alone it could still be spoofed (especially as they use ~all and not -all) (https://community.spiceworks.com/t/anyone-else-noticing-sendgrid-allowing-bad-actors-to-spoof-their-domain/947728, https://www.reddit.com/r/sysadmin/comments/144avo4/sendgrid_phishing_emails/), but it's also passing DKIM:

   smtp.mailfrom=em4475.colocrossing.com; dkim=pass (signature was verified)
  

  Though from the second link:

  Been periodically receiving phishing emails that's spoofed from our domain, passes SPF/DKIM/DMARC from sendgrid ip address.

  But given that they seem to have access to the email addresses of all/most CC customers, I think this might be real. Let's see...

  Thanked by 9beanman109 Blembim Decicus admax mandala tentor khalequzzaman nghialele Xrmaddness
• beanman109 Member, Host Rep, Megathread Squad

  May 2025

  @zGato said:
  i don't get any emails from colocrossing, at all, so i'm fine

  hackers hate this one way of besting them!

  Thanked by 9zGato lukast__ Blembim Decicus admax khalequzzaman geo nghialele Xrmaddness
• zGato Member

  May 2025

  I'm also not entirely sure about this, but this email is not in the WHMCS email history, so could be a breach of their sendgrid shit and that's it.

  Thanked by 12lukast__ beanman109 Blembim Decicus admax netomx mandala tentor khalequzzaman nghialele Xrmaddness Ed_Chd
• oloke Member, Host Rep

  May 2025 edited May 2025

  @allthemtings said:
  Pictures of my sisters are going to be leaked without the hour this can’t go on @ColoCrossing

  please share them here before they post your leaked data

  outsmart the hackers 😎

  Thanked by 2Blembim nghialele
• angstrom Moderator

  May 2025

  @jsg said:
  @angstrom @Arkas @DP @jbiloh

  Shouldn't the title be changed? After all, an email supposedly coming from [whoever]@colocrossing.com with wild allegations but no proof whatsoever, and even worse, in a blackmailing context, is NOT indicative of a breach of colocrossing infrastructure.

  @ColoCrossing

  Be sure to hand any and all evidence to LEA so as to get those blackmailing assholes behind bars!

  For the time being, I've moved the thread from News to Offtopic

  Yes, we need independent confirmation that there have been "system breaches"

  It almost looks like a disgruntled employee on the way out who sent this email

  Thanked by 10beanman109 PineappleM Blembim Porlam admax lukast__ khalequzzaman jsg Xrmaddness ServerBachelor
• zGato Member

  May 2025 edited May 2025

  @angstrom said:

  @jsg said:
  @angstrom @Arkas @DP @jbiloh

  Shouldn't the title be changed? After all, an email supposedly coming from [whoever]@colocrossing.com with wild allegations but no proof whatsoever, and even worse, in a blackmailing context, is NOT indicative of a breach of colocrossing infrastructure.

  @ColoCrossing

  Be sure to hand any and all evidence to LEA so as to get those blackmailing assholes behind bars!

  For the time being, I've moved the thread from News to Offtopic

  Yes, we need independent confirmation that there have been "system breaches"

  It almost looks like a disgruntled employee on the way out who sent this email

  There's still a breach of the customer's emails DB, that's forsure.

  Thanked by 9Blembim beanman109 admax lukast__ khalequzzaman imok Xrmaddness ServerBachelor iKeyZ
• Teko Member

  May 2025 edited May 2025

  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  Thanked by 2Blembim nghialele
• beanman109 Member, Host Rep, Megathread Squad

  May 2025

  @angstrom said:

  @jsg said:
  @angstrom @Arkas @DP @jbiloh

  Shouldn't the title be changed? After all, an email supposedly coming from [whoever]@colocrossing.com with wild allegations but no proof whatsoever, and even worse, in a blackmailing context, is NOT indicative of a breach of colocrossing infrastructure.

  @ColoCrossing

  Be sure to hand any and all evidence to LEA so as to get those blackmailing assholes behind bars!

  For the time being, I've moved the thread from News to Offtopic

  Yes, we need independent confirmation that there have been "system breaches"

  It almost looks like a disgruntled employee on the way out who sent this email

  @jbiloh pls confirm or deny
  thanx

  Thanked by 9Blembim oloke sh97 admax lukast__ borkedascii khalequzzaman geo Xrmaddness
• oloke Member, Host Rep

  May 2025 edited May 2025

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  did he give you any deals?

  Thanked by 5beanman109 lukast__ khalequzzaman vastness4594 nghialele
• zed Member

  May 2025

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  But who are you? Trust me bro.

  Thanked by 10beanman109 PineappleM admax netomx lukast__ mandala borkedascii khalequzzaman jsg nghialele
• Teko Member

  May 2025

  @oloke said:

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  did he gave you any deals?

  I gave him a deal for a few BTC, although I don't have BTC, tbh
• zGato Member

  May 2025

  yeah boys, virtualizor is compromised LOL

  just got a screenshot too, the dude didn't even bother to blur the stuff, what a goat

  Thanked by 24Blembim oloke beanman109 PineappleM Decicus sh97 barbaros Porlam admax satorik lukast__ ebietsy borkedascii tentor khalequzzaman vastness4594 brauni nghialele Xrmaddness loay iKeyZ Ed_Chd SLMob maverickp
• Blembim Member

  May 2025

  @zGato said:
  yeah boys, virtualizor is compromised LOL

  just got a screenshot too, the dude didn't even bother to blur the stuff, what a goat

  it possibel giv us sneak peak?

  Thanked by 8oloke beanman109 PineappleM admax lukast__ Decicus khalequzzaman geo
• zGato Member

  May 2025

  @Blembim said:

  @zGato said:
  yeah boys, virtualizor is compromised LOL

  just got a screenshot too, the dude didn't even bother to blur the stuff, what a goat

  it possibel giv us sneak peak?

  don't want to get in trouble

  just ask the guy on telegram, he doesn't care

  Thanked by 7PineappleM Blembim admax lukast__ Decicus khalequzzaman nghialele
• Teko Member

  May 2025

  @zed said:

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  But who are you? Trust me bro.

  You don't have to trust me; I don't mind your secret on the internet.
  Or you can just ask the hacker for proof using your VPS ID, which I have done.

  Thanked by 5Blembim PineappleM mandala khalequzzaman nghialele
• beanman109 Member, Host Rep, Megathread Squad

  May 2025

  @Blembim said:

  @zGato said:
  yeah boys, virtualizor is compromised LOL

  just got a screenshot too, the dude didn't even bother to blur the stuff, what a goat

  it possibel giv us sneak peak?

  is possibel we get news topic back already? what a whirlwind of a 5 minute period its been

  Thanked by 7Blembim PineappleM admax lukast__ khalequzzaman geo Xrmaddness
• angstrom Moderator

  May 2025

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  So the hacker got in touch with you for a chat, or you got in touch with the hacker for a chat?

  Thanked by 4PineappleM admax lukast__ khalequzzaman
• Teko Member

  May 2025

  @angstrom said:

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  So the hacker got in touch with you for a chat, or you got in touch with the hacker for a chat?

  I got in touch with the hacker
• darkimmortal Member

  May 2025

  Offtopic? Typical LET

  Thanked by 18beanman109 Blembim MannDude admax lukast__ Decicus borkedascii tentor khalequzzaman vastness4594 imok SashkaPro marcopolio equalz Peppery9 Ed_Chd SLMob maverickp
• beanman109 Member, Host Rep, Megathread Squad

  May 2025

  @darkimmortal said:
  Offtopic? Typical LET

  not quite news worthy enough yet sir sorry i've got a problem with blowing my load too early

  Thanked by 6admax lukast__ khalequzzaman barbarza geo nghialele
• darkimmortal Member

  May 2025 edited May 2025

  Received this too to coloncrossing@mydomain so it’s at least a mailing list breach

  I’m also a relatively new customer (single digit months) so it’s fresh
• zed Member

  May 2025

  @Teko said:

  @zed said:

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  But who are you? Trust me bro.

  You don't have to trust me; I don't mind your secret on the internet.
  Or you can just ask the hacker for proof using your VPS ID, which I have done.

  Not even a customer, my point was your confirmation isn't confirming anything, help us out here.
• sh97 Member, Host Rep

  May 2025

  @beanman109 unexpected card on your 2025 bingo?

  Thanked by 15beanman109 Blembim oloke barbaros admax FAT32 lukast__ mandala Decicus khalequzzaman vastness4594 barbarza geo nghialele Xrmaddness
• Teko Member

  May 2025

  @zed said:

  @Teko said:

  @zed said:

  @Teko said:
  Confirmed, the email is not spoofed; their backend has been exposed. I just had a chat with the hacker.

  The hacker provided proof that matches my panel records, and they have Virtualizor permissions. (provided a screenshot of my VPS)

  Reminder: reinstall the system and cleanup all your secret

  But who are you? Trust me bro.

  You don't have to trust me; I don't mind your secret on the internet.
  Or you can just ask the hacker for proof using your VPS ID, which I have done.

  Not even a customer, my point was your confirmation isn't confirming anything, help us out here.

  same as @zGato , dont want to get into trouble

  Thanked by 4zGato Blembim PineappleM khalequzzaman
• fifo Member

  May 2025

  Has colo crossing always used sendgrid? I remember getting a strange email in Feb, but the headers pointed to zoho instead.
• barbaros Member

  May 2025

  @Teko said:

  Reminder: reinstall the system and cleanup all your secret

  Thanks I will try to arrange a hitman from DarkNet to cleanup any loose ends.

  Thanked by 7oloke PineappleM admax lukast__ Decicus khalequzzaman nghialele
• Rubben Member

  May 2025

  sue them

  Thanked by 6oloke Blembim lukast__ Decicus khalequzzaman nghialele
• barbaros Member

  May 2025

  @wadhah look dis important news

  @emgh suck my willy

  Thanked by 10Blembim oloke PineappleM sh97 admax lukast__ Decicus khalequzzaman emgh nghialele