Cybersecurity 14 September 2026 5 min read I reported a phish. I found a casino. By Old Forge Technologies 11 reads Contents # I reported a phish. I found a casino. Somebody has been phishing my info@ mailbox. Twice this week a message arrived from `ionos@stableserver.net` dressed up in full IONOS branding: a fabricated customer number, a padlock emoji, a seven-day deadline, and a big "Verify Email Now" button waiting to harvest credentials. Standard stuff. The interesting part is not the phish. The interesting part is what happens when you try to report it. ## Doing it by the book The sending domain, stableserver.net, has been registered since 2012 through eNom, one of the largest registrars in the world. So I did what you are supposed to do: an abuse report to the domain's abuse address, with eNom's abuse inbox in copy. Dates, senders, subjects, a description of the credential-harvesting pattern, an offer of full headers on request. Back came an autoresponder. Reading between its lines, email reports are decoration; if you want anything to happen, you go to their web form at `cp.enom.com/help/AbusePolicy.aspx` and submit the whole thing again. ## The form So I went to the form, which is where the fun starts. You paste your report in again. You attach your evidence. Except the upload only accepts JPGs, a fact the form discloses nowhere; you learn it by uploading something sensible, like the original email or a headers file, and receiving an error. Think about that for a second. The canonical evidence of email abuse is an email, and the officially sanctioned way to submit it to one of the world's biggest registrars is to take a photograph of it. Submit, and you land on a confirmation page with a reassuring green banner: > "Please note that due to the volume of complaints received, unless we need additional information, you will not receive a reply or update from us. Please be assured that we take abuse very seriously and investigate every incident that is reported." No ticket number for you, no follow-up, no way to ever know whether anything happened. The same page, without visible irony, is titled "Enom Security & Abuse Policy" and explains that eNom has "a dedicated Compliance team" with "a zero tolerance policy for spam". ## As reported by HostExploit The policy page backs up its zero-tolerance claim with names: Spamhaus, Arbor, NetCraft, Google, and one bullet that deserves quoting in full: > "eNom works with HostExploit to establish accurate and reliable measurements of spam and malware activities on our systems and our efforts have resulted in our systems being relatively free of harmful spam and malware, as reported by HostExploit." I had never heard of HostExploit, so I clicked through. The link lands on a blog article from July 2011, a writeup of HostExploit's "Top 50 Bad Hosts" report for that quarter. The site's most recent content of any kind dates to March 2014. Every link inside the article resolves to the bare homepage, the web equivalent of a hallway where every door opens back into the hallway. The homepage is the punchline. hostexploit.com, the independent security watchdog cited on a registrar's abuse policy page as proof its systems are clean, is today a Bulgarian online casino review site. Copyright 2026, affiliate bonus links included, promising "real testing" of slot platforms with the same earnest tone it once applied to bulletproof hosting. Somewhere along the way the watchdog died, the domain lapsed or got sold, and an SEO operation moved into the corpse. Nobody at eNom noticed, because the page citing it is not really there to be read. It is there to exist, so that the box marked "we have an abuse policy" can be ticked. ## Abuse theatre Here is the shape of the whole system, laid end to end. A phisher sends mail from a domain registered through a major registrar. The registrar's abuse inbox forwards you to a form. The form cannot accept the evidence in its native format. The confirmation page promises silence. The credentials backing the policy point at a security project that has been dead for over a decade and now advertises casinos. Every individual piece has a plausible bureaucratic explanation. Volume is real, spam reports are noisy, old pages linger. Put together, though, they form a process that is indistinguishable from one designed to make reporters give up, which for practical purposes means it is one. Security people have a phrase for controls that exist to be seen rather than to work: security theatre. This is abuse theatre, staffed by an autoresponder, certified by a casino. Meanwhile the suspension notices keep arriving, politely, every few days, from a domain in good standing. *If you run your own mail and want to actually do something about phish like this: report the URLs to Google Safe Browsing and to the hosting provider of the landing page, block the sending domain at your MTA, and file the domain with Spamhaus. None of those will photograph your evidence.* P.S. I have pointed an uptime monitor at stableserver.net, probing every minute, to measure what a registrar's zero tolerance looks like on a graph. As of publication the server answers every check with HTTP 403: it refuses to show a page, yet it is demonstrably alive and still perfectly capable of sending mail. Should eNom ever act, the line will flatten and I will note the date here. You will receive a reply or update from me. :)
