I reported 15 self-hosted remote-access servers, one of them reached through a fake software-update page that installs a remote-access tool. The vendor replied that it had actioned the reported accounts after an internal investigation with its security team, and later that it had actioned the reported instances and needed nothing further. It did not share its findings.
I reported one phishing domain that imitated a hosting company's login page. The registrar's abuse team replied that it had reviewed my complaint and suspended the domain name.
I sent 11 single-domain abuse reports, each on a phishing or scam site that asked visitors for logins, card details or personal details. Each report named one domain, what the page imitated or asked for, and when I saw it online. Eight replies said the site had been taken down and three said the service had been suspended.
I reported a server publishing an open directory of 356 intrusion-tooling files, including scripts that sprayed passwords against network devices and virtualisation servers and sent their results back to the same server. The provider replied within ten minutes that the service had been suspended.
An attacker had collected files belonging to an organisation, and the organisation's security team asked me for the evidence after my first notice. I sent it an encrypted package with my report, the attacker's copies of its files and an inventory of the credentials exposed in them. The team replied that it was using the material in its ongoing investigations.
I reported five hosts at one provider that an attacker had exploited through a code-injection flaw as part of a cryptomining campaign. The provider split the report into one ticket per host, and for one host it said its customer had confirmed the removal of the infringing material. My records show no confirmation for the other four.
An attacker's own exposed toolkit showed that it had compromised an organisation, and I sent the evidence to the national CERT responsible for it. The CERT later told me the organisation had remediated the incident and completed its investigation.
I sent a national CERT a referral on an operation stealing data from several organisations, plus a notice for each of two organisations it had targeted. The CERT answered all three, saying it had taken appropriate measures on the incidents. It did not say what the measures were.
I told a hosting provider that three of its customers' servers were exposed to the internet and appeared in a cryptojacking operator's own list of services it had fingerprinted. The provider passed on one customer's reply, which said the affected system had been isolated and taken offline and would be completely wiped to make sure the cryptojacker was removed.
I reported a second account whose public repository held the code of an operator's attack tooling. My records show the account was suspended and its repository returned HTTP 404 afterwards.
I reported the account of a cryptojacker kit's author, which hosted repackaged cryptominer binaries and the staging code operators used. I filed four reports, three on repositories and one on the account, and the platform told me it had acted on all four. The addresses I then checked myself all returned HTTP 404.
Each card is one action, or a group of identical actions from one round of reports, and says where it comes from: the recipient's word, my own check, or my case records alone. Victim actions are described in general terms only, with no organisation, sector or country, because the victims and the national CERTs that relayed my reports shared them in confidence. Most reports get no reply at all, and some of these actions may have had causes beyond my report.