ConnectWise scam domains list

General
, ,
1

Connect Wise Control is one of the worst software that scammers use to take remote access to victim’s computers in the sense that you can only close it through task manager and it always runs on your computer’s startup, there is no way to tell that this software is running other than in task manager. I want to make a list of these domains so we can report them and make victims aware of these horrible sites using this horrible software! If you have any of these domains that look like the image below using this software please reply with them here and I will add them to the list.

Screenshot 2022-12-14 111235
Screenshot 2022-12-14 1112351920×1079 125 KB

The current list, updated on 5/24/23:

https://ntcare247.live/
https://help247.us/
https://ntxdr.top/
https://fcare.cc/
https://medino.life/
https://healthcenter.live/
https://supportcare.pro/
https://247secure.info/
http://support01.us
https://support01.us/
https://support247.help/
https://shelp.cc/
https://assist247.info/
http://ihelps.us
http://passist.us
http://cscare.cc/
https://login08.info/
https://24789.org/
https://phelp.pro/
https://carehelp.live/
https://9001sup.org/
https://sfhelp.online/
https://sfhelpback.xyz/
https://kwbackend.xyz/
https://phelp247.us/
https://tassist.me/
https://ysupport.us/
https://ntcare247.us/
https://asorg.info/
https://win01.top
https://akpd.live/
https://fsupport.cc
https://nsworld.live
https://nsworld.live/
https://vfssupport.live/
https://lphelp.online/
http://gosys.us/
https://carehelp.live/
https://whelp.cc
https://dponline.pro
https://matry.top
https://kwsupport.live/
https://mcare.help/
http://123secure.org/
https://vhelp.info/
https://asorg.info/
https://ghelps.us/
https://control.ctrl10.pw
https://kcare.cc
https://rmpk.info
https://9117.org
https://mkpks.info
https://rhelps.us/
http://jassist.us
https://os123.org
https://sup2.supos123.org/guest.aspx
https://os123.org/
https://rcare.cc/
https://dhelps.us/
https://qcare.cc
https://kpmk.info/
https://vfsupport.live/
https://www.pcsupporthelp.com/
https://shelp.info/
https://pcsupport.life/
https://qassist.us
https://tcare.cc
https://os911.org
https://rmus.pro
https://www.cancelorder.net/

8 Likes
2

many ConnectWise scam domains are simply load another page in an iframe. this can be discerned by a small blank border around the page. this is often because the scam call centers are running multiple scams and are using different domains to link to the same installation.

in ntcare247.live’s case, it simply loads https://ntxdr.top/guest.aspx

I’ll try to keep on top of what ConnectWise scam domain iframes to where, since those sites are the ones that need to be flagged.

another scam domain mentioned last week is https://fcare.cc which iframes https://medino.life/guest.aspx

another iframe target is https://healthcenter.live/guest.aspx but the reported site from August that iframes that one went down

1 Like
3

https://supportcare.pro/

Not sure if it downloads ConnectWise…but it’s used by a scammer.

1 Like
4

https://help247.us/ is one site I went to yesterday

1 Like
5

Just updated the list with these domains being added :+1:

2 Likes
6

https://support247.help/

1 Like
7

support01.us and help01.us don’t iframe anything (they used to iframe win01.top), but they now impersonate Norton and distribute ScreenConnect (labelled WinDesk) using win01.top as their server

other domains I found are win01.xyz, psupport.cc, and pccarelive.org

1 Like
8

Here’s another SR – https://247secure.info/

9

Ok! I have updated the list with the active domains you guys have replied with, ty!

10

shelp.cc - It’s another one of these links that uses the dreaded ScreenConnect.

11

@ScammerRevolts Not sure if this one falls into the criteria, but some chode just had me go to this one this morning…

ihelps.us In turn it downloaded support.client.jnlp

1 Like
12

ihelps.us iframes https://marian.ink/guest.aspx

1 Like
13

cscare.cc - It is another one of these links that uses ScreenConnect.

1 Like
14

cscare.cc iframes https://login08.info/guest.aspx

1 Like
15

passist.us is the last one that came up for me.

1 Like
16

It would be nice if Microsoft Windows Defender could remove this. Maybe someone else could code a script where it Automatically removes ConnectWise on Windows

17

Ok, I have updated the list with the new links, thank you, everyone!

1 Like
18

Another one
Wllbackend.xyz

19

Not getting any response from this domain, are you sure it is typed correctly?

20

Yes. It worked when I posted it. Whois shows its registered with Namecheap.

1 Like