https://stwps.org
PayPal and McAfee Scammers using this site.
1 Like
Added:
1 Like
www.conline.life
Delhi popup scammers using this today
1 Like
2 Likes
https://jpcare.live
Geek squad scammers today
1 Like
Seems I am unable to resolve https://jpcare.live/, I am guessing it has already been taken down?
Seems they were using alex host and it was last seen 3 months ago:
| IP Addresses | Organization | First Seen | Last Seen | Duration Seen |
|---|---|---|---|---|
| 193.233.203.146 | ALEXHOST SRL | 2024-02-14 (4 months) | 2024-02-26 (3 months) | 12 days |
| 213.232.235.244 | ALEXHOST SRL | 2024-02-11 (4 months) | 2024-02-14 (4 months) | 3 days |
Going to https://193.233.203.146 seems to work, I will add the domain along with the IP.
URLScan: 193.233.203.146 - urlscan.io
The domain currently has no DNS records, maybe they are shutting it down and planning to move a new domain for the server they are hosting CW on.
Oh Boy:
| Domain | Rank | Hosting Provider | Mail Provider |
|---|---|---|---|
| sub.verify.czechia.competent-shockley.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.rkhelp.us | ALEXHOST SRL | ‐ | |
| www.rkhelp.live | ALEXHOST SRL | ‐ | |
| heuristic-albattani.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| rbcare.info | ALEXHOST SRL | ‐ | |
| rscare.info | ALEXHOST SRL | ‐ | |
| www.rscare.online | ALEXHOST SRL | ‐ | |
| rkhelp.info | ALEXHOST SRL | ‐ | |
| nortn.live | ALEXHOST SRL | ‐ | |
| rbcare.online | ALEXHOST SRL | ‐ | |
| www.jpcare.info | ALEXHOST SRL | ‐ | |
| www.uvcare.live | ALEXHOST SRL | ‐ | |
| rbcare.us | ALEXHOST SRL | ‐ | |
| www.mfhelp.live | ALEXHOST SRL | ‐ | |
| www.rshelp.us | ALEXHOST SRL | ‐ | |
| rshelp.live | ALEXHOST SRL | ‐ | |
| jpcare.info | ALEXHOST SRL | ‐ | |
| www.optimistic-pike.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| wtcare.live | ALEXHOST SRL | ‐ | |
| www.rkhelp.cc | ALEXHOST SRL | ‐ | |
| www.rkhelp.online | ALEXHOST SRL | ‐ | |
| uvcare.live | ALEXHOST SRL | ‐ | |
| rscare.cc | ALEXHOST SRL | ‐ | |
| www.rbcare.live | ALEXHOST SRL | ‐ | |
| rshelp.info | ALEXHOST SRL | ‐ | |
| www.rbcare.info | ALEXHOST SRL | ‐ | |
| brhelp.info | ALEXHOST SRL | ‐ | |
| wtcare.info | ALEXHOST SRL | ‐ | |
| www.brhelp.info | ALEXHOST SRL | ‐ | |
| www.helpsystem.info | ALEXHOST SRL | ‐ | |
| rkhelp.online | ALEXHOST SRL | ‐ | |
| www.rshelp.info | ALEXHOST SRL | ‐ | |
| jxhelp.live | ALEXHOST SRL | ‐ | |
| www.rshelp.cc | ALEXHOST SRL | ‐ | |
| pp247.live | ALEXHOST SRL | ‐ | |
| netfx.live | ALEXHOST SRL | ‐ | |
| rscare.help | ALEXHOST SRL | ‐ | |
| cshelp13.live | ALEXHOST SRL | ‐ | |
| optimistic-pike.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.rbcare.online | ALEXHOST SRL | ‐ | |
| www.cashapphelp011.live | ALEXHOST SRL | ‐ | |
| www.wtcare.info | ALEXHOST SRL | ‐ | |
| www.rscare.cc | ALEXHOST SRL | ‐ | |
| mfhelp.live | ALEXHOST SRL | ‐ | |
| helpsystem.info | ALEXHOST SRL | ‐ | |
| www.rbcare.us | ALEXHOST SRL | ‐ | |
| verify.czechia.ntx.optimistic-pike.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.rshelp.live | ALEXHOST SRL | ‐ | |
| charming-shamir.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| competent-shockley.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| rbcare.live | ALEXHOST SRL | ‐ | |
| www.rscare.info | ALEXHOST SRL | ‐ | |
| www.competent-shockley.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.rscare.live | ALEXHOST SRL | ‐ | |
| rkhelp.live | ALEXHOST SRL | ‐ | |
| rscare.live | ALEXHOST SRL | ‐ | |
| rkhelp.cc | ALEXHOST SRL | ‐ | |
| www.nortn.live | ALEXHOST SRL | ‐ | |
| rshelp.us | ALEXHOST SRL | ‐ | |
| 193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.rkhelp.info | ALEXHOST SRL | ‐ | |
| rscare.online | ALEXHOST SRL | ‐ | |
| hungry-dubinsky.193-233-203-146.plesk.page | ALEXHOST SRL | ‐ | |
| www.cashapphelp105.info | ALEXHOST SRL | ‐ | |
| rkhelp.us | ALEXHOST SRL | ‐ | |
| www.wtcare.live | ALEXHOST SRL | ‐ | |
| ms4care.live | ALEXHOST SRL | ‐ | |
| rshelp.cc | ALEXHOST SRL | ‐ | |
| www.rscare.help | ALEXHOST SRL | ‐ | |
| www.ms4care.live | ALEXHOST SRL | ‐ |
Results for the other IP: https://213.232.235.244
| Domain | Rank | Hosting Provider | Mail Provider |
|---|---|---|---|
| www.mshelp19.info | ALEXHOST SRL | ‐ | |
| w2help.live | ALEXHOST SRL | ‐ | |
| www.abhelp.info | ALEXHOST SRL | ‐ | |
| help01.cc | ALEXHOST SRL | ‐ | |
| mshelp06.info | ALEXHOST SRL | ‐ | |
| www.help02.cc | ALEXHOST SRL | ‐ | |
| bdcare.live | ALEXHOST SRL | ‐ | |
| mshelp08.info | ALEXHOST SRL | ‐ | |
| www.cphelp.live | ALEXHOST SRL | ‐ | |
| mshelp05.info | ALEXHOST SRL | ‐ | |
| www.mshelp15.info | ALEXHOST SRL | ‐ | |
| www.mshelp13.info | ALEXHOST SRL | ‐ | |
| www.mshelp11.info | ALEXHOST SRL | ‐ | |
| mshelp09.info | ALEXHOST SRL | ‐ | |
| www.mshelp16.info | ALEXHOST SRL | ‐ | |
| www.rclaim.online | ALEXHOST SRL | ‐ | |
| mshelp19.info | ALEXHOST SRL | ‐ | |
| mshelp11.info | ALEXHOST SRL | ‐ | |
| www.mshelp08.info | ALEXHOST SRL | ‐ | |
| www.bdcare.info | ALEXHOST SRL | ‐ | |
| ihelp24.live | ALEXHOST SRL | ‐ | |
| www.mshelp20.info | ALEXHOST SRL | ‐ | |
| mshelp15.info | ALEXHOST SRL | ‐ | |
| www.bshelp.support | ALEXHOST SRL | ‐ | |
| cshelp17.live | ALEXHOST SRL | ‐ | |
| abhelp.info | ALEXHOST SRL | ‐ | |
| mshelp16.info | ALEXHOST SRL | ‐ | |
| www.cshelp17.live | ALEXHOST SRL | ‐ | |
| www.mshelp17.info | ALEXHOST SRL | ‐ | |
| bdcare.info | ALEXHOST SRL | ‐ | |
| mshelp13.info | ALEXHOST SRL | ‐ | |
| mhelp24.live | ALEXHOST SRL | ‐ | |
| mshelp02.info | ALEXHOST SRL | ‐ | |
| www.mshelp06.info | ALEXHOST SRL | ‐ | |
| www.mshelp02.info | ALEXHOST SRL | ‐ | |
| www.bdcare.live | ALEXHOST SRL | ‐ | |
| www.mshelp18.info | ALEXHOST SRL | ‐ | |
| help02.cc | ALEXHOST SRL | ‐ | |
| www.mhelp24.live | ALEXHOST SRL | ‐ | |
| mshelp03.info | ALEXHOST SRL | ‐ | |
| mshelp14.info | ALEXHOST SRL | ‐ | |
| www.mshelp07.info | ALEXHOST SRL | ‐ | |
| nochelp.live | ALEXHOST SRL | ‐ | |
| www.abhelp.live | ALEXHOST SRL | ‐ | |
| www.bscare.info | ALEXHOST SRL | ‐ | |
| abhelp.live | ALEXHOST SRL | ‐ | |
| www.mshelp12.info | ALEXHOST SRL | ‐ | |
| www.mshelp14.info | ALEXHOST SRL | ‐ | |
| www.w2help.live | ALEXHOST SRL | ‐ | |
| www.help01.cc | ALEXHOST SRL | ‐ | |
| mshelp12.info | ALEXHOST SRL | ‐ | |
| www.nochelp.live | ALEXHOST SRL | ‐ | |
| www.mshelp04.info | ALEXHOST SRL | ‐ | |
| www.zxcare.live | ALEXHOST SRL | ‐ | |
| www.ihelp24.live | ALEXHOST SRL | ‐ | |
| mshelp18.info | ALEXHOST SRL | ‐ | |
| www.mshelp09.info | ALEXHOST SRL | ‐ | |
| mihelp.info | ALEXHOST SRL | ‐ | |
| akhelp.info | ALEXHOST SRL | ‐ | |
| www.rcare.live | ALEXHOST SRL | ‐ | |
| mshelp20.info | ALEXHOST SRL | ‐ | |
| cshelp19.live | ALEXHOST SRL | ‐ | |
| rcare.live | ALEXHOST SRL | ‐ | |
| mshelp17.info | ALEXHOST SRL | ‐ | |
| mshelp04.info | ALEXHOST SRL | ‐ | |
| mshelp07.info | ALEXHOST SRL | ‐ | |
| www.mshelp05.info | ALEXHOST SRL | ‐ |
Added:
https://www.mshelp19.info
https://w2help.live
https://www.abhelp.info
https://help01.cc
https://mshelp06.info
https://www.help02.cc
https://bdcare.live
https://mshelp08.info
https://www.cphelp.live
https://mshelp05.info
https://www.mshelp15.info
https://www.mshelp13.info
https://www.mshelp11.info
https://mshelp09.info
https://www.mshelp16.info
https://www.rclaim.online
https://mshelp19.info
https://mshelp11.info
https://www.mshelp08.info
https://www.bdcare.info
https://ihelp24.live
https://www.mshelp20.info
https://mshelp15.info
https://www.bshelp.support
https://cshelp17.live
https://abhelp.info
https://mshelp16.info
https://www.cshelp17.live
https://www.mshelp17.info
https://bdcare.info
https://mshelp13.info
https://mhelp24.live
https://mshelp02.info
https://www.mshelp06.info
https://www.mshelp02.info
https://www.bdcare.live
https://www.mshelp18.info
https://help02.cc
https://www.mhelp24.live
https://mshelp03.info
https://mshelp14.info
https://www.mshelp07.info
https://nochelp.live
https://www.abhelp.live
https://www.bscare.info
https://abhelp.live
https://www.mshelp12.info
https://www.mshelp14.info
https://www.w2help.live
https://www.help01.cc
https://mshelp12.info
https://www.nochelp.live
https://www.mshelp04.info
https://www.zxcare.live
https://www.ihelp24.live
https://mshelp18.info
https://www.mshelp09.info
https://mihelp.info
https://akhelp.info
https://www.rcare.live
https://mshelp20.info
https://cshelp19.live
https://rcare.live
https://mshelp17.info
https://mshelp04.info
https://mshelp07.info
https://www.mshelp05.info
https://sub.verify.czechia.competentshockley.193233203146.plesk.page
https://www.rkhelp.us
https://www.rkhelp.live
https://heuristicalbattani.193233203146.plesk.page
https://rbcare.info
https://rscare.info
https://www.rscare.online
https://rkhelp.info
https://nortn.live
https://rbcare.online
https://www.jpcare.info
https://www.uvcare.live
https://rbcare.us
https://www.mfhelp.live
https://www.rshelp.us
https://rshelp.live
https://jpcare.info
https://www.optimisticpike.193233203146.plesk.page
https://wtcare.live
https://www.rkhelp.cc
https://www.rkhelp.online
https://uvcare.live
https://rscare.cc
https://www.rbcare.live
https://rshelp.info
https://www.rbcare.info
https://brhelp.info
https://wtcare.info
https://www.brhelp.info
https://www.helpsystem.info
https://rkhelp.online
https://www.rshelp.info
https://jxhelp.live
https://www.rshelp.cc
https://pp247.live
https://netfx.live
https://rscare.help
https://cshelp13.live
https://optimisticpike.193233203146.plesk.page
https://www.rbcare.online
https://www.cashapphelp011.live
https://www.wtcare.info
https://www.rscare.cc
https://mfhelp.live
https://helpsystem.info
https://www.rbcare.us
https://verify.czechia.ntx.optimisticpike.193233203146.plesk.page
https://www.rshelp.live
https://charmingshamir.193233203146.plesk.page
https://competentshockley.193233203146.plesk.page
https://rbcare.live
https://www.rscare.info
https://www.competentshockley.193233203146.plesk.page
https://www.rscare.live
https://rkhelp.live
https://rscare.live
https://rkhelp.cc
https://www.nortn.live
https://rshelp.us
https://193233203146.plesk.page
https://www.rkhelp.info
https://rscare.online
https://hungrydubinsky.193233203146.plesk.page
https://www.cashapphelp105.info
https://rkhelp.us
https://www.wtcare.live
https://ms4care.live
https://rshelp.cc
https://www.rscare.help
https://www.ms4care.live
2 Likes
So AlexHost is hosting ALL the above CW Sites I just listed, all these domains point at these 2 servers:
| IP Addresses | Organization | First Seen | Last Seen | Duration Seen |
|---|---|---|---|---|
| 193.233.203.146 | ALEXHOST SRL | 2024-02-14 (4 months) | 2024-02-26 (3 months) | 12 days |
| 213.232.235.244 | ALEXHOST SRL | 2024-02-11 (4 months) | 2024-02-14 (4 months) | 3 days |
https://alexhost.com/ is personally facilitating these scammer’s ability to steal from victims and keep 24/7 access to victims computers. I made reports in the past to this host and I see some of the same domains.
Almost every CW site that I find is hosted by AlexHost or https://screenconnect.connectwise.com/ themselves. what a horrible situation, hopefully, this is all worth the money on AlexHost’s side and the many business partners CW has on their side to develop this software for.
Domains are usually hosted by https://www.namesilo.com/.
2 Likes
Correct, these IP’s matches the list I posted before about some hosts that host CW sites, AlexHost is a big part of it:
213.232.235.244 host01 Alexhost
37.221.67.16 host06 Alexhost
79.124.40.39 ip-40-39.4vendeta.com Tamatiya
193.233.203.146 host05 Alexhost
193.233.203.208 host03 Alexhost
141.11.95.129 IPXO
79.124.60.189 ip-60-189.4vendeta.com Tamatiya
85.239.34.90 mic02 Alexhost
89.37.197.244 IPXO
37.221.67.53 alex06 Alexhost
159.253.120.215 mic03 Alexhost
88.214.23.125 Virmach
85.239.33.5 host04 Alexhost
172.98.14.153 Virmach
185.255.122.67 BeeHosted
193.233.202.124 host02 Alexhost
Also, the system behind these domains, is an old version of a new system I found yesterday behind these scammers: Netflix support scam (844) 200-2106 - #2 by bobbes
This system partially uses the same route-names and regarding selecting themes and configuring CW-domains, works the same as the old system, on which I could identify it. Not sure yet if this is the same group that uses it, or if it is just an internal system that is being sold between groups. I’ll keep monitoring it for all the domains added to this list.
1 Like
https://fwshelp.live/ active today and
https://srna.site
1 Like
Added to the list @southerculture – Thanks mate! 
1 Like
https://carewise.live (active and using by fake Norton scammers)
1 Like
https://secureapp.me Delhi Tech scammers today
2 Likes
https://newcontrol.ctrlx1.ru:8443/
Fake Geek Squad from Patna/Kolkata and Hyderabad,
The Patna IP is using a VPN I think…
1 Like
Pdhelp.org is a ConnectWise page
Rescanned the domains, added a new condition to it, to also support 3 characters, based on new domains added here.
Good news? Most AlexHost websites I shared before are gone.
Bad news? A lot of new domains popped up scanning with 3 characters.
All domains with the title “Support” having an input for a ConnectWise code.
Mostly on 2 IP addresses. Both hosted by… drumrolllll… AlexHost.
This time not Moldova, but The Netherlands.
SR, I have their system (the new version, Laravel) too, if you want it to investigate it.
| ephelp.cc | 93.185.167.129 |
|---|---|
| wccare.cc | 159.253.120.215 |
| s2help.cc | 159.253.120.215 |
| avhelp.info | 159.253.120.215 |
| fscare.help | 193.233.203.187 |
| bscare.info | 213.232.235.244 |
| bdcare.live | 213.232.235.245 |
| zxcare.live | 213.232.235.246 |
| dpcare.info | 159.253.120.215 |
| wccare.info | 159.253.120.215 |
| wccare.live | 159.253.120.215 |
| dpcare.live | 159.253.120.215 |
| kthelp.top | 91.92.247.175 |
| kuhelp.top | 91.92.247.176 |
| kfhelp.top | 91.92.247.177 |
| pohelp.top | 91.156.65.19 |
| ppcare.online | 159.253.120.215 |
| abhelp.live | 213.232.235.244 |
| avhelp.info | 159.253.120.215 |
| dkhelp.info | 159.253.120.215 |
| dkhelp.live | 159.253.120.215 |
| eehelp.live | 93.185.167.129 |
| fthelp.live | 159.253.120.215 |
| wchelp.live | 159.253.120.215 |
| kprcare.live | 93.185.167.129 |
| pypal.live | 93.185.167.129 |
| wsihelp.live | 93.185.167.129 |
| fpkcare.live | 193.27.90.71 |
| gfgcare.live | 93.185.167.129 |
| grdcare.live | 193.27.90.71 |
| gwscare.live | 93.185.167.129 |
| hppcare.live | 93.185.167.129 |
| ioscare.live | 93.185.167.129 |
| itwcare.live | 93.185.167.129 |
| kijcare.live | 93.185.167.129 |
| kjicare.live | 93.185.167.129 |
| kprcare.live | 93.185.167.129 |
| kytcare.live | 193.27.90.71 |
| ljpcare.live | 193.27.90.71 |
| lpkcare.live | 193.27.90.71 |
| ltxcare.live | 93.185.167.129 |
| poicare.live | 93.185.167.129 |
| rbhcare.live | 93.185.167.129 |
| rcdcare.live | 193.27.90.71 |
| rdecare.live | 93.185.167.129 |
| sdgcare.live | 193.27.90.71 |
| sedcare.live | 93.185.167.129 |
| sepcare.live | 93.185.167.129 |
| slocare.live | 193.27.90.71 |
| specare.live | 193.27.90.71 |
| stbcare.live | 193.27.90.71 |
| tcvcare.live | 93.185.167.129 |
| tiucare.live | 93.185.167.129 |
| tjpcare.live | 93.185.167.129 |
| vchcare.live | 193.27.90.71 |
| wbdcare.live | 193.27.90.71 |
| wescare.live | 93.185.167.129 |
| wsucare.live | 93.185.167.129 |
| wutcare.live | 193.27.90.71 |
| bgtcare.live | 193.27.90.71 |
| dqacare.live | 193.27.90.71 |
| alphelp.live | 193.27.90.71 |
| ardhelp.live | 193.27.90.71 |
| avshelp.live | 93.185.167.129 |
| bkthelp.live | 93.185.167.129 |
| brxhelp.live | 93.185.167.129 |
| bvdhelp.live | 193.27.90.71 |
| ckhhelp.live | 193.27.90.71 |
| cpehelp.live | 193.27.90.71 |
| csrhelp.live | 93.185.167.129 |
| dcxhelp.live | 93.185.167.129 |
| dfahelp.live | 193.27.90.71 |
| doehelp.live | 193.27.90.71 |
| dphhelp.live | 193.27.90.71 |
| dprhelp.live | 193.27.90.71 |
| ebshelp.live | 93.185.167.129 |
| erghelp.live | 193.27.90.71 |
| esthelp.live | 193.27.90.71 |
| fdyhelp.live | 93.185.167.129 |
| frxhelp.live | 93.185.167.129 |
| ftehelp.live | 93.185.167.129 |
| futhelp.live | 193.27.90.71 |
| fwshelp.live | 193.27.90.71 |
| gdrhelp.live | 193.27.90.71 |
| htrhelp.live | 193.27.90.71 |
| htwhelp.live | 93.185.167.129 |
| jpkhelp.live | 93.185.167.129 |
| jsdhelp.live | 193.27.90.71 |
| juihelp.live | 193.27.90.71 |
| klthelp.live | 193.27.90.71 |
| klwhelp.live | 93.185.167.129 |
| kphhelp.live | 93.185.167.129 |
| kwshelp.live | 93.185.167.129 |
| kyfhelp.live | 193.27.90.71 |
| lqzhelp.live | 93.185.167.129 |
| ltshelp.live | 93.185.167.129 |
| njdhelp.live | 93.185.167.129 |
| nrxhelp.live | 193.27.90.71 |
| pkohelp.live | 193.27.90.71 |
| qpthelp.live | 93.185.167.129 |
| rtuhelp.live | 93.185.167.129 |
| udyhelp.live | 193.27.90.71 |
| ufshelp.live | 193.27.90.71 |
| unjhelp.live | 93.185.167.129 |
| vgdhelp.live | 93.185.167.129 |
| wdphelp.live | 193.27.90.71 |
| wedhelp.live | 193.27.90.71 |
| wsihelp.live | 93.185.167.129 |
| wsohelp.live | 193.27.90.71 |
| wswhelp.live | 93.185.167.129 |
| xhrhelp.live | 193.27.90.71 |
| zxrhelp.live | 93.185.167.129 |
2 Likes
Added to this list
https://token24.life/ / https://drbm.info:8443/ (from Stream)
2 Likes
https://s3699.mukutukula.cyou:8443/guest (iframe from https://CYHELP.TOP )
https://ghbd.link:8443/ (iframe from http://mnkd.info/ )
1 Like