Transaction date: Wednesday, March 26, 2025
Transaction number: WM5609PQ
Customer support: +1.888.370.7642
Dear
Thank you for shopping with Amazon! Your order has been successfully processed, and your invoice is attached for your convenience.
Order Details:
Items Purchased: Apple Fitness+ (fitness subscription)
Order Number: WM5609PQ
Order Date: Wednesday, March 26, 2025
Payment Method: Credit Card
Total Amount: $1485.99
For any questions or assistance, please reach out to Amazon Customer Support or call +1.888.370.7642.
Thank you for choosing Amazon!
Best regards,
Amazon Customer Service Team
Carrier: RingCentral
Call Center Location: Kolkata, West Bengal India 
Answers as: “Suppoat team of Geek Squad” or “Amazon”
Technician: “James”
Falsely Claims: Identity theft
Remote Access Software: ConnectWise from help94.top (Code: 7651234), an iFrame of drxhelp.top
Once remotely connected to my virtual machine, “James” blanked my screen with a fake software update while he brought up their “Microsoft cancellation form.”
- I refused to fill out their “cancellation form” and the bhenchods became too invasive to provide “suppoat,” going as far as to repeatedly call me a “motherfucker” and an “asshole”
They use a website (https://www.help94.top/) to download the remote software (code they used was 27VT53M). Here is a link to the EXE it downloads if your interested (https://www.dropbox.com/scl/fi/bqy6pqqs9f9iy0jnokwjj/support.Client.exe?rlkey=eembzwyrfwakk5wtyvwtqwwv5&st=lu1yjwdg&dl=0)
Doing a bit more digging, it appears they are from West Bengal India based on the WhoIs data from that help94.top site… I am shocked they are dumb enough to use their actual info when registering the domain lol!
