Fake Norton Scammers

Scams
1

OFFICESETUPEXPERT.XYZ has a chat box

GoDaddy are the Registrar and Host and they have a ‘whois proxy’

image officesetupexpertxyzpng.png</s>image officesetupexpertxyzpng.png<e>
2

845×601 23.4 KB

what my antivirus says!
3

Hey, found this in the website’s source:

If you face any problem during installing Call USA/Canada 1-888-254-4408 United Kingdom +44-0808-234-2376 Australia 61-1-800-875-269 ,

Those numbers are active as of 06/07/19:13:04(GMT)
Have fun!

Edit: in addition to this, the malicious form sends the data to "http://officesetupexpert.xyz/n.php" - when I used cURL to try and see what it does, I got this:

``` <b>Notice</b>: Undefined index: name in <b>/home/vw40a8yt6unk/public_html/n.php</b> on line <b>2</b><br /> <br /> <b>Notice</b>: Undefined index: txtName in <b>/home/vw40a8yt6unk/public_html/n.php</b> on line <b>3</b><br /> <br /> <b>Notice</b>: Undefined index: txtNumber in <b>/home/vw40a8yt6unk/public_html/n.php</b> on line <b>4</b><br /> <br /> <b>Notice</b>: Undefined index: key in <b>/home/vw40a8yt6unk/public_html/n.php</b> on line <b>5</b><br /> ```

In my opinion, the "/home/vw40a8yt6unk/" tells us that the website's 'name' is vw40a8yt6unk but there isn;t much we can do with that.