John from fake Wells Fargo can be reached at his Google Voice line 818-869-4844. His favorite color is red.
Google Sites page Wells Fargo Login – Secure Access to Accounts | Official Site links to
https://rebrand.ly/welfaroo , which redirects to
Log In , with fake error page
Error .
with tawk.to web chat account https://tawk.to/chat/69e8f4062764511c3261cb87/1jmqvifdk?pop=1
Sort of similar operation to these PayPal sites: Fake PayPal https://thakral.vercel.app/ .
The domain registration info is not redacted:
Roles:
Contact:
kind: individual
Name: Nick
Org: Nick
Address:
,New Push,J023
Delhi
Delhi
110083
Email: [email protected]
Tel: +91.9838483829 (voice)
Another site with the same domain registrar just came to my attention
https://sites.google.com/loginns1.com/venmo-login/ links to https://rebrand.ly/vennolog , which redirects to https://venmlog.info/log/ , with the fake error page https://venmlog.info/err/ .
Associated tawk.to web chat account https://tawk.to/chat/69eb6ead7c1b241c32bf65b8/1jmvqglt4?pop=1 .
On the same IP address:
I suspect that there are many Google Voice numbers for this group, and I would guess that they are mostly used for outbound calls.
I suspect that if you bait the scammers through the chat and the initial Google Voice callback more seriously than I tend to do (verifying their favorite color, etc…) you could uncover more valuable inbound phone numbers or other information.
Update: Eric William from Venmo Support can be reached at 857-232-8537 (Neutral Tandem). He refused to verify his favorite color.
Another phishing domain registered to the same account, this time impersonating Capital One Bank: https://rebrand.ly/cd42b7 redirects to Capital One Login, with fake error page Error! and tawk.to web chat account https://tawk.to/chat/698a2a7bc060e01c37489666/1jh1rbtfo?pop=1 .
Number is still active, Sam This Side from Wells Fargo. His favorite color is black.
After I reported their redirector/shortener URL at rebrand.ly, the scammers switched to another URL shortener service, https://dub.sh/wellsfalog . I am attempting to get this one shut down too.
