HIGHLIGHTS FROM VIRTUAL MACHINE BAIT:
- The scammer will claim you were automatically subscribed to a free Geek Squad membership from Walmart, Best Buy or your ISP and that it was automatically upgraded to their “premium plan.” In order to “cancel,” you are asked to “open the Google Chrome” and go to bit.ly/GeekSquadAssist (pvetkvlwjuehb0koq5jmgg.on.drv.tw)
- Since their website wasn’t working, I was asked to go to Encurtador de Link, which too didn’t work, then UltraViewer (ID: 69301224) to “connect to the secure server.” They then tried to go to bit.ly/GeekSquadAssist from my virtual machine to no avail.
- The scammer then had me fill out a “cancellation form,” where they claim is under the “supervision and regulation of the Better Business Bureau and the Attorney General.” Once complete, I am asked to write down my “refund ID (GEEK9337860)” and “Billing Manager Code (BMG30786)” before transferring my call to a “billing manager, Ramsay Russell.”
- “Ramsay” called from his Magic Jack line, (214) 501-6597 and had me go to bbborglive.weebly.com so they can claim they are “affiliated with the Better Business Bureau” and have me download their ScreenConnect client from “refund 1” and have me fill out a “verification form.”
- Once complete, “Ramsay” will have me log into my nonexistent bank account. Since I don’t do online banking, he asked me to temporarily enroll for a new account, so I then played him the bhenchod song.
The website they used was https://pvetkvlwjuehb0koq5jmgg.on.drv.tw/Geeksquad/Start.html
Their “cancellation form” claims they operate out of Waterloo, Iowa with the TextNow line (417)-212-2127 as their contact number.
Their fake BBB website lists two separate ConnectWise download links and always redirects users to Chase.
- Support (rns1backns.site), with an IP address of 213.232.235.73

- Support (mycoffeehouse.site), with an IP address of 94.103.188.49


