Email From: [email protected] (Mauricio Sierra)
Scam Number: (803) 843-8027
Carrier: AT&T
Callback Number: (828) 574-3649 (Microsoft Teams)
Call Center Location: India 
Answers as: “Helpdesk” or “Amazon”
Technician: “Dave Ross/Mike Watson”
Remote Access Software: UltraViewer (ID: 205139117/DESKTOP-G714VJR, 204568449/LAPTOP-IHO7O3A6, 46537016/LAPTOP-DV55KMQ), Zoho Assist (Technician: [email protected]) and ConnectWise from thecyberphoenixllc.screenconnect.com (Version: 25.9.12.9552 User: Ingrid C. Davis)
Once remotely connected to my virtual machine, the incredibly-braindead “Dave Ross” attempted to run the runbox and task manager to no avail before opening the “event viewer” so he can falsely claim my device was infected with 57 “malwares” whilst a coworker remotely connected to my virtual machine from their laptop.
- “Dave” then downloaded Zoho Assist and ConnectWise from thecyberphoenixllc.screenconnect.com in order to “connect” me to their “secure server” before having me fill out a “McAfee Resolution Form” that also required me to provide my device pin, credit card details and SOCIAL SECURITY NUMBER, but not submit it until he’s had a look at the details.
- Once the form is submitted, “Dave” wanted me to log into my nonexistent bank account on the ground that I had “made a mistake” by saying my fake bank was in-person only. I told him the information was correct, and he opted to hang up on me so I can then receive a call from his “refund manager.”
- “Dave” then called me back under the identity of “Mike Watson” and once again asked me to log into my nonexistent bank account on the grounds that “every bank registered with the FDIC has a website”
- “Mike” then threatened to sue me in court if I said “fucking” once more, clearly not understanding my speech was fucking protected under the 1st Amendment of the United States Constitution, then proceeded to clear my browser and download history and ask if I was using a virtual machine.
- I was able to tell “Mike” that I wasn’t using a virtual machine, then he proceeded to ask if I do online banking once more, proving how much of a fucking broken record he is, before calling me a “blind, idiotic motherfucker”
The scammers falsely claim to operate out of an apartment in Raleigh, North Carolina as “The Cyberphoenix, LLC”. Though they list the RingCentral line (888) 711-5308 as a contact number, calls are transferred to a random Magic Jack customer.
Through the contents of their “cyberphoenix” website, I was able to trace their operations back to Brookshield E-Processing Services Private Limited out of Kolkata, West Bengal. The company is operated by Swarup Madhu (DIN: 08795860) and Subhajkit Chakraborty (DIN: 07308878), who are also listed as directors of
- Globetrotters Family Private Limited, which shares the same address as Brookshield
- Geekyogi Technologies Private Limited, which operates out of the Webel IT Park in Palashdiha, Industrial Area, Durgapur, West Bengal 713208, India.
Associated LinkedIn Account - https://www.linkedin.com/company/geekyogi-technologies/
Associated Phone Number: +91 74395 70538
Associated Email Addresses