There are several sites scammers use with multiple uses, remote software such as anydesk, ultraviewer, etc. Also, this one today is in use by PayPal, Norton, McAfee, Geek Squad, all with cancellation forms to each group: https://cancel.webnode.page/
6 Synes om
Here’s another remote link to softwares: https://updateaccountsecurity.com/
4 Synes om
3 Synes om
3 Synes om
https://cancelmyordernow.com/ has links to anydesk and https://www.gthelp247.top/
2 Synes om
Cancellation and Refund Portal , links to anydesk 6.3, screenconnect.exe, the url they have you type is bitly.cx/paypalsupport
3 Synes om
3 Synes om
https://4help.site/ links to ultraviewer, anydesk, connectwise, as well as apple computers and chromebook.
2 Synes om
https://www.gthelp247.top/ is down.
3 Synes om
https://globalgeekshop.org/ (various links to ConnectWise, ultraviewer, alphemix, awesun, supremo)
4 Synes om
https://150.co.il/ Hebrew website with links to: rustdesk.com, teamviewer.com, anydesk.com, aero-admin, iperiousremote.com, logmein.com
4 Synes om
3 Synes om
https://paypalconnected.com goes to https://login.cppllog2356.top/guest (screenconnect)
(already posted by @SouthernCulture_x Taking out ConnectWise sites - #1491 by SouthernCulture_x)
2 Synes om
interesting catch.
I found 2 more via urlscan
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://appletechnician.com/ | Name.com, Inc. | 2025-12-24 |
| https://appleitsupport.com/ | Name.com, Inc. | 2025-12-24 |
both redirecting to
https://login.cppllog2356.top/guest as well
2 Synes om
@SouthernCulture_x I imagine they would use that to send to victims to easily download the software, as opposed to getting them to type some (potentially) long URL, they can just type a short URL.
2 Synes om
@dubloox3 Both Apple sites return Not Found. It seems like the JS on cpplog2365.top isn’t working, the Go button stays disabled.
1 Synes om
Yep, I think that’s the point with these links. If you find any new links please post.
https://ltr123.com/windows.html Another interesting site in use by popup scammers with links to multiple remotes. here’s a screenshot:
4 Synes om
https://geminisecurity.net/ (Fake PayPal using this site, links to ConnectWise, Anydesk.
here’s the link to connectwise: https://login.cppllog2356.top/guest here’s a screenshot of the site.
2 Synes om
nice, found a clone via urlscan (same connectwise link)
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://geminitransfer.com/ | Name.com, Inc. | 2026-01-05 |
1 Synes om