There are several sites scammers use with multiple uses, remote software such as anydesk, ultraviewer, etc. Also, this one today is in use by PayPal, Norton, McAfee, Geek Squad, all with cancellation forms to each group: https://cancel.webnode.page/
6 Me gusta
Here’s another remote link to softwares: https://updateaccountsecurity.com/
4 Me gusta
3 Me gusta
3 Me gusta
https://cancelmyordernow.com/ has links to anydesk and https://www.gthelp247.top/
2 Me gusta
Cancellation and Refund Portal , links to anydesk 6.3, screenconnect.exe, the url they have you type is bitly.cx/paypalsupport
3 Me gusta
3 Me gusta
https://4help.site/ links to ultraviewer, anydesk, connectwise, as well as apple computers and chromebook.
2 Me gusta
https://www.gthelp247.top/ is down.
3 Me gusta
https://globalgeekshop.org/ (various links to ConnectWise, ultraviewer, alphemix, awesun, supremo)
4 Me gusta
https://150.co.il/ Hebrew website with links to: rustdesk.com, teamviewer.com, anydesk.com, aero-admin, iperiousremote.com, logmein.com
4 Me gusta
3 Me gusta
https://paypalconnected.com goes to https://login.cppllog2356.top/guest (screenconnect)
(already posted by @SouthernCulture_x Taking out ConnectWise sites - #1491 by SouthernCulture_x)
2 Me gusta
interesting catch.
I found 2 more via urlscan
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://appletechnician.com/ | Name.com, Inc. | 2025-12-24 |
| https://appleitsupport.com/ | Name.com, Inc. | 2025-12-24 |
both redirecting to
https://login.cppllog2356.top/guest as well
2 Me gusta
@SouthernCulture_x I imagine they would use that to send to victims to easily download the software, as opposed to getting them to type some (potentially) long URL, they can just type a short URL.
2 Me gusta
@dubloox3 Both Apple sites return Not Found. It seems like the JS on cpplog2365.top isn’t working, the Go button stays disabled.
1 me gusta
Yep, I think that’s the point with these links. If you find any new links please post.
https://ltr123.com/windows.html Another interesting site in use by popup scammers with links to multiple remotes. here’s a screenshot:
4 Me gusta
https://geminisecurity.net/ (Fake PayPal using this site, links to ConnectWise, Anydesk.
here’s the link to connectwise: https://login.cppllog2356.top/guest here’s a screenshot of the site.
2 Me gusta
nice, found a clone via urlscan (same connectwise link)
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://geminitransfer.com/ | Name.com, Inc. | 2026-01-05 |
1 me gusta