There are several sites scammers use with multiple uses, remote software such as anydesk, ultraviewer, etc. Also, this one today is in use by PayPal, Norton, McAfee, Geek Squad, all with cancellation forms to each group: https://cancel.webnode.page/
6 Mi Piace
Here’s another remote link to softwares: https://updateaccountsecurity.com/
4 Mi Piace
3 Mi Piace
3 Mi Piace
https://cancelmyordernow.com/ has links to anydesk and https://www.gthelp247.top/
2 Mi Piace
Cancellation and Refund Portal , links to anydesk 6.3, screenconnect.exe, the url they have you type is bitly.cx/paypalsupport
3 Mi Piace
3 Mi Piace
https://4help.site/ links to ultraviewer, anydesk, connectwise, as well as apple computers and chromebook.
2 Mi Piace
https://www.gthelp247.top/ is down.
3 Mi Piace
https://globalgeekshop.org/ (various links to ConnectWise, ultraviewer, alphemix, awesun, supremo)
4 Mi Piace
https://150.co.il/ Hebrew website with links to: rustdesk.com, teamviewer.com, anydesk.com, aero-admin, iperiousremote.com, logmein.com
4 Mi Piace
3 Mi Piace
https://paypalconnected.com goes to https://login.cppllog2356.top/guest (screenconnect)
(already posted by @SouthernCulture_x Taking out ConnectWise sites - #1491 by SouthernCulture_x)
2 Mi Piace
interesting catch.
I found 2 more via urlscan
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://appletechnician.com/ | Name.com, Inc. | 2025-12-24 |
| https://appleitsupport.com/ | Name.com, Inc. | 2025-12-24 |
both redirecting to
https://login.cppllog2356.top/guest as well
2 Mi Piace
@SouthernCulture_x I imagine they would use that to send to victims to easily download the software, as opposed to getting them to type some (potentially) long URL, they can just type a short URL.
2 Mi Piace
@dubloox3 Both Apple sites return Not Found. It seems like the JS on cpplog2365.top isn’t working, the Go button stays disabled.
1 Mi Piace
Yep, I think that’s the point with these links. If you find any new links please post.
https://ltr123.com/windows.html Another interesting site in use by popup scammers with links to multiple remotes. here’s a screenshot:
4 Mi Piace
https://geminisecurity.net/ (Fake PayPal using this site, links to ConnectWise, Anydesk.
here’s the link to connectwise: https://login.cppllog2356.top/guest here’s a screenshot of the site.
2 Mi Piace
nice, found a clone via urlscan (same connectwise link)
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://geminitransfer.com/ | Name.com, Inc. | 2026-01-05 |
1 Mi Piace