Phishing/tech support scam for 3d printing device (?) 609-710-4069, 786-946-2540

Scam Number: 609-710-4069, 786-946-2540
Scammer’s Website or Email: cricut.com setup

which links to

https://cricutdesignspace.online/en_us/setup.php

Additional information about this scam: This seems to be a similar process to the banking/crypto impersonation scams I’ve been tracking here, not sure if it is actually the same criminal group. They are impersonating https://cricut.com/ , which seems to be some consumer-grade fabrication robotics device for arts & crafts stuff?

Anyway I complied with their phishing and got two callbacks from “Zacob” (or Jacob?) whose favorite color is black.

The phishing site does prompt you to download a Windows executable file. I am working on sifting through its text strings for any clues but would not recommend running it obviously.

Tawk.to text chat: https://tawk.to/chat/64900e4acc26a871b023620c/1h39bfl6t .

Mike called from 609-710-4069 after the chat, above. His favorite color is black.

Edit: checked on 786-946-2540 today reached “Marcus” whose favorite color is “dark yellowish brown,” (burnt umber perhaps? does Marcus enjoy the fall foliage season?).

Answers a generic “Thanks for calling how may I help you,” so I suspect the call center runs many similar scams and relies on the victim to tell them which way he/she wants to be scammed.

Edit 2: 786-946-2540 “Kelvin Morrow” says this is “printer support.” Says he is “not here to talk about” his favorite color.

I know this guy is a scammer so I scared the s*** out of him
why my buddies gave me all his information
he gave me pictures of where he’s located

Update: got an email on my honeypot address:

which links to the phishing domain cricut ,

which guides the victim to the very cute error page here: Cricut Error

Phone number from the contact page: 786-866-5932 .

I called and reached Dan D-A-N, Howmahalpyou who said that his favorite color is black (and that Cricut is pronounced like the insect, cricket. Thanks Dan D-A-N!)

hmm, same U.S. and UK phone numbers, links to a lot of SEO “content” featuring the phone numbers – quite an elaborate production for one product.

Edit: some accounts of this scam going back at least a year

https://www.reddit.com/r/cricut/comments/zs6rl2/the_scammers_are_back_at_it_as_tech_support_for/

On the same IP address as mannymaker.com and cricutdesignmachine.com , we find the very cleverly named phishing website

https://canňon.com/ , which uses a similar wordpress template. This may all be a coincidence – there are hundreds of domain names that point to that IP address, or it might not.

This page links to Canon : Official Manuals : Welcome!

which inevitably leads the victim to the “error” page

Does it have a tawk.to web chat widget? Of course it does!

https://tawk.to/chat/6544f507f2439e1631eb6185/1healq9oi

Update: I’m chatting with Jack.

Mikey from Canon Printer Support: 508-501-4138.
And “Grampus” (?) whose favorite color is yellow: 617-545-0933.

Another number: Marcus from Cricut 716-419-9456. His favorite color is “dark black.”