“Thank you for calling support, this is David. How can I help you?”
Scammer will claim your computer was infected by a virus, prompting you to connect to the “Microsoft Secure Server” by signing out and turning off your computer. You are then asked to provide your name and ZIP code, then run https://www.pchelp123.org/ with the code 14286.
Registered via Sav.com on Cinco de Mayo, 2023 (Updated May 10, 2023) - Whois pchelp123.org
pchelp123.org is an iframe of Secure Support Server (13001.ru)
Registered by a private person in the Russian Federation via R01-RU on May 22, 2023 - Whois 13001.ru
Associated IP Address - 45.227.255.41
*OTHER DOMAINS HOSTED ON THE IP ADDRESS:
- sup2.13001.ru
- control.ctrl02.ru
- sup2.12001.ru
- sup2.supos911.org
- control.ctrl10.pw
- sup2.supos123.org
- sup2.10239.org
- sup2.70701.org
- 45.277.255.41
- axemorketr.com
- casmater.com
- acinetow.com
Attempted callback from (406) 719-8635
and (512) 859-4611
