Suspected Network of Support Scams (Carreto Corona Armando)

I hope this isn’t a duplicate of someone’s prior research!

Keyword searching for "gmail support" found me this website:, which has the hallmarks of a fake tech support team.

Whois returned this information:
Street:W Valley Hwy S #13
Postal Code:98001
Email:[email protected]

The address given is that of Yahn & Son Funeral Home and Crematory on Google Maps.

A reverse whois lookup found three other domains under Carreto Corona Armando: (online) (online) (account suspended)

Whois on reveals a different phone and email:
Email:[email protected] gives a different phone number, multiple emails, and three new domains (all online):
Phone: +1.8889028333
Email: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] - Email Technical Support +1-855-258-6664 Mail Support, Daily visitors: 534, Keywords: roadrunner email, Email Support, email tech support, email customer service, email customer support, email technical support, road... - Epson Printer Support Number +1-800-699-3341 - Epson Support, Daily visitors: 534, Keywords: epson printer support, epson support number, 0x97 fix patch, epson support phone number, epson printer error 0xf4, epson 0x97 fix ... - Get Help & Printer Support from Experts, Keywords: printer offline fix, printer is offline

The most valuable email is [email protected] - there are many women named Pavneet Kaur but it's probably worth investigating.

Domain dump:

Alleged registrant numbers of Carreto Corona Armando:
+1.8338826888, +1.7708739555, +1.7708739556, +1.8884567234, +1.8006993341, +1.8889028333

Alleged emails:
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

And of course, support numbers (by domain):
Emailsupport (no numbers)
+1 650 857 1501 (US)
+44 207 660 0403 (UK)
+1 877 231 4351 (CA)
+1 800 652 2666 (US, CA)
+1 860 180 3366 (INDIA)
+1 800 474 6836 (UK)
+1 587 600 3145
+1 800 463 7766 (US)
0343 903 7766 (UK, ?)
+1 800 425 0011 (CA)
Printersupportpro: (no numbers)

I haven't tried the numbers myself, and Pavneet Kaur deserves closer attention.

That is a Punjabi Indian female name

[email protected]

1-888-653-9471 active today Saturday

The following numbers are currently being call flooded: “9471” - “2666” - “6836” - “7766” - “0011”

----- Thank you so much :)

Update: Some excellent work on had already happened here:

My research checks out with theirs, and they name some domains I hadn’t found. I’m not sure whether they are actually related to Carreto Corona Armando (all private WHOIS information):

In fact, this thread from 2019 seems to have exposed the group and some of its members!
These guys have been around for at least 3 years and are still kicking. If the people/group are the same, (maybe it's the "new generation") it warrants a proper reporting effort (at the very least).

Playing around with the domain names I found earlier, I found more which are exactly the same with ".net" or ".com" instead of ".us". I have good reason to believe they are by the same group:
All the WHOIS information on these is private, so perhaps the scammers got smart before registering these nearly identical domains.

I did some further digging and found more fraudulent-looking websites hosted on the same IPs (using

Numbers: +1 650 857 1501 (same number as .us),,, +1 888 653 9471 (same number found by @drwat) +1 866 978 6159 +1 972 924 0308 +1 888 584 5373 +1 888 510 0507

Again, I have not tried the numbers myself.
This is an elaborate and longstanding operation; refer to the two threads mentioned above and pay them credit. What's the next step?

Server Ip:

22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 2048 c7:27:62:f2:66:05:89:44:06:fe:fe:98:43:b7:88:ca (RSA)

80/tcp open http Apache httpd 2.4.29 ((Ubuntu))

http-server-header: Apache/2.4.29 (Ubuntu)

|http-title: Did not follow redirect to

443/tcp open ssl/ssl Apache httpd (SSL-only mode)

http-server-header: Apache/2.4.29 (Ubuntu)

|http-title: Did not follow redirect to

| ssl-cert: Subject:

| Subject Alternative Name:,| Not valid before: 2021-04-26T16:15:04

Not valid after: 2021-07-25T16:15:04

|ssl-date: TLS randomness does not represent time

| tls-alpn: