Suspected Network of Support Scams (Carreto Corona Armando)

Scams
,
1

I hope this isn’t a duplicate of someone’s prior research!

Keyword searching for "gmail support" found me this website: https://emailsupport.us/, which has the hallmarks of a fake tech support team.

Whois returned this information:
CARRETO CORONA ARMANDO
Organization:N/A
Street:W Valley Hwy S #13
City:Algone
State:Washington
Postal Code:98001
Country:US
Phone:+1.8338826888
Email:[email protected]

The address given is that of Yahn & Son Funeral Home and Crematory on Google Maps.

A reverse whois lookup found three other domains under Carreto Corona Armando:
https://www.hpprintersupportpro.us/ (online)
https://www.canonprintersupportpro.us/ (online)
https://avastsupportnumber.us/ (account suspended)

Whois on hpprintersupportpro.us reveals a different phone and email:
Phone:+1.7708739555
Email:[email protected]

Website.informer.com gives a different phone number, multiple emails, and three new domains (all online):
Phone: +1.8889028333
Email: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
https://emailtechnicalsupport.us/ - Email Technical Support +1-855-258-6664 Mail Support, Daily visitors: 534, Keywords: roadrunner email, Email Support, email tech support, email customer service, email customer support, email technical support, road...
https://epsonprintersupportpro.us/ - Epson Printer Support Number +1-800-699-3341 - Epson Support, Daily visitors: 534, Keywords: epson printer support, epson support number, 0x97 fix patch, epson support phone number, epson printer error 0xf4, epson 0x97 fix ...
https://printersupportpro.us - Get Help & Printer Support from Experts, Keywords: printer offline fix, printer is offline

The most valuable email is [email protected] - there are many women named Pavneet Kaur but it's probably worth investigating.

TL;DR:
Domain dump:
https://emailsupport.us/
https://www.hpprintersupportpro.us/
https://www.canonprintersupportpro.us/
https://emailtechnicalsupport.us/
https://epsonprintersupportpro.us/
https://printersupportpro.us/

Alleged registrant numbers of Carreto Corona Armando:
+1.8338826888, +1.7708739555, +1.7708739556, +1.8884567234, +1.8006993341, +1.8889028333

Alleged emails:
[email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

And of course, support numbers (by domain):
Emailsupport (no numbers)
Hpprintersupportpro:
+1 650 857 1501 (US)
+44 207 660 0403 (UK)
+1 877 231 4351 (CA)
Canonprintersupportpro:
+1 800 652 2666 (US, CA)
+1 860 180 3366 (INDIA)
+1 800 474 6836 (UK)
Emailtechnicalsupport:
+1 587 600 3145
Epsonprintersupportpro:
+1 800 463 7766 (US)
0343 903 7766 (UK, ?)
+1 800 425 0011 (CA)
Printersupportpro: (no numbers)

I haven't tried the numbers myself, and Pavneet Kaur deserves closer attention.

1 Like
2

That is a Punjabi Indian female name

[email protected]

canonprintersupportpro.us

1-888-653-9471 active today Saturday

3

The following numbers are currently being call flooded: “9471” - “2666” - “6836” - “7766” - “0011”

----- Thank you so much :)

4

Update: Some excellent work on hpprintersupportpro.us had already happened here: http://scammer.info/d/49791.

My research checks out with theirs, and they name some domains I hadn’t found. I’m not sure whether they are actually related to Carreto Corona Armando (all private WHOIS information):

https://123hgh.com/

https://www.customerservicephonenumber.co/

https://customersupportphonenumber.co/

https://limksys.com/

In fact, this thread from 2019 seems to have exposed the group and some of its members! http://scammer.info/d/28220
These guys have been around for at least 3 years and are still kicking. If the people/group are the same, (maybe it's the "new generation") it warrants a proper reporting effort (at the very least).

Playing around with the domain names I found earlier, I found more which are exactly the same with ".net" or ".com" instead of ".us". I have good reason to believe they are by the same group:
https://www.hpprintersupportpro.com/
https://www.canonprintersupportpro.net/
https://www.printersupportpro.net/
All the WHOIS information on these is private, so perhaps the scammers got smart before registering these nearly identical domains.

I did some further digging and found more fraudulent-looking websites hosted on the same IPs (using spyse.com):
https://www.contactmailsupport.net/
https://www.brotherprintersupportpro.us/
https://www.brotherprintersupportpro.net/
https://www.emailsupport-contact.com/
https://www.quickbookssupportphonenumber247.co/
https://www.emailcustomerservice247.com/
https://www.amiytech.com/

Numbers:
hpprintersupportpro.com: +1 650 857 1501 (same number as .us)
canonprintersupportpro.net, printersupportpro.net, brotherprintersupportpro.net, amiytech.com: +1 888 653 9471 (same number found by @drwat)
contactmailsupport.net: +1 866 978 6159
brotherprintersupportpro.us: +1 972 924 0308
emailsupport-contact.com: +1 888 584 5373
emailcustomerservice247.com: +1 888 510 0507

Again, I have not tried the numbers myself.
This is an elaborate and longstanding operation; refer to the two threads mentioned above and pay them credit. What's the next step?

5

www.emailsupport.us

Server Ip: 45.14.226.49

22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 2048 c7:27:62:f2:66:05:89:44:06:fe:fe:98:43:b7:88:ca (RSA)

80/tcp open http Apache httpd 2.4.29 ((Ubuntu))

|http-server-header: Apache/2.4.29 (Ubuntu)

|http-title: Did not follow redirect to https://emailsupport.us/

443/tcp open ssl/ssl Apache httpd (SSL-only mode)

|http-server-header: Apache/2.4.29 (Ubuntu)

|http-title: Did not follow redirect to https://www.emailsupport.us/

| ssl-cert: Subject: commonName=emailsupport.us

| Subject Alternative Name: DNS:emailsupport.us, DNS:www.emailsupport.us| Not valid before: 2021-04-26T16:15:04

|Not valid after: 2021-07-25T16:15:04

|ssl-date: TLS randomness does not represent time

| tls-alpn:

| http/1.1

58.82.2fa9.ip4.static.sl-reverse.com

ns1.afraid.org

ns2.afraid.org

ns3.afraid.org

ns4.afraid.org

emailsupport.us

mail.emailsupport.us

www.emailsupport.us

6

emailtechnicalsupport.us 866-237-5619
Bahraich near Lucknow, India