Taking out ConnectWise sites

What are the results, did the code work?

「いいね!」 3

Ive turned off the bot until monday.
Ill switch it back on during the peak scam period and really mess with them.
In the mean time lets make a list of domains to nuke all at once.

「いいね!」 4

gcompro.org has had some “unexpected maintenance” performed on it by DisconnectWise.

「いいね!」 5

Didnt need the code for that specific domain as it was using an iframe
you only need the code for the mask domains (the ones that have the background image of paypal/microsoft/etc…)

「いいね!」 4

Yea, Norton refund scammers tend to use these domains btw.

「いいね!」 4

Norton mcompro.org 74589

「いいね!」 4

Added to the list, will be DOSed on monday during peak scam times.

「いいね!」 4

another bs.e24.help code 63338

「いいね!」 3

bs.e24.help appears to have been shut down :slight_smile:

「いいね!」 3

https://control.ctrl10.pw
https://sup2.13001.ru/
https://control.ctrl02.ru/
https://sup2.12001.ru/
https://sup2.supos911.org/
https://sup2.supos123.org/
https://os911.org/

「いいね!」 4

rncare.live Code: 09876)

「いいね!」 3

:+1: Added.

「いいね!」 4

All 131 scammer domains I have found are currently experiencing “high CPU usage” right at the most inconvenient time. They can change the port all they want, it wont make any difference.

「いいね!」 5

Another site from a tech support scammer this morning which auto-downloaded a screen connect.exe file,

https://lijw1.top/Guest.aspx/?Session=b2de62aa-d60d-4bb8-abc1-782d864f4eee

「いいね!」 5

kphelp.info you can add, I didn’t see it on the list.

「いいね!」 5

kphelp.info is a mask domain that hangs when you enter a code (that means ive already taken out the master server).

lijw1.top has been added to the list of servers experiencing high CPU usage.

「いいね!」 5


:skull: :skull: :skull:

「いいね!」 5

「いいね!」 7

「いいね!」 5

some of the backend domains have been changed on these, ive gone through and have taken them down again

「いいね!」 4