Taking out ConnectWise sites

SouthernCulture_x · January 17, 2025, 2:44pm

https://careteam.help/,
and,
https://fihelp.top/?__cf_chl_rt_tk=B5OMgcoMiMjm01u4boRtp1PLrnANJ9ZpTrdd6tpKrnQ-1737125546-1.0.1.1-zPItE2FXY.mIPVQXSzX.5QCc4HVWVLImcq2OpT3PlHY

everra · January 17, 2025, 5:24pm

01/17/25 qzhelp.top 104.21.53.142 Cloudflare/Gname
01/17/25 molatoripro.cyou 104.21.95.126 Cloudflare/Gname

This one popped up on the 9th, looks like they moved IPs, didn’t have the download URL then because they did this one themself
in the background while the first CW was installed

01/09/25 qzhelp.top 172.67.213.135 Cloudflare/gname.com

everra · January 17, 2025, 6:17pm

01/17/25 quhelp.top 188.114.96.3 Cloudflare/Gname - 55632
01/17/25 gajrokerring.icu 172.67.155.171 Cloudflare/Gname

This download last seen with mrhelp.top - same IP last Nov.

11/25/24 mrhelp.top 172.67.178.182 Cloudflare/Gname.com
11/25/24 gajrokerring.icu 172.67.155.171 Cloudflare/Gname.com

Matherchod · January 17, 2025, 6:38pm

echelp.top code 06047

SouthernCulture_x · January 17, 2025, 7:15pm

https://pps.help9.top/
I usually don’t put in codes, but here it is code=23500

SouthernCulture_x · January 18, 2025, 10:54pm

https://qzhelp.top/?__cf_chl_rt_tk=OzPXb00XPEQIqoS1dCZDE.axL2R_FNvbOUwgbYXO2Vc-1737238310-1.0.1.1-YWFfrIxri5eWZKeCfAKmq4PZ4IMFbbBD.UakY6c8y9E

everra · January 20, 2025, 4:58pm

01/20/25 mgbhelp.top 79.110.49.101 Virtuo Networks France SAS/Namesilo - 39164

Same URL download

everra · January 20, 2025, 5:22pm

01/20/25	jnhelp.top	104.21.32.1	Cloudflare/Gname - 21tb09u
01/20/25	gomolatori.cyou	172.67.144.81	Cloudflare/Gname

everra · January 20, 2025, 6:37pm

01/20/25 careaid.help 104.21.64.1 Cloudflare/namesilo - 68982

Same URL download

SouthernCulture_x · January 20, 2025, 8:25pm

https://pkbm.xyz/

Nathaniel · January 21, 2025, 2:10am

can you drop the script or just explain in a little more detail how u take connectwise sites down?

everra · January 21, 2025, 5:24pm

01/21/25	djhelp.top	104.21.12.113	Cloudflare/Gname
01/21/25	wolikas.molatoriit.cyou	172.67.187.177	Cloudflare/Gname

everra · January 21, 2025, 5:36pm

01/21/25	dshelp.top	172.67.128.35	Cloudflare/Gname - 60090
01/21/25	molatoriline.cyou	37.221.65.128	Alexhost/Gname.com Pte. Ltd.

SouthernCulture_x · January 21, 2025, 5:38pm

https://allcare.help/

everra · January 21, 2025, 6:41pm

01/21/25	ntsupport.help	78.40.117.18	Alexhost/Namesilo - 76902
01/21/25	uecr-tt4.top	37.221.64.71	Alexhost/Namesilo

everra · January 21, 2025, 7:48pm

01/21/25	revcare.help	37.221.64.202	Alexhost/Namesilo - 27411
01/21/25	owty1-rr.top	37.221.64.118	Alexhost/Namesilo

SouthernCulture_x · January 21, 2025, 8:18pm

https://pl.help9.top/,
https://h2support.help/

SouthernCulture_x · January 22, 2025, 8:07pm

https://ccnet120.live/
and,
https://dpcare.live/
https://rs2care.live/
https://dccare.help/
https://hdrcare.help/ (Fake MS365 site)
https://d4support.help/
https://cvcare.help/

everra · January 23, 2025, 4:21pm

01/22/25 snhelp.top 104.21.96.1 Cloudflare/Gname - 237641
01/22/25 molatorier.cyou 104.21.33.213 Cloudflare/Gname

This download last seen with
01/16/25 dkhelp.top 188.114.96.3 Cloudflare/Gname
01/16/25 molatorier.cyou 104.21.33.213 Cloudflare/Gname

everra · January 23, 2025, 7:23pm

01/22/25 caregive.help 188.114.96.3 Cloudflare/Namesilo -

Same URL downloads - thought they were getting on a cellphone