Taking out ConnectWise sites

03/10/25 www.qfhelp.top 104.21.27.215 Cloudflare/Gname
03/10/25 web.tvwhelp.top 104.21.74.50 Cloudflare/Gname

03/10/25 helpsupport.top 196.251.72.175 EKABI/Namesilo

https://ccocare.help/

03/11/25 pmlhelp.top 194.59.30.60 Virtuo/Namesilo

Same download

https://karb.link:9113/

03/11/25 rbmcare.help 172.67.149.84 Cloudflare/Namesilo

Same download

https://ppmcare.help/ (code in use 95932)

https://mwdcare.help/

https://fmmcare.help/ (code in use 72324)
https://rp2help.live/
ConnectWise ScreenConnect Remote Support Software

03/12/25 obkm.cc 144.126.156.55 Contabo-Nubes/Namesilo

Same download

03/12/25 m.ichelp.top 104.21.48.1 Cloudflre/Gname

This was reported end of Feb - but the IP changed slightly, comes up as one of those watch templates

2/25/25 m.ichelp.top 104.21.96.1 Cloudflare/Gname

https://pwwcare.help/

03/12/25 pxyhelp.top 194.59.31.27 Virtuo/namesilo

Same download

03/12/25 www.ihhelp.top 104.21.16.1 Cloudflare/Gname

Reported 3/3, IP shifted slightly. Same Download

03/03/25 www.ihhelp.top 104.21.64.1 Cloudflare/Gname

03/12/25 pwwcare.help 104.21.48.1 Cloudflare/Namesilo

https://www.enhelp.top/ (code=13cf57n)
https://hddcare.help/

03/13/25 rmcare.help 172.67.135.28 Cloudflare/Namesilo

Same Download

03/13/25 pqerhelp.top 194.59.30.60 Virtuo/Namesilo

03/13/25 www.jhhelp.top 104.21.112.1 Cloudflare/Gname
03/13/25 web.obhelp.top 172.67.201.13 Cloudflare/Gname

Reported on 3/3 - IP changed slightly.

03/03/25 www.jhhelp.top 104.21.96.1 Cloudflare/Gname