the irony 
Their hiding behind cloudflare which does cause some issues…
Thankfully cloudflare is a US based company, and they are pretty much forced to comply with requests from law enforcement.
Looks like a dangerous program
tshelp.site did not work on my VM, I don’t know if it works on any other PC’s, but I’m posting it.
conline.life
klhelp.site
Using screenconnect ms4help.info with code “12887”
Masking ltdr1.top also with code: “12887”
ghelp.live has a surprise waiting lol
Code: “12887” once again…
https://vscare.info/
it’s being used today by Delhi tech support pop-up scammers!
uqhelp.live, it redirects to,
ab65pnl.sbs
phelp1.org
38622