Bqyhelp.top From the 805 rats
https://eqzcare.help/
https://fpzcare.help/ (upgraded site with BestBuy, Geeksquad logos)
Support
https://oadcare.help/
www.f6qhelp.top
www.helpt5.top
https://cndcare.help/
https://rdkc.xyz/ (code=67006)
https://bmkc.cc:8443/
https://www.help210.top/ (code in use OO87012)
just tested some .top sites with my Tool: Scam-Website Clone Detector via Image Hashing + urlscan.io (only the ones that are still online)
results for help7s.top:
| Scanned Site | Clone Site | Registered on: |
|---|---|---|
| https://www.help7s.top/ | https://kfjhelp.sbs/ | 2025-04-30 |
results for ppl6help.top:
| Scanned Site | Clone Site | Registered on: |
|---|---|---|
| https://www.ppl6help.top/ | https://cancelmyorders.top/ | 2024-11-14 |
| https://www.ppl6help.top/ | https://cancelpaypalorder.com/ | 2025-01-20 |
| https://www.ppl6help.top/ | https://get2factor.com/ | 2024-02-12 |
| https://www.ppl6help.top/ | https://helpmysupport.com/ | 2024-02-15 |
| https://www.ppl6help.top/ | https://mypaypal.xyz/ | 2025-02-27 |
| https://www.ppl6help.top/ | https://paypalagent.com/ | 2025-03-19 |
| https://www.ppl6help.top/ | https://paypalconnection.com/ | 2025-02-24 |
| https://www.ppl6help.top/ | https://ppl247.top/ | 2024-11-22 |
| https://www.ppl6help.top/ | https://pplassist.com/ | 2024-03-25 |
| https://www.ppl6help.top/ | https://pplhelpnow.com/ | 2024-03-25 |
| https://www.ppl6help.top/ | https://pplsupport.sbs/ | 2025-04-30 |
| https://www.ppl6help.top/ | https://cancelmyorder.top/ | 2024-10-15 |
| https://www.ppl6help.top/ | https://ppls.help20.top/ | 2025-03-15 |
| https://www.ppl6help.top/ | https://pps.help20.top/ | 2025-03-15 |
| https://www.ppl6help.top/ | https://securemyaccount.top/ | 2024-11-14 |
(not sure if they are all connectwise-related)
Not sure if this is helpful but at least it seems to find more connectwise sites.
Nice work! Please keep this up, also have you worked on a new script to help take these down? Any help would be appreciated.
thanks and nope I wasnât really active with the connectwise sites lately, I tried to report a couple of their remote servers a while ago but no luck.
But as the tool seems to find a bunch of similar .top sites we could try this:
- Someone posts a new .top site
- We let the clone-tool check for similar sites
- I could add a function to extract the registrar as well (I have a tool for that, extracting the hosts didnât work but I assume they are all hidden behind Cloudflare)
- try to âbatch-reportâ all clone sites to the registrar
But there are some challenges:
- Most registrars donât accept batch reports (and ask for separate reports include proof) = sh**-load of work
- We might need some kinda spreadsheet/database to see if we already reported the sites
- theoretically we would need to check each site to avoid reporting a non-connectwise site
I ran the list from above in a second script to group them by registrar + status (seems to work):
big scam going on. flood if someone can. lets show our power !
Iâm going to list this here, though itâs not a ConnectWise site, but it lists multiple remote softwareâs
and fake PayPal is using this site.