Taking out ConnectWise sites

General Discussion
1248

https://wmzlive.top/?__cf_chl_rt_tk=T52VnXzTgoShR3bZ1haQyjOgO53ke6o_KDQX6Q4BhNo-1755788928-1.0.1.1-3XgD5YnhrLWXwQAGsaMst08UkfzMrPwrxzjjjxLc9x4

1249
URL: Registrar: Registered on:
https://helpehi.top/ NameSilo,LLC 2025-08-20
https://abwsol.top/ NameSilo, LLC 2025-08-19
https://www.cppl24help.top/ Gname.com Pte. Ltd. 2025-08-09
https://www.cp24help.top/ Gname.com Pte. Ltd. 2025-08-09

not sure if scam related (seems to come from remotefix.support):

URL: Registrar: Registered on:
https://173.249.76.93/ unknown unknown
1250

https://rtbhelp.top/

https://bestcontrol.ctrl421.ru/?Session=14a496a9-3ca6-48bb-ac53-44744b1423f0 (careful, automatic down)

1251
URL: Registrar: Registered on:
https://connectwithsupport.com/ (fake paypal with anydesk + 2 SC site redirects) Name.com, Inc. 2025-08-22
https://ac7dft-ad.top/ NameSilo, LLC 2025-08-20
https://m.mob401.top/ Gransy s r o dba subreg cz 2025-07-24
https://bestcontrol.ctrl421.ru/ R01-RU 2024-09-08
1252
URL: Registrar: Registered on:
https://helpdrz.top/ NameSilo, LLC 2025-08-22
https://helpjcm.top/ NameSilo, LLC 2025-08-23
1253

https://bdnet103.top/ (this site looks familiar, I hope I didn’t post already..it’s still active though)

1254
URL: Registrar: Registered on:
https://fkyhelp.top/ NameSilo, LLC 2025-08-21
https://carexcb.top/ NameSilo, LLC 2025-08-21
1255

https://wzrlive.top/

https://iekcare.top/

1256

niice, found a new theme hash for these “App_Themes/Embedded/” (they removed the upper ScreenConnect part)
bd64e22cfbfd4810b720bfae719aac595840a28be4af174e322652b6f373e4ae

I also found some kinda “bypass” to still find screenconnect sites with CF turnstile, even if they weren’t properly scanned, here’s an example:
https://urlscan.io/result/0198e996-9b10-72ea-b592-57401c17f5ee/#summary (can’t be scanned)
but reverse-searching with the hash for a failed logo favico.ico gives all other sites that failed similarly:
Search - urlscan.io
will add this hash to my script from now on
22c7a38d8509b322ab9460aeca4419462a5373f51c39bcd1ab15521a196d69d8

@SouthernCulture_x it’s super helpful if you post new sites from streams/baits so I can crosscheck if the script can grab them and adjust it :sign_of_the_horns:

URL: Registrar: Registered on:
https://ovhhelp.top/ NameSilo,LLC 2025-08-25
https://helpxir.top/ NameSilo, LLC 2025-08-22
https://uovhelp.top/ NameSilo,LLC 2025-08-22
https://carebhs.top/ NameSilo, LLC 2025-08-22
https://soleqj.top/ NameSilo, LLC 2025-08-22
https://rzwcare.top/ NameSilo,LLC 2025-08-21
https://u21bh-yg.top/ NameSilo,LLC 2025-08-21
https://ynrlive.top/ NameSilo,LLC 2025-08-21
https://ugnlive.top/ NameSilo, LLC 2025-08-21
https://helpnnw.top/ NameSilo, LLC 2025-08-21
https://soljmp.top/ NameSilo,LLC 2025-08-21
https://livewoj.top/ NameSilo,LLC 2025-08-20
https://helprkn.top/ NameSilo, LLC 2025-08-19
https://livelxt.top/ NameSilo,LLC 2025-08-16
https://web.rwbhelp.top/ Gname Pte. Ltd. 2025-02-28
1257

I try to post as many as I personally find my friend, yeah the variations are pretty easy to find, it looks like your script is working good, keep it up!

1258

https://solxel.top/

1259
URL: Registrar: Registered on:
https://paypalassist.net/ (3 redirects to SC) Name, Inc. 2025-08-27
https://iansol.top/ NameSilo, LLC 2025-08-27
https://www.cphelp9.top/ Gname Pte. Ltd. 2025-08-22
1260

https://gmkr.cc:9113/

https://ugnlive.top/?__cf_chl_rt_tk=JSIDpn_ay3ODYOZjW_Wqoj.zlUfcQDJHO21sh6y_ayc-1756416176-1.0.1.1-3i4yhZN9COMv0eeepQqm2HYjzaznUqtGpYAAhG6brHU

https://carebhs.top/

1261

https://gmkr.cc:9113/

https://carebhs.top/?__cf_chl_rt_tk=XMOlExKZzPwYW6fbu2W6yCVxIv490ENwoGzxqTEb3vw-1756419045-1.0.1.1-YAIl0Vh5_oEq6WIPlSUXBFELrRFZehmDDT_o4OCu2XE

1262

https://www.solwwr.top/

1263

https://mellive.top/

https://www.km5help.top/ (this site looks familiar, hope it hasn’t been posted:))

https://helprkn.top/

1264
URL: Registrar: Registered on:
https://ngosol.top/ NameSilo, LLC 2025-09-01
https://carepna.top/ (redirect) NameSilo, LLC 2025-08-30
https://solwwr.top/ (redirect) NameSilo, LLC 2025-08-30
https://nsacare.top/ NameSilo, LLC 2025-08-29

(haven’t directly found them with the script only after finding another Alexhost Server with sites similar to liveiaj.top)

1265

https://bdxlive.top/

I’m putting this site here, it has several links to remote software, 1 SC site that’s not working. This is from a Norton email posted today. Norton Lifelock - After Sales Support Portal

1266
1267
URL: Registrar: Registered on:
https://trehelp.top/ NameSilo,LLC 2025-09-02
https://helpqao.top/ NameSilo, LLC 2025-09-02
https://helprln.top/ NameSilo, LLC 2025-09-02
https://gflhelp.top/ NameSilo, LLC 2025-09-02
https://helpfvs.top/ NameSilo, LLC 2025-09-02

(been a while but the script caught some new sites)