https://imtdcare.top/?Session=b4705aac-b3ce-4225-9258-d55120c8bf01
https://snjoin.top/
https://www.hpiohelp.top (no proxy)
https://zshlive.top/ (fake Norton, Spaceship, CloudFlare bullshit)
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://www.securemyaccount85.top/ | Gname | 2025-12-05 |
| https://www.secureserver57.top/ | Gname | 2025-12-05 |
| https://www.ppl24help.top/ | Gname | 2025-11-25 |
| https://www.uv9help.top/ | Gname | 2025-11-24 |
| https://fbhcare.top/ | Spaceship, Inc. | 2025-11-04 |
| https://gvglive.top/ | Spaceship, Inc. | 2025-11-04 |
| https://dbhcare.top/ | Spaceship, Inc. | 2025-11-04 |
| https://eijcare.top/ | Spaceship, Inc. | 2025-11-04 |
| https://hnpcare.top/ | Spaceship, Inc. | 2025-11-03 |
| https://iuphelp.top/ | Spaceship, Inc. | 2025-11-03 |
| https://mawhelp.top/ | Spaceship, Inc. | 2025-11-03 |
| https://erncare.top/ | Spaceship, Inc. | 2025-11-03 |
| https://dlzcare.top/ | Spaceship, Inc. | 2025-11-03 |
| https://fmkcare.top/ | Spaceship, Inc. | 2025-10-17 |
| https://vdtcare.top/ | Spaceship, Inc. | 2025-10-17 |
| https://epchelp.top/ | Spaceship, Inc. | 2025-10-17 |
| https://okmw.help:9113/ | NameSilo, LLC | 2025-11-07 |
| https://jzshelp.top/ | Spaceship, Inc. | 2025-11-04 |
@dubloox3 1234 is a valid code for https://ppl24help.top and https://uv9help.top . The files that they try to get you to download do not have the same checksum.
One serves up SHA256: 586dd15b1d6a5cd746e9a06fb6c866b3ba520675e6aab34236aa00c2107925e9
and the other serves up SHA256: 776edafb554c14d9c7cefaf87e3ecdbea77d54499675cd2eaac0e840a40c1c77
Also, @dubloox3 Of all of the links that you posted, only the first 4 are still up
lol yeah.. I report them immediately after posting, those got taken down by the Registrar quick (seems like Spaceship finally starts to react)
Ah, okay. You use WHOIS and a abuse reporting email address for that, yeah?
I report them in bulk via Netcraft, you might have heard about them from the Peoples Call Centre this year. We reported around 1200 since we scan for new sites and manually reporting them is close to impossible.
@SouthernCulture_x 1234 works on https://suhcare.live
@SouthernCulture_x 1234 does not work here
@SouthernCulture_x 1234 works on https://bghtcare.top/
| URL: | Registrar: | Registered on: |
|---|---|---|
| http://pwbm.us/ (redirect) | NameSilo, LLC | 2025-12-03 |
| https://pwbm.us:9113/ | NameSilo, LLC | 2025-12-03 |
| https://ordhelp.top/ | Spaceship, Inc. | 2025-11-04 |
| https://vcdhelp.top/ | Spaceship, Inc. | 2025-11-03 |
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://www.gd24help.top/ | Gname.com Pte. Ltd. | 2025-11-26 |
https://sys140.net/ (this site is active today, it’s been listed before)
https://vbjoin.top/ (scammers having a bad day with servers down)
| URL: | Registrar: | Registered on: |
|---|---|---|
| https://suchelp.top/ | Spaceship, Inc. | 2025-12-08 |
| https://u21vgr-ve6.top/ | Spaceship, Inc. | 2025-09-20 |
| https://maincontrol.ctrl020.ru:7113/ | R01-RU | 2025-10-08 |