There is currently a way to make scammers ConnectWise ScreenConnect sites unusable (by breaking their ability to read codes), if you find any sites, please drop them here and ill take them out.
Even if the hosting providers turn their backs, we can still shut them down.
Heres the ones ive taken down so far (assuming my badly written script dosent crash lmao):
norf1.top
8do3.wkrtpbaksr.sclogins.net
9g4j.jtrporbks.loginlink2.site
abdk.cc
bw74.pnfgseyj.loginlink2.site
bws1backss.site
c0e2.rcbnlhytey.loginlink2.site
d46j.cpdsthrt.loginlink2.site
fl90.cast1backt.sclogins.net
gw63.vk1bpmnackk.sclogins.net
lijw1.top
hkyt1.top
m3324.yesgkbk1gk.site
quickpchelp.net
s4g9.tf1bacerkf.loginlink2.site
sup2.osc247.ru
zoneimport.g3639.gleeze.com
edit: (a LOT more have been added since I posted this, literally hundreds)
Some of them wont load at all, some will load, but will fail to read the code/generate the exe, some will throw an error.
24 „Gefällt mir“
Nice One…pchelp1800.org for your list…Cheers…Col
6 „Gefällt mir“
pchelp1800.org was masking sup2.sp101.ru
its been added to the list
4 „Gefällt mir“
We’re watching these sites very well.
3 „Gefällt mir“
A lot of those are masked, do you have any valid codes for them?
2 „Gefällt mir“
If I can find a number that uses them, I tend to see Norton ones using ConnectWiseControl and they provide codes.
I usually just to mess with them, play dumb and delete the file and make him do it ALL over again and forces him to give me ANOTHER code.
5 „Gefällt mir“
if you can save the codes thats great
the way their masked means they wont reveal the real connectwise instance until they get a valid code
3 „Gefällt mir“
If you find a number that uses them post it here, going and deleting the connectwise file will force them to give you multiple.
4 „Gefällt mir“
Just updated the script, it should be a lot more effective now
4 „Gefällt mir“
once i have a valid code i can see all the other codes on the server
its just getting that first code so the mask site reveals the backend server
4 „Gefällt mir“
Now, we just need numbers to call. Call centers use multiple websites, so we just need to bait them until we get all of them down.
4 „Gefällt mir“
I know a load of active numbers which can be tried for ConnectWise Control codes
I never speak to these low class dolts
My IQ suffers greatly just hearing them say “suppoat”, “suppert” or numerous other barely legible grunts a couple of thousand times a day
I’ll make a thread and dump a few in there
4 „Gefällt mir“
Thank You, will look into it
3 „Gefällt mir“
Numbers are always welcome. We always have folks looking forward to speak to scammers
5 „Gefällt mir“
Heres the sites im currently holding offline:
[‘lijw1.top’, ‘sup2.osc247.ru’, ‘jfrd1.top’, ‘hdkrty.sbs’, ‘krto.cc’, ‘bmck.us’, ‘fxvt1.top’, ‘sup2.sp101.ru’, ‘mkuy1.top’, ‘abdk.cc’, ‘baka1.top’, ‘imar1.top’, ‘dkrc1.top’, ‘cdrm1.top’, ‘dfgy1.top’, ‘ciwa1.top’]
5 „Gefällt mir“
They are trying to use a different port to avoid my bot lmao
5 „Gefällt mir“
