Tech Suppoat Numbers 7-29-19

Phishing
1

844-516-4604

Link: https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/

image bandicam-2019-07-29-09-47-08-276jpg.jpeg![image bandicam-2019-07-29-09-47-08-276jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/15:48:230-bandicam-2019-07-29-09-47-08-276jpg.jpeg)

2

855-546-0530

Link: https://rebootviewport.ga/Call-Windows-Support_CH18555460530/

![image bandicam-2019-07-29-09-50-30-465jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/15:50:390-bandicam-2019-07-29-09-50-30-465jpg.jpeg)

3

844-490-7730

Link: https://ubixquery.ga/Call-Windows-Support_CH18444907730/

![image bandicam-2019-07-29-09-51-15-939jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/15:51:440-bandicam-2019-07-29-09-51-15-939jpg.jpeg)

4

865-507-2445

Link: http://prnauth770.tk/u1616188&clickid=176283147195921369&keyword124rqfdsd24355rjbvqwEWRRWEFSD54544345756544/3124124124/CH_fsds4rwew4422434dsds32sHelp/

![image bandicam-2019-07-29-09-56-05-948jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/15:56:370-bandicam-2019-07-29-09-56-05-948jpg.jpeg)

5

BobRTC Direct Dial numbers:

https://bobrtc.live/phonebook/dial/18444907730

https://bobrtc.live/phonebook/dial/18555460530

https://bobrtc.live/phonebook/dial/18445164604

6

844-389-1184

Link: https://techsuppoertingxx.tk/Call-Windows-Support_CH18443891184/

![image bandicam-2019-07-29-10-02-52-371jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/16:03:290-bandicam-2019-07-29-10-02-52-371jpg.jpeg)

7

888-735-3552

Link: http://165.22.160.47/malware-win-chx/?phone=+1-(888)-735-3552&

![image bandicam-2019-07-29-10-23-19-181jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/16:23:480-bandicam-2019-07-29-10-23-19-181jpg.jpeg)

8

844-516-4159

Link: http://www.freeeditor.club/1ffuiuluiiiuiuusdfdsfnmnjhhkjd/

![image bandicam-2019-07-29-11-00-08-269jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/17:00:380-bandicam-2019-07-29-11-00-08-269jpg.jpeg)

9

800-745-0043

Link: http://jailaxmimataki.s3-website-us-west-2.amazonaws.com/

![image bandicam-2019-07-29-11-01-59-309jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/17:02:280-bandicam-2019-07-29-11-01-59-309jpg.jpeg)

10

877-378-8921

Link: http://rabbitshot.ml/dasdadasdawe212321sdsAx/

![image bandicam-2019-07-29-11-13-47-634jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/17:13:550-bandicam-2019-07-29-11-13-47-634jpg.jpeg)

11

@JoeHimself5#101833

DATA, ALL FILES AND ENUMERATION BEING UPLOADED CURRENTLY

PRELIM DATA BELOW, THE SERVER WILL NOT RESPOND TO SPECIFIC QUERIES

Initial Attack: LOCATION ATTACK AT A LIBRARY WA STATE

https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/

SC: Tech-Support-Scam-Page1-A7292019-A hosted at ImgBB — ImgBB

DL Link to beep: mavisviewxx.gq/Call-Windows-Support_CH18445164604/beep.mp3

SC: Image of actual downloaded file from directory

Tech-Support-Scam-Page1-A7292019-B hosted at ImgBB — ImgBB

SC: Image of file and source directory

Tech-Support-Scam-Page1-A7292019-C hosted at ImgBB — ImgBB

SC: Comparitor of file in web directory vs file downloaded from the link to the file: Left, downloaded 0 file, RIGHT, actual file in directory, 12KB.

Tech-Support-Scam-Page1-A7292019-D hosted at ImgBB — ImgBB

TC: https://www.threatcrowd.org/domain.php?domain=mavisviewxx.gq
TCSC: https://ibb.co/F7KV9NM
TCSC: https://ibb.co/1LBRPw2

Serving IP: 104.18.32.244
TC: https://www.threatcrowd.org/ip.php?ip=104.18.33.244
TCSC: https://ibb.co/xMRn1C7
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/style.css
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/3.png
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/btns.png
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/cur.png
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/win_logo.jpg

Extra linked files used in operation of page
https://code.jquery.com/ui/1.12.1/jquery-ui.min.js
https://code.jquery.com/jquery-2.2.4.min.js
https://mavisviewxx.gq/Call-Windows-Support_CH18445164604/beep.mp3

12

@JoeHimself5#101833

https://www.youtube.com/watch?v=poo2xaEhrHE

13

@FLAGRUM#101887 SUBORINATE DATA

All IP addresses being used to resolve and serve!

104.18.32.244

104.18.33.244

2606:4700:30::6812:20f4

2606:4700:30::6812:21f4

seen this address before

Organisation:

Equatorial Guinea Domains B.V.

Dominio GQ administrator

P.O. Box 11774

1001 GT Amsterdam

Netherlands

Phone: +31 20 5315725

Fax: +31 20 5315721

E-mail: abuse: [email protected], copyright infringement: [email protected]

Domain Nameservers:

HAL.NS.CLOUDFLARE.COM

MAYA.NS.CLOUDFLARE.COM

CLOUDFLARE IS ABUSE! So is freenom

14

@JoeHimself5#101833

All files zipped and uploaded to major security providers

BLACK LISTING HAS BEGUN ON ALL FRONTS I CAN REACH

Keep putting them up, eventually, prison or worse.

15

@JoeHimself5#101833

Current low scope of bot net of malware involved. That is just the start of the entire map.
https://ibb.co/KDFkgv4

16

855-494-2474

Link: https://ndhshdlajshd36.xyz/2474askjdkjasdhsd1nk2/Call-Support1/

![image bandicam-2019-07-29-15-19-56-383jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/21:20:050-bandicam-2019-07-29-15-19-56-383jpg.jpeg)

17

844-516-4681

Link: http://newdomainxls009.site/ntr1/12345/1sdafgdfvsdert44bdsbfj2342x/

![image bandicam-2019-07-29-16-59-03-625jpg.jpeg](https://tlscommunity.com/assets/2019-07-29/22:59:510-bandicam-2019-07-29-16-59-03-625jpg.jpeg)

18

800-745-0043 still active!

19

The voicemail from 800-745-0043. Maybe someone can translate? I thought I heard “chutiya” in there somewhere lol.

https://youtu.be/_rKXVOaYh1E

20

844-490-7730 is active again for now…