https://www.yliber.cf/call-for-microsoft-support-1-855-835-7333/chx/
855-835-7333
These guys are a total blast to talk to.
I spent a few hours and they were clueless it was a prank
If you go to the public_html you get a dir of all phone numbers they have set up: https://www.yliber.cf/
Hi, could you please tell me where you went what user agent/browser were you using when you got that popup?
@Fennex#70205 Good catch on the open directory
[DIR] call-for-microsoft-support-1-855-835-7333/ 2019-01-12 02:43 -
[DIR] call-for-microsoft-support-1-877-286-9666/ 2019-01-12 02:38 -
[DIR] call-for-microsoft-support-1-877-314-0111/ 2019-01-12 01:23 -
@bobHasAvirus#70208 I cannot, because its a script that executes on multiple typo-squat domains. As far as agent/browser, I use
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
dosent work
@brocool27#70223 Can you elaborate on what doesnt work? The site is still up.
Doesn’t work.
Dial the number, it does not work. Don’t downvote comments when you’re wrong.
@sterculius#70232 I will when the comment makes no sense or is unclear. Thanks for clarifying that the number no longer works.
If 1-855-835-7333 does not work, then try 1-877-286-9666 or 1-877-314-0111, because those are the two other numbers listed at https://www.yliber.cf/
Forgot to even put this in earlier but the other two numbers from the domain list there are down. Well for me that is. No idea if they closed them for the day or literally closed in general.
New websites and numbers for the same popups/scammers:
https://www.bbreaver.cf/
https://www.dbreaver.cf/
New:
1-844-880-6292
https://www.bbreaver.cf/call-for-microsoft-support-1-844-880-6292/
1-855-246-5422
https://www.dbreaver.cf/call-for-microsoft-support-1-855-246-5422/
Old:
1-855-835-7333
https://www.bbreaver.cf/call-for-microsoft-support-1-855-835-7333/
1-877-286-9666
https://www.dbreaver.cf/call-for-microsoft-support-1-877-286-9666/
1-877-314-0111
https://www.dbreaver.cf/call-for-microsoft-support-1-877-314-0111/
They are very much operational, look at the adaross detection:
http://scammer.info/d/14851-adaross-scam-site-list-01-14-2019/
The numbers are the same with the addition to the new ones, the only difference is they are running with the two new sites https://www.bbreaver.cf/ and https://www.dbreaver.cf/
and the fact that https://www.yliber.cf/ is now down.
Adding */chx* or */firedgex* at the end of the URLS results in the Windows variant of the popup.
Adding */mac* at the end of the URLS results in the Apple Mac variant of the popup.