New sites. https://sites.google.com/wallet-extension.com/phantomwallet/home
links to https://phountom.xyz/onboarding/ (no intermediate redirector site this time).
error page https://phountom.xyz/err/
The domain is registered to a “Mark Jackson” of Delhi, India.
Tawk.to web chat: https://tawk.to/chat/63fa3e854247f20fefe29f7f/1gq4o8fd4
this is the same tawk.to account that was used before here:
New sites: https://sites.google.com/coinbselogs.com/coinbasepro/home
links to https://cloyerssyment.com/7e64e35b-3949-4471-9411-0929c35b7628
which redirects to https://coinnbselog.azurewebsites.net/ ,
with the error page https://coinnbselog.azurewebsites.net/error.html .
Tawk.to web chat account https://tawk.to/chat/65ce2bd39131ed19d96d22a9/1hmmlmcl5 , the same as here:
Emily is online right now for your supports.
New tawk.to web chat account found at https://metaska.online/err/
New sites:
links to
https://charlesschwab_us.godaddysites.com/
which links to http://logg.liveonsite.xyz/charldffeschwabf/
tawk.to web chat account https://tawk.to/chat/658565a607843602b804b8d5/1hi8ha51l
Other phishing pages:
Error page https://antivirus.mcakey.com/error-installation/ , featuring tawk.to web chat account https://tawk.to/chat/65fdb11b1ec1082f04da33f3/1hpjfnlne .
“Fetal Error” sounds serious! Call the OB/GYN stat.
IP - 2a02:4780:b:1400:0:3688:c81c:10 
(Hostinger, Cyprus), also hosts
Albert Smith is active now, I am chatting with him.
Update: Call 801-753-9252 for Very Genuine McAfee Support. Agent Paul’s favorite color is black.
New sites:
https://sites.google.com/abcrypt.com/capitalone-login/home
links to the intermediate redirector https://gtly.to/PCyNI2qxC
which redirects to
error page
tawk.to web chat
https://tawk.to/chat/660da4fea0c6737bd1280f3d/1hqikp0u8
https://sites.google.com/1metamask-login.com/metamask-extension/home
links to https://gtly.to/TyyIvS365 , which redirects to
error page
tawk.to web chat
https://tawk.to/chat/65da625c8d261e1b5f6504c5/1hneh0eu8
(same as used here: Tracking bank/crypto phishing gang(s) using Google Sites, Tawk.to, MS Azure sites, Wordpress, etc - #83 by ElmerFudde2020 )
806-482-2621 Fake Capital One Bank etc.
New urls:
https://vwv.peoypal.com/error/
with Tawk.To web chat
https://tawk.to/chat/61a4c0959099530957f71fce/1fllp0ieg
“Albert Smith” at your service for all the accountings and the supports.
https://sites.google.com/codeacti.com/amazoncomcode/ has a new target page: it links to the intermediate referrer https://rebrand.ly/68c847 , which redirects to
with the error page
and the tawk.to chat account
https://tawk.to/chat/65a98d048d261e1b5f550a14/1hkf4tn5t
Jack is working late to service your needs, give him a chat!
Update: 315-754-4988 is still their number:
And another one:
https://rabbywallet.net/ uses Rabby wallet to redirect to Rabby wallet , with the error page Error! and the tawk.to chat account https://tawk.to/chat/65fff05aa0c6737bd12418c3/1hpns5p8a .
Another interesting website on the same IP address as many of these phishing sites:
https://bgp.he.net/ip/162.241.85.150#_dnsrecords
https://www.customershelponline.com/ which claims to be YouTube support and has a toll-free number (I get a busy signal so it may be obsolete or out of service).
This website was cited here years ago:
Page and web chat agent “Paul” still active as of 7 May 2024.
This sad abandoned web guestbook has almost daily spam postings from this phishing campaign, still ongoing.
Another website impersonating Coinbase:
Chat with Paul if you want to get scammed:
https://tawk.to/chat/65da5e078d261e1b5f65032a/1hnefujn6
(same tawk.to account as before, I have reported it many times but tawk.to does nothing.)
Same phishing page, new tawk.to account. Nobody’s biting for me right now, but it is Saturday.
Another website: https://veno.cosquare.xyz/logi/
Error page: Venom Wallet Error
Tawk.to chat widget: https://tawk.to/chat/63fa3e854247f20fefe29f7f/1gq4o8fd4
same tawk.to account as before:
and on the same IP address,
https://btdmarket.magik-jack.com/?s=e
with the same tawk.to account.
More new sites:
https://sites.google.com/metamaksio.com/metamaskwallet-extension/home and https://sites.google.com/metamaksio.com/metamaskwalletextension/home both link to the redirecting site Page not found - My Blog , which redirects to
This one collects the private key-phrase here MetaMask Wallet , then redirects to the legitimate website.
