0800-014-8189 a2zpchelp.com / a2ztech.us scam “Windows Support” type number.

A recent post on a forum that I read highlighted another spammy tech support number, likely to trick users into thinking they are calling Yahoo, AVG etc… and charging them hundreds of pounds to fix issues.

0800-014-8189 (08000148189 448000148189 / +44-800-014-8189).
0800-756-3355 (08007563355 448007563355 / +44-800-756-3355).

They are also operating from these numbers as well in the USA:

+1-(888) 315-9643 (18883159643 / +1-888-315-9643)
+1-(888) 501-5570 (18885015570 / +1-888-501-5570)
+1-(855) 832-4406 (18558324406 / +1-855-832-4406)
+1-(800)-261-7658 (18002617658 / +1-800-261-7658)
+1-(925) 262-8519 (19252628519 / +1-925-262-8519 / 9252628519)

They seem to have a clever tactic of posting, as brand new users, on many UK based forums asking “is this number for Yahoo?” along with a problem like “I called them and they recovered my deleted emails”, which seems like a very strange thing to do, asking if its genuine after their problem has been successfully fixed.

It probably makes good SEO though. There seem to be hundreds of these similar or identical forum posts along with thousands of SEO type domains also touting this number:

https://www.google.co.uk/search?q=0800-014-8189

Upon further research this phone number seems to be related to a previous scam I’ve reported on… “The a2zpchelp.com scam”…

further a2ztech a2zpchelp scam

Upon clicking a supposed “Yahoo support” link on Google it shows a page with lots of spammy javascript to stop you leaving the page or changing the tab.
(The page is here http://a2zpchelp.com/macafee.html)

spamvertising fraud2

spamvertising fraud

Advising callers to call 08082387568 (0-808-238-7568 / +448082387568)

This time the website is hosted at GoDaddy on a shared server – 166.62.4.1 / “sg2nlhg744c1744.shr.prod.sin2.secureserver.net”

The domain – a2zpchelp.com is registered to “Lalit Sharma”, a different name to the other domain name involved a2ztech.us (hosted at 162.222.227.105).

Registrant Name: Lalit Sharma
Registrant Organization: N/A
Registrant Street: 4/37 Amba Bagh Near Kishan Ganj Opp. Kalra Sweets Hindi Academy
Registrant City: Delhi
Registrant State/Province: Other
Registrant Postal Code: 110007
Registrant Country: IN
Registrant Phone: +91.9899325698
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: micropchub@gmail.com

They also give the following postal address:

International Plaza,
Suite 550, Philadelphia – PA 19113

DNS leaks an e-mail address of “micropchub@gmail.com”.

Further searching around the internet digs up these domains also associated with the scam:

itmlab.net – Also seems to be involved with actually paying for AdWords adverts to gain visitors to their scam alert page. DNS leaks an e-mail address of “riteshraiseo@gmail.com”. This is related to another domain, itmindslab.com, which I explain further below in this article.
This domain has privacy protection applied to the domain whois information. It also gives out a postal address…

326, Corporate Parkway, Macon, GA – 31210, United States

janhitmejaari.com – Previously involved in paying for Bing adverts to drive traffic to the scam virus alert page during November 2014. However the page in question has been removed from the site now. This domain has whois information.

Registrant Name: IT Mlab
Registrant Organization: IT Mlab
Registrant Street: Los Angeles Los Angeles
Registrant City: Los Angeles
Registrant State/Province: California
Registrant Postal Code: 90095
Registrant Country: US
Registrant Phone: +91.9000000000
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ads@directorydoll.com

This domain seems to be hosted / proxied via CloudFlare, a DDoS protection service!

directorydoll.com – Related to the above domain registration and also points to the same server IP address as the itmlab.net and registered with the same domain whois information as the a2ztech.us. A screenshot of the page from november:

furtherscam janhitmejaari

The other domain in my previous article, a2ztech.us, is registered to just “Peter” in Florida in the USA. All the domains are registered via the same company, bigrock.com. One other domain is registered via GoDaddy and has privacy protection against the whois.

techpc247.com – This domain gives a different postal address:

1485 Treat Blvd
Suite 101 B
Walnut Creek California 94597
USA

However the old domain now gives out, mistakenly?, more information about the scam. The site is now an open list of files:
www a2ztech us directory listing

The View Source for one of the files is quite funny… they even have their scam message in the HTML source:

weird a2ztech source

They are operating under many fake brands, the one at the top of this article fakes McAfee.. there is one for Microsoft Security Essentials:

microsoft security essentials fake a2zpchelp scam

Other domains that are related via whois information used to register some of the above scam domains..

itmindslab.com – The main page claims to be a “Global IT Marketing Solutions Provider” providing web development, software development, SEO and other services. Their own page is hosting one of these scam virus notice pages! The domain is registered via a whois privacy service.
They give their address and phone number as:

Pandav Nagar
New Delhi 110092,
Tel: +011-22-48-32-69
Email: inquiry@itmindslab.com
Contact Person: Archana Rai

shiveshpratap.com – A guy called “Shivesh Pratap” an “Infotrainer, Biz-Tech Maven, HingLish Blogger, Motivational Speaker & Poet”. Whois info seems inaccurate:

Registrant Name: sps
Registrant Organization: sps ltd
Registrant Street: India Line 2: (Optional)
Registrant City: Banglore
Registrant State/Province: Karnataka
Registrant Postal Code: 560030
Registrant Country: IN
Registrant Phone: +91.8750091725
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: shiv@semesters.in

The website is hosted on 162.222.227.105, the same server that hosts the scam page a2ztech.us!

semesters.in – Linked to the above whois information, Looks like some kind of, either, cheatsheet for a course or course material. hosted on the same server that hosts the scam a2ztech.us page!

Update – 17th March 2015:

I called these people again.. this time the agent I got on the end of the phone.. in response to my “Are you Yahoo Support? I can’t get into my yahoo account” told me that I needed a firewall and tried to sell me £99 service for a year of an unknown firewall – supposedly Norton (half the price of his offer) doesn’t have a good enough firewall… anyway, much trolling was had.

The agent claims he was:

Name: Michael steaven
toll free – 1800-947-0614 / 18009470614
email – info@fewlogics.net

fewlogics scam 2

fewlogics scam

The domain, as with the ones above, is registered with bigrock and has the following registrant details:

Registrant Name: Tarun Kumar Singh
Registrant Organization: N/A
Registrant Street: 145 Bennington Street, Apt # 113
Registrant City: RIVERE
Registrant State/Province: Other
Registrant Postal Code: 02151
Registrant Country: US
Registrant Phone: +1.6173782011
Registrant Email: fewlogics@gmail.com

The website lists the following postal address:

427A Broadway, Everett, MA

http://www.fewlogics.net [74.208.94.1] – hosted at 1&1 Internet in the USA.

fewlogics.com also seems to be hosted on the same server and list the same postal address and whois details as .net but a different phone number of 1-800-210-0508 / 18002100508 or 617-544-3233 / 6175443233 / (617)5443233

I also noticed, while trolling another support llama company, that the a2z warning page has very similar design to another scam.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

6 Responses to 0800-014-8189 a2zpchelp.com / a2ztech.us scam “Windows Support” type number.

  1. Pingback: Two more “Windows” scam calls… | thecomputerperson

  2. Pingback: Norton Fake Phone Number – Tech Support Scam | thecomputerperson

  3. Alton J says:

    I’ve been hit with this scam HARD. I’ve had Geek Squad TRY and fix it but the problem persists. Any advise or recommendations would be a HUGE help. Thanks!!

  4. What problem remains and what has been tried?

  5. Alton J says:

    well…I have installed page blockers, Geek Squad ran a full test and reset my computer. Recently they just started popping up again. They went away for a spell and have returned. Thoughts? Thank you very much for writing on this. I thought I was going mad for a bit.

  6. Do you get them only when you load a web browser? Are you using Windows or Mac? What anti-virus do you use?

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s