Yet another Microsoft Support Scam

Another customer, another support caller scammer.. this time:

08000314014
Email address support@thetechhelpline.co.uk
Remote Support site: http://www.onesupport.me/

Did the standard connect, show them the event viewer with the “scary errors”, showed them the services list with lots of stopped services “scary!” and then a netstat showing “hackers connecting to their computer”.

OneSupport.me whos informatio is hidden by GoDaddy’s privacy service but the NameServers it references, NS2.PAGENIE.COM and NS2.PAGENIE.COM, seem to relate to a domain that was once used for Image Editing outsourcing work (twinned with tech support type businesses). The domain is also protected by the same GoDaddy whois privacy service. The two domains are also hosted on the same IP.

162.144.126.128 (“162-144-126-128.unifiedlayer.com”). This is also where the two nameserver hostnames point to.

paGenie once gave their contact details as +1 800 935 0798 / 18009350798 and did not list a postal address.

Their e-mail domain, thetechhelpline.co.uk, gives away more information.

Registrant:
Sidharth Banthia

Registrant’s address:
Synthesis Business Park,Action Area-II
Newtown, Rajarhat
Kolkata
700157
India

Data validation:
Registrant contact details validated by registrar on 10-Dec-2014

Registrar:
Namesco Limited [Tag = NAMESCO]
URL: http://www.names.co.uk

Relevant dates:
Registered on: 26-Oct-2013
Expiry date: 26-Oct-2016
Last updated: 10-Dec-2014

Name servers:
ns6243.hostgator.com
ns6244.hostgator.com

Their website doesn’t mention an address but they give their contact phone number as the one they also gave to my customer over the phone and the “Connect to Technician” link takes you to the above mentioned onesupport.me domain.

thetechhelpline.co.uk website also leaks another domain – resqnow.com also registered at GoDaddy and using the paginie nameservers but without whois privacy applied:

Registrant Name: Ty Freeborn
Registrant Organization: Multimedia Enterprises
Registrant Street: 177 Broken Putter Way
Registrant City: Las Vegas
Registrant State/Province: NV
Registrant Postal Code: 89148
Registrant Country: United States
Registrant Phone: +1.7024493025
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: tfreeborn@hotmail.com

thetechhelpline.co.uk is hosted at 192.254.188.248 (no reverse dns) at HostGator. This same IP also has the following domains pointing to it.. most look very suspicious:

123pcsecure.com:
Lists a phone number of 1 800 878 2302 / 18008782302 and says the website is “under construction”.

askpcwizards.com – Just an under construction notice

helptech247.com:
Lists a phone number of 1 800 935 0714 / 18009350714 and no postal address. Uses LogMeIn Rescue to connect to victim computers.

myexpertfinance.com – Directory listing / No pages.

onlinepcsecure.com – Just an under construction notice

onlinepcwizards.com:
Lists a phone number of 1800 878 2302 / 18008782302, Uses LogMeIn Rescue to connect to victim computers, and a postal address…

Address : 9350 S. Cimarron Rd. #4104
City : Las Vegas
State : NV
Zip : 89178

pcgeniepro.com – Gives their phone number as 1 800 935 0798, same as the now-offline paGinie.com site used to. Doesn’t list a postal address. Does try to give you a PC cleanup program.

pcspeedy.com – Lists their phone number as 1 855 264 9273 / 18552649273 and doesn’t list a postal address. The Chat function takes you to a thetechhelpline.co.uk branded chat window.

resqnow.com – Lists their phone number as 1 844 567 7342 / 18445677342 and not postal address. See above for whois information.

supportsapiens.com – Almost a copy and paste version of the resqnow.com site, lists their phone number as 1 844 287 3437 / 18442873437, no postal address, uses a GoToAssist subscription branded as thetechhelpline.co.uk.

wizardrealty.in – An unrelated website or a “client’s” website? Real Estate company in Kolkata, India. Most of the site is holding text. Lists a phone number of +919230015140

http://www.qualitymaintenanceservices.co.uk – An unrelated website or a “client’s” website? A cleaning company in Coventry in the UK. The domain is registered under the name “Kamaljit Kaila” and points to the same HostGator account as the above domains.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

4 Responses to Yet another Microsoft Support Scam

  1. G man says:

    The same scammers are still operating, unfortunately. But from phone number 01582570172. Directed me to onesupport.me and I promptly told them to go forth and multiply.

  2. Mary Tilton says:

    This [profanity removed] are doing scam by using The name as “The Tech Help Desk” They have based in Kolkata,India…there address is mentioned in the above…..

  3. Anon says:

    I just had a call from these scammers. Usual story, you have errors on your computer and we can take care of them blah blah blah. They told me their office is in vegas, as well as a virtual head office in London and gave me the phone number for the UK 0800 031 4140, the guy said his name was EDHAN and his work I.D. no is eb00157 Most likely fake info on his part, but I did at least do his head in acting thick. When I refused to give them access he said it would cost me £400 to get my computer fixed if I took it to a computer store. I told him he dont have a clue what he is talking about and hung up. Rather annoying that some clown has my home number who lives in India though.

  4. R from MS BI says:

    I also received a call from tech help desk. Ironically, at the time he called I was reviewing event logs from one of our servers. I was able to keep him busy for 30 minutes on the side while I was doing real work and then my son came home and we started to sing Sponge bob Squarepants theme song. He hung up.

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s