Yahoo have a problem today where only 200 messages are being returned in IMAP requests so large folders never list all the mail.
While searching for information about the problem I came across their answers.yahoo.com forum section on Yahoo products.
It looks like this forum is plagued by fake support posts with non-Yahoo phone numbers.
In this case “des” responded to the question saying “Contact Genuine Yahoo Customer Support” and then an image containing a US telephone number:
+1-866-350-0239 (aka. 0018663500239)
When called they answer with the generic “Hello, Support” and when questioned “Are you Yahoo” his reply was “Yes, we support Yahoo”. So probably right on the edge of being iffy.
They then ask you to visit logmein123 and, when run, the program says “Pyramids IT”, clearly not Yahoo!. Very likely to be this company http://pyramidsit.net/services.html. The domain is registered using a whois / privacy protection service.
Their website claims their contact details are as follows:
40 North Caesar Avenue
At which point I hung up and closed my virtual machine.
Beware, upon more browsing I found many, many similar posts.
This one lists:
Yahoo even seem to allow the username “staff”, adding more weight to this scam :(
1888-927-1490 is answered by the same IVR as the first scam number. This time they request you to use http://www.support.me (logmein still) and the company showing on the client this time is “Trank Technologies”. Very likely to be this company: http://tranktechnologies.com/services.html
The domain is registered at GoDaddy under:
Registrant Name: Rashib Soni
Registrant Street: 1806,kamla nagar
Registrant City: New Delhi
Registrant State/Province: Delhi
Registrant Postal Code: 110007
Registrant Country: India
Registrant Phone: 8860021815
Registrant Email: email@example.com
Another email address associated with the domain is “firstname.lastname@example.org”
email@example.com (Gautam) notes that “We are a international call center based in Delhi & Kolkata.”
This gautam address is also associated with 121techhelp.com which seems to be a landing page for teamviewer, logmein and Amyuni support programs.
This domain also crops up in another tech support scam I’ve come across.
Also www.onestopsquad.com, another dubious support company based in India:
Address: 17 Micahill Rd., Levittown
PA 19056, USA
Phone: +1 800-817-1025
PO Box 44449, Brooklyn, OH 44144, USA
Telephone: +1 844-843-7779
FAX: +1 0123-4567-8900
Gautam has also been associated with dubious, but now expired, domains such as Login-aol-mail.com and gmailassist.com
1-866-350-0241 was answered by the same IVR and they requested that I use logmein, this time it was back to “Pyramids IT”
1800-256-7021 didn’t seem to ever get answered. Rang for ever.
Other numbers associated with the scam
1-844-528-4488 (18445284488) which is answered by the same IVR as all the others. Entertainingly enough the same guy I spoke to on 1-866-350-0241 answered this call! He even used the same name which I think was Mehdi.
-DIFFERENT COMPANY BELOW-
A different company who’s IVR announces “Support desk” and then the human clearly lied and said welcome to yahoo support. They spammed the number 1-888-224-8533 (18882248533) also advertising a UK number of +448003101049 (08003101049 / 0800 310 1049).
However the script of the call seems to start off very much identical to the other numbers.
Interestingly they used the “7 layers of security” which I’ve seen in a previous scam.
This seems to be www.securensupport.com running this particular scam..
Whois currently reads:
Registrant Name: Secure N Support
Registrant Organization: Kambro Technologies
Registrant Street: 4531 Laird Circle, Santa Clara CA 95054
Registrant City: Santa Clara
Registrant State/Province: California
Registrant Postal Code: 95054
Registrant Country: US
Registrant Phone: +1.8559126226
Registrant Email: firstname.lastname@example.org
Their website also gives the same contact details.
The domain is associated with “email@example.com”
+91 888 2222 677 USA – +1 8555 226 462
7, Building 5R/1, Near HDFC Bank, BK Chowk NIT Faridabad, Haryana – 121001
and also associated with tacoinfotech.com who give their address as:
+91-9582-51-5180 / +91-9873-97-1058
1/393, Lalita Park, Laxmi Nagar, New Delhi, Delhi 110092