Our cybersecurity team has identified a sophisticated multi-domain scam campaign operating through 10 interconnected websites, all registered through NAMECHEAP INC between November 30, 2025 and December 8, 2025. The primary domains in this network include www.mylostcheck.com, www.reliefcheckhelp.com, janycharm.com, lavishlywild.com, simplytabs.com, lengingtree.com, buycurae.com, plushstore.co, wuffypup.com, and lostcheck.com. These domains share the same underlying infrastructure across 19 documented connections, indicating coordinated operation by the same threat actors.
The campaign employs multiple deceptive tactics targeting different consumer segments. The relief check component uses domains like www.mylostcheck.com and www.reliefcheckhelp.com to impersonate government assistance programs, with community reports documenting fraudulent messages from "Dan" claiming consumers have "$5286 waiting in a relief check that's already been issued in your name, but has not yet been collected." Simultaneously, the network operates fake e-commerce sites including janycharm.com and plushstore.co, with one consumer reporting ordering clothing through janycharm.com via YouTube advertisements, only to have their debit card compromised after payment through PayPal.
Consumer reports indicate this campaign is actively targeting victims through multiple channels including direct messaging and social media advertising. The rapid domain registration timeline, with all domains created within an 8-day window, demonstrates the coordinated nature of this operation. The shared infrastructure across all domains allows the scammers to quickly pivot between different fraud schemes while maintaining operational continuity.
To protect yourself from this campaign, never click on links in unsolicited messages about government relief checks or respond to unexpected communications about unclaimed funds. Legitimate government agencies do not contact consumers through unofficial websites or text messages about relief payments. Before making purchases from unfamiliar e-commerce sites, verify the company's legitimacy through independent research and check domain registration dates - newly registered domains advertising deals are often fraudulent. If you receive suspicious communications, hang up immediately, do not click any links, and report the incident to the FTC at reportfraud.ftc.gov or to the FCC for unwanted calls and texts. You can verify if a phone number or domain is associated with known scams by checking consumer protection databases and searching for the entity name plus "scam" in search engines.
This campaign represents a high-threat, actively evolving fraud operation with significant consumer impact potential. The coordinated infrastructure and multi-vector approach indicate sophisticated threat actors capable of rapid adaptation. Consumers should exercise extreme caution with any communications referencing relief checks or deals from the identified domains. We recommend blocking all associated domains and reporting any contact attempts to federal authorities immediately.