This cybersecurity report details a sophisticated scam campaign utilizing a network of 12 domains, 3 phone numbers, and shared infrastructure to target consumers through fraudulent relief check claims and other deceptive schemes. The campaign centers around domains with names designed to mimic legitimate financial services, including www.reliefcheckhelp.com, www.mylostcheck.com, www.mycashlookup.com, and www.reliefcheck.com, all registered through NAMECHEAP INC. These domains operate alongside what appear to be unrelated e-commerce sites such as janycharm.com, lavishlywild.com, plushstore.co, and wuffypup.com, suggesting the operators are diversifying their fraudulent activities across multiple sectors.
The campaign's infrastructure shows extensive interconnection, with 18 documented relationships between entities sharing the same hosting infrastructure. Key domains like www.mylostcheck.com serve as central nodes, sharing infrastructure with janycharm.com, lavishlywild.com, simplytabs.com, lengingtree.com, and www.reliefcheckhelp.com. The phone numbers 928-218-8254, 917-924-3596, and 404-868-8288 have been reported together with www.reliefcheckhelp.com, indicating coordinated calling campaigns. Additionally, the presence of ACCOUNT SERVICES INC., a debt collection company with 8 CFPB complaints, suggests potential involvement in follow-up collection activities related to these scams.
Consumer impact data reveals active targeting through multiple channels. Phone number 404-868-8288 has generated 2 FTC complaints in the "Work from home & other ways to make money" category, with victims primarily located in Kingston, Georgia and Marietta, Georgia, indicating possible regional targeting of Georgia residents. Community reports document voicemail messages from "Dan from www.reliefcheckhelp.com" claiming victims have "$5286 waiting in a relief check," while other reports detail fraudulent e-commerce transactions through janycharm.com where consumers paid through PayPal but never received merchandise. The registration dates show most domains were created between November 30, 2025 and December 8, 2025, with the notable exception of www.reliefcheck.com registered in 2019, suggesting either a long-running operation or domain aging tactics.
To protect yourself from these scams, verify any claims about unclaimed money or relief checks through official government websites like usa.gov or treasury.gov rather than responding to unsolicited calls or visiting unfamiliar websites. If contacted by phone, hang up immediately and do not provide personal information. Never click links in suspicious emails or text messages. Before making purchases from unfamiliar websites, research the company through the Better Business Bureau and check for verified customer reviews on independent platforms. If you believe you've been targeted or victimized by this campaign, report it to the FTC at reportfraud.ftc.gov or file a complaint with the FCC. You can verify the safety of phone numbers and domains by checking them against known scam databases and consumer protection websites.
This campaign represents a high threat level due to its sophisticated infrastructure sharing, multi-vector approach combining voice calls and fraudulent websites, and active targeting of consumers with false relief check claims and fake e-commerce operations. Consumers should exercise extreme caution with any unsolicited communications mentioning unclaimed money or deals from unfamiliar websites. Law enforcement agencies and consumer protection organizations should prioritize investigation of the shared NAMECHEAP infrastructure and consider coordinated takedown actions across all connected domains to disrupt this network's operations.