Scam Detective
Domain

www.gregthatcher.com

First seen Feb 22, 2026

Suspicious
  • No SSL certificate
  • 2 community reports from users

Campaign Intelligence

This cluster centers on 2382 connected domains tagged as PureHVNC, elf, sh. 572 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (8772427372, 1319641540, 1319641221) with 557 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2228 complaints with federal agencies. Geog...

This cluster centers on 2396 connected domains tagged as 156-233-71-230, Quakbot, lnk. 586 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (8772427372, 1319641540, 1319641221) with 565 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2237 complaints with federal agen...

This cluster centers on 1895 connected domains tagged as BeaverTail, RedLineStealer, password: 2026. 113 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 934 phone numbers (8772427372, 1319641540, 1319641221) with 524 FTC complaints; 683 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2093 complaints wit...

This cluster centers on 2416 connected domains tagged as BABADEDA, WallStealer, meterpreter. 607 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (5086371451, 9366439335, 1842506726) with 570 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2243 complaints with federa...

This cluster centers on 2764 connected domains tagged as BeaverTail, Kaiji, fbf543. 645 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1132 phone numbers (7638857447, 8664372914, 2157987305) with 10266 FTC complaints; 146 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8616274 CFPB complaints; 298 email addresses (xxxxxxxxxxxxxxxxxxxxxxxx@vm...

This cluster centers on 3287 connected domains tagged as HijackLoader, RemcosRAT, screenconnect. 617 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1649 phone numbers (5408463620, 8552597377, 8007873903) with 7110 FTC complaints; 143 companies (Informative LLC, HomePlus Corporation, Doral Capital Corporation) with 8547081 CFPB complaints; 807 email addresses (kellymoore_64@yahoo.com, schantzsybg7@...

This cluster centers on 2874 connected domains tagged as QuasarRAT, StealitStealer, pw-k53mv9bc. 652 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1375 phone numbers (2157987305, 2025069230, 2028641298) with 14635 FTC complaints; 160 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8680419 CFPB complaints; 299 email addresses (abuse@fb.com, ...

Details

First Seen
2/22/2026

Related Domains

No known connections to other entities yet.

Community Reports

Exposing a Craigslist Scammer A scammer responded to an ad I had on Craigslist. He sent me a $1650 check for a $100 item, along with a bullshit explanation about sending him the rest back. He sent me several pieces of bogus info which I think the Interwebs would enjoy knowing. I'll bet this guy would love to receive email offering to sell him stuff. It would be ironic if his fake addresses got all kinds of junk mail delivered to them as well, wouldn't it? (I presume they are just private PO boxes.) The email address he used: **khakimi65@gmail.com** The name he used: **Kevin Miller** The first "send the stuff to" address he sent me: RECEIVER'S NAME.....Dorian Roundtree Add.......................141 Washington Street City.......................St. Louis State.....................MO Zip code.................63114 The 2nd "send the stuff to" address he sent me: RECEIVER'S NAME.....Jose Flores Add.......................141 Washington Street City.......................Cloverdale State.....................CA Zip code.................95425 The name on the check he sent me: Wyoming Oral & Maxillofacial Surgery, PC 2nd Street Casper, Wyoming 82609 (It turns out there are a lot of Oral Surgeons on 2nd Street in Casper, WY. I guess he did a *little* work.) The bank info on the (fake) Check he sent me: **First Interstate Bank 18006th Ave. N. Billings, MT 59101** The routing number for the bank is completely bogus. It is: **102300129** One of the ways to detect a fake check is by the routing number, which will always start with the digits 092. You can look up legitimate routing numbers at [a lot of places](http://www.gregthatcher.com/Financial/). There was yet *another* fake address on the FedEx envelope he used to deliver the bogus check. (Yes, he actually paid to send me a fake check via FedEx.) He used the name of a real person at a real company. I don't know if her info has been hijacked or she's just an innocent dupe, but I contacted her to let her know.

4281 days ago3 upvotes

Exposing a Craigslist Scammer A scammer responded to an ad I had on Craigslist. He sent me a $1650 check for a $100 item, along with a bullshit explanation about sending him the rest back. He sent me several pieces of bogus info which I think the Interwebs would enjoy knowing. I'll bet this guy would love to receive email offering to sell him stuff. It would be ironic if his fake addresses got all kinds of junk mail delivered to them as well, wouldn't it? (I presume they are just private PO boxes.) The email address he used: **khakimi65@gmail.com** The name he used: **Kevin Miller** The first "send the stuff to" address he sent me: RECEIVER'S NAME.....Dorian Roundtree Add.......................141 Washington Street City.......................St. Louis State.....................MO Zip code.................63114 The 2nd "send the stuff to" address he sent me: RECEIVER'S NAME.....Jose Flores Add.......................141 Washington Street City.......................Cloverdale State.....................CA Zip code.................95425 The name on the check he sent me: Wyoming Oral & Maxillofacial Surgery, PC 2nd Street Casper, Wyoming 82609 (It turns out there are a lot of Oral Surgeons on 2nd Street in Casper, WY. I guess he did a *little* work.) The bank info on the (fake) Check he sent me: **First Interstate Bank 18006th Ave. N. Billings, MT 59101** The routing number for the bank is completely bogus. It is: **102300129** One of the ways to detect a fake check is by the routing number, which will always start with the digits 092. You can look up legitimate routing numbers at [a lot of places](http://www.gregthatcher.com/Financial/). There was yet *another* fake address on the FedEx envelope he used to deliver the bogus check. (Yes, he actually paid to send me a fake check via FedEx.) He used the name of a real person at a real company. I don't know if her info has been hijacked or she's just an innocent dupe, but I contacted her to let her know.

4281 days ago3 upvotes

Share Your Experience

What's Your Exposure?

Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.

Proton VPN Block malicious sites and encrypt your connection

Proton VPN routes your traffic through encrypted servers and blocks known malware domains. Free plan available.

Is www.gregthatcher.com safe? Check it now | Scam Detective