This cluster centers on 2382 connected domains tagged as PureHVNC, elf, sh. 572 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (8772427372, 1319641540, 1319641221) with 557 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2228 complaints with federal agencies. Geog...
Domain
www.paypal-promo.com
First seen Feb 24, 2026
Suspicious
- No SSL certificate
- 1 community report from users
Campaign Intelligence
This cluster centers on 2396 connected domains tagged as 156-233-71-230, Quakbot, lnk. 586 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (8772427372, 1319641540, 1319641221) with 565 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2237 complaints with federal agen...
This cluster centers on 1895 connected domains tagged as BeaverTail, RedLineStealer, password: 2026. 113 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 934 phone numbers (8772427372, 1319641540, 1319641221) with 524 FTC complaints; 683 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2093 complaints wit...
This cluster centers on 2416 connected domains tagged as BABADEDA, WallStealer, meterpreter. 607 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 969 phone numbers (5086371451, 9366439335, 1842506726) with 570 FTC complaints; 690 email addresses (kellymoore_64@yahoo.com, schantzsybg7@aol.com, online.motors@consultant.com). Across all linked entities, consumers have filed 2243 complaints with federa...
This cluster centers on 3287 connected domains tagged as HijackLoader, RemcosRAT, screenconnect. 617 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1649 phone numbers (5408463620, 8552597377, 8007873903) with 7110 FTC complaints; 143 companies (Informative LLC, HomePlus Corporation, Doral Capital Corporation) with 8547081 CFPB complaints; 807 email addresses (kellymoore_64@yahoo.com, schantzsybg7@...
Details
Related Domains
No known connections to other entities yet.
Community Reports
Easy Shortgame - Educational purposes only [Link](http://www.reddit.com/r/beermoney/comments/2ibsgl/free_paypal_25/) Set up: SE creates bogus paypal promo site, prays on broke college students, redditors, where ever posted. target is in a hurry for money doesn't research the site or even check the [homepage](https://www.paypal-promo.com) . Target must provide email, full name, and code to receive offer. SE provides a bogus code for free $25 credit, promised to be deposited within 24-48 hours to buy time before anyone realizes its a scam. Follow though: SE has name and email, but no password and not enough to get into paypal. paypal only resets password by email, txt, or automated call. SE searches facebook by either email or Full Name, finds key facts, pet name, maiden name, school, ect. Resets email password gains access to all email. SE resets paypal passcode. Endgame: SE has access to paypal account and can make purchases as you, credit card numbers, and if that wasn't enough SE can reset bank password the same way and have full access to all target's banking info. Through a couple filters vulnerable, perfect subjects are targeted. 1. Definitely has paypal to use site 2. Can be aimed toward broke people who are more desperate and therefor willing to test sketchy promo Say, worst case scenario, it works 1/50 targets. This is a quick game, can be repeated easily. This isn't exactly what occurred, but could have occurred. Real promo for media purposes, not general customers. No one lost any money unless they counted their chickens early. even then, they're just disappointed
4187 days ago8 upvotes
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.
Proton VPN — Block malicious sites and encrypt your connection
Proton VPN routes your traffic through encrypted servers and blocks known malware domains. Free plan available.
Get Proton VPNAffiliate link. We may earn a commission.