This cluster centers on 2764 connected domains tagged as BeaverTail, Kaiji, fbf543. 645 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1132 phone numbers (7638857447, 8664372914, 2157987305) with 10266 FTC complaints; 146 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8616274 CFPB complaints; 298 email addresses (xxxxxxxxxxxxxxxxxxxxxxxx@vm...
(480) 624-2599
Last reported Mar 27, 2026
- 3 community reports from users
Campaign Intelligence
This cluster centers on 2874 connected domains tagged as QuasarRAT, StealitStealer, pw-k53mv9bc. 652 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1375 phone numbers (2157987305, 2025069230, 2028641298) with 14635 FTC complaints; 160 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8680419 CFPB complaints; 299 email addresses (abuse@fb.com, ...
This cluster centers on 1486 connected domains tagged as None, keylogger. 5 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1364 phone numbers (3124141737, 3163966869, 8553892999) with 17909 FTC complaints; 170 companies (EQUIFAX, INC., TRANSUNION INTERMEDIATE HOLDINGS, INC., BANK OF AMERICA, NATIONAL ASSOCIATION) with 8747332 CFPB complaints; 187 email addresses (xxxxxxxxxxxxxxxxxxxxxxxx@vmh5.grup...
This cybersecurity analysis reveals a coordinated debt collection scam campaign operating through a network of five interconnected phone numbers: 4806242599, 3072268326, 2133170966, 8776840410, and 8883809079. Despite none of these numbers having recorded FTC complaints, they are connected through shared campaign infrastructure with a confidence level of 0.70. The operation appears to leverage legitimate debt collection companies as cover, with ACCOUNT SERVICES INC. (8 CFPB complaints) being rep...
Details
Linked Company Activity
Connected Entities
Linked Companies
Related Phone Numbers
Community Reports
No contact was directly by the scammer, instead, an unknown charge appeared on a credit card statement. Research shows the GoDaddy account was established during October 2025, but that the telephone number, (480) 624-2599, has been used repeatedly since 1999 for various scammer accounts. GoDaddy Whois information states the business location to be listed as DomainsByProxy.com 100 S. Mill Ave, Suite 1600, Tempe, Arizona, 85281. Other detailed information about the website by GoDaddy at https://www.godaddy.com/whois/results.aspx?itc=dlp_domain_whois&domain=recovercharge.com [BBB Scam Type: Credit Cards] [Business: Recover Charges] [Location: AL, USA- 35806]
Unsolicited mail arrived at my rental house in my name. Strange as I have never lived at that address. There was visible in the clear window, a fake check made out in my name. My house is not for sale and public data was scraped to associate the house in my name. The address showed Southern Home Buyers, 340 B Monroe Ave, Memphis, TN 38105 with a Presorted Standard US Postage Paid Sacramento, CA Permit 1935. An internet search revealed the scam. southernusahomebuyers.com Technical Analysis Key Facts Domain age 5 months Company Data Organization Domains By Proxy, LLC Owner Registration Private Address DomainsByProxy.com, 100 S. Mill Ave, Suite 1600 State Arizona Country US E-mail https://www.godaddy.com/whois/results.aspx?domain=southernusahomebuyers.com&action=contactDomainOwner Telephone +1.4806242599 Website Data Website southernusahomebuyers.com SSL certificate valid 2025-08-20 SSL issuer GoDaddy.com, Inc. WHOIS registration date 2025-01-21 WHOIS last update date 2025-01-21 WHOIS renew date 2026-01-21 Owner Name Registration Private Organization Domains By Proxy, LLC Street DomainsByProxy.com, 100 S. Mill Ave, Suite 1600 State Arizona Country US Telephone +1.4806242599 .css-1w6dufj{-webkit-box-flex:0;-webkit-flex-grow:0;-ms-flex-positive:0;flex-grow:0;-webkit-flex-basis:auto;-ms-flex-preferred-size:auto;flex-basis:auto;width:calc(100% * 12 / var(-- [BBB Scam Type: Other] [Business: Southern USA Home Buyers 340 B Monroe Ave Memphis TN 38112] [Location: MS, USA- 38680]
An unsolicited postal mail arrived to my rental house in my name. I have never lived there. Public records associated me with that property address. A fake check made out in my name was visible in a clear window on the mail The Return address on the mail was Southern USA Home Buyers 340 B Monroe Ave Memphis TN 38105, An internet search revealed these facts of the scam running for 5 months registered in Arizona. southernusahomebuyers.com Technical Analysis Key Facts Domain age 5 months Company Data Organization Domains By Proxy, LLC Owner Registration Private Address DomainsByProxy.com, 100 S. Mill Ave, Suite 1600 State Arizona Country US E-mail https://www.godaddy.com/whois/results.aspx?domain=southernusahomebuyers.com&action=contactDomainOwner Telephone +1.4806242599 Website Data Website southernusahomebuyers.com SSL certificate valid 2025-08-20 SSL issuer GoDaddy.com, Inc. WHOIS registration date 2025-01-21 WHOIS last update date 2025-01-21 WHOIS renew date 2026-01-21 Owner Name Registration Private Organization Domains By Proxy, LLC Street DomainsByProxy.com, 100 S. Mill Ave, Suite 1600 State Arizona Country US Telephone +1.4806242599 .css-1w6dufj{-webkit-box-flex:0;-webkit-flex-grow:0;-ms-flex-positive:0;flex-grow:0;-webkit-flex-basis:auto;-ms-flex-preferred-size:auto;flex-basis:auto;width:calc(100% * 12 / var(--Grid-parent-columns) - (var(--Grid [BBB Scam Type: Other] [Business: Southern USA Home Buyers] [Location: MS, USA- 38680]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.
NordVPN — Block threats and hide your IP from trackers
NordVPN encrypts your internet traffic and blocks malicious websites, ads, and trackers before they reach your device.