This cluster centers on 3287 connected domains tagged as HijackLoader, RemcosRAT, screenconnect. 617 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1649 phone numbers (5408463620, 8552597377, 8007873903) with 7110 FTC complaints; 143 companies (Informative LLC, HomePlus Corporation, Doral Capital Corporation) with 8547081 CFPB complaints; 807 email addresses (kellymoore_64@yahoo.com, schantzsybg7@...
(512) 880-2969
Last reported Mar 20, 2026
- 1 community report from users
Campaign Intelligence
Details
Connected Entities
No known connections to other entities yet.
Community Reports
Scammer posted a Craigslist ad for a relatively new LG refrigerator for $400, which was well below market value. I messaged the contact number, (512-880-2969) and the scammer responded with an address and a meeting time for later that day. Scammer claimed to be selling the refrigerator after a move because the new rental already had appliances. Soon thereafter, the scammer texted that another potential buyer was going to be meeting first. But with a deposit he could hold the refrigerator for me. He said he did not have access to typical pay apps (Venmo, PayPal, Zelle) and could only accept a Bitcoin payment. I offered to pay cash, but the scammer continued to reference the other buyer and needed an immediate payment. He even sent a supposed selfie of himself holding a Texas driver's license with the name Matthew *** *********. I sent $200 via crypto, He even called me and we spoke to confirm the meeting to complete payment. A short time later, he texted me again about the other buyer, who was now offering to pay the full amount. I could still get it if I paid in full, he said. I paid the remaining amount via crypto. When that transaction was delayed for processing, the scammer said I could deposit cash at an ATM inside a sketchy smoke shop. That's when I realized I had been scammed. A few key details that the scammer used that match another report: He constantly references checking with his wife about the other buyer, and he says they are at his in-laws' house for the day while working through the negotiation. .css-c8hvdp{--Grid-columns:12;-webkit-flex-direction:row;-ms-flex-direction:row;flex-direction:row;min-width:0;box-sizing:border-box;display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-box-flex-wrap:wrap;-webkit-flex-wrap:wrap;-ms-flex-wrap:wrap;flex-wrap:wrap;gap:var(--Grid-rowSpacing) [BBB Scam Type: Online Purchase] [Business: Matthew Jon Worthington] [Location: NV, USA- 89012]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.
Proton VPN — Block malicious sites and encrypt your connection
Proton VPN routes your traffic through encrypted servers and blocks known malware domains. Free plan available.