This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...
800-209-5527
Last reported Apr 15, 2026
- 31 community reports from users
Campaign Intelligence
This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...
This cybersecurity analysis examines a banking impersonation scam campaign centered around fraudulent calls claiming to represent Fifth Third Financial Corporation. The campaign utilizes phone number 8002095527, which has generated 0 FTC complaints but appears in multiple community fraud reports. Fifth Third Financial Corporation, a legitimate banking institution with 14,113 CFPB complaints in the checking or savings account sector, is being impersonated by scammers who are also connected to Acc...
This scam campaign centers around Mortgage Research Center, LLC and two associated companies that collectively operate a sophisticated mail-based solicitation scheme targeting homeowners and vehicle owners. The primary entity, Mortgage Research Center, LLC, has generated 595 CFPB complaints in the mortgage industry, while its connected entities United Group Inc. and United Home Loan Services Inc. have accumulated 75 and 3 CFPB complaints respectively in vehicle loan and mortgage sectors. These c...
**Mortgage Relief Scam Campaign Targets Homeowners with Fraudulent Correspondence** A coordinated scam campaign is targeting homeowners through deceptive mail correspondence that mimics legitimate mortgage relief communications. The operation utilizes two connected phone numbers: 800-209-5527 for English-speaking victims and 888-572-0611 for Spanish-speaking targets. These numbers are linked through community reports with a confidence level of 0.59, indicating they are part of the same fraudule...
Details
Linked Company Activity
Connected Entities
Linked Companies
My Mortgage, Inc.
reported togethercompanyFlagstar Bank, N.A.
campaign co-membercompanyFirst Credit Services Inc.
campaign co-membercompanyPENTAGON FEDERAL CREDIT UNION
campaign co-membercompanyFIFTH THIRD FINANCIAL CORPORATION
campaign co-membercompanyCredit Services Corporation, LLC
campaign co-membercompanyIntegrity Group Inc
campaign co-membercompanyThe Bureaus, Inc.
campaign co-membercompanyDirect, Inc
campaign co-membercompanyTime Investment Corporation
campaign co-membercompanyEVERBANK, NATIONAL ASSOCIATION
campaign co-membercompanyCheckr, Inc
campaign co-memberRelated Phone Numbers
8557397810
campaign co-memberphone4154236379
campaign co-memberphone4097617631
campaign co-memberphone8882745552
campaign co-memberphone8773824357
campaign co-memberphone4806606572
campaign co-memberphone8446657222
campaign co-memberphone2233002233
campaign co-memberphone8967530024
campaign co-memberphone2289803131
campaign co-memberphone8887291403
campaign co-memberphone8502779873
campaign co-memberphone9148779868
campaign co-memberphone5715481682
campaign co-memberphone5162394413
campaign co-memberphone8008571567
campaign co-memberphone4046696656
campaign co-memberphone3486156058
campaign co-memberphone6503809008
campaign co-memberphone2542989940
campaign co-memberphone8472464299
campaign co-memberphone8502347642
campaign co-memberphone6026792050
campaign co-memberphone8704567472
campaign co-memberRelated Domains
130.12.180.43
campaign co-memberdomainimplementing-theft-metal-justin.trycloudflare.com
campaign co-memberdomainstaying-heavily-meaning-blowing.trycloudflare.com
campaign co-memberdomaincreations-venture-traditional-stainless.trycloudflare.com
campaign co-memberdomain103.125.219.204
campaign co-memberdomain206.123.145.26
campaign co-memberdomainarilprivate.storexyz.web.id
campaign co-memberdomain14.236.182.73
campaign co-memberdomain83.224.162.132
campaign co-memberdomain123.31.81.229
campaign co-memberdomain120.157.56.105
campaign co-memberdomain113.176.132.141
campaign co-memberRelated Emails
saclaimingdpt@e-mail.ua
campaign co-memberemailvictor7@luckymail.com
campaign co-memberemailbsood@goodstart.org.au
campaign co-memberemailm0ercia1@yahoo.co.jp
campaign co-memberemailadmin@ibookingpms.com.br
campaign co-memberemail_reply@geico.com
campaign co-memberemailabuse@telus.com
campaign co-memberemailmem.....@....soft.com
campaign co-memberemailgeral@jogodigital.com
campaign co-memberemailaccount@microsoft.info
campaign co-memberemailcs18entertainment@sadronsutra.com
campaign co-memberemailcorrectprefix@phishersowndomain.net
campaign co-memberCommunity Reports
recived letter in postal mail claiming to be my finance company of my mortgage. Gave my property address and the mortgage brokerage company that created the loan (not the lender). Letter said: "This is to inform you about an important matter regarding the property at (my full property address) secured by your current lender which is (my mortgage broker not a lender institution). We reserve the right to revoke allocation waiver after 7 days of receiving this notice. Call immediately as this will be our FINAL ATTEMPT TO NOTIFY YOU 1-800-209-5527." Called the number and it was a Medical Alert promotional for Free medical alert bracelet if over 50. [BBB Scam Type: Phishing] [Business: Property Allocated Waiver Date Repor] [Location: WA, USA - 98387]
Received letter stating the message below. This letter is to inform you about an important matter regarding the property at (my address) secured by your current lender which is Jp Morgan Chase Bank. We reserve the right to revoke allocated waiver after 7 days of receiving this notice. Please Call IMMEDIATELY as this will be our FINAL ATTEMPT TO NOTIFY YOU 1-800-209-5527. [BBB Scam Type: Debt Collections] [Business: Not provided] [Location: GA, USA - 30518]
Received a suspicious “final notice” letter claiming to be from a “Private Lender” regarding a property. The letter, dated 11/25/2025, included a fake perforated check for $199 labeled “Allocated Waiver” and urged immediate contact at a toll-free number (1-800-209-5527) to avoid revocation of the waiver within 7 days. It featured a generic “Home Owner ID” (e.g., CH05200123), vague property details, and phrases like “IMMEDIATE RESPONSE REQUESTED” to create urgency. A disclaimer stating, “THIS IS NOT A CHECK” and “Not affiliated with Private Lender,” raising red flags. No legitimate lender or mortgage company was named, and the language was filled with jargon (e.g., “allocated waiver”) without substance. The phone number and letter format match reports of mail-based phishing scams targeting recent homeowners, likely using public real estate records. Avoid calling or cashing the check, as it’s a tactic to harvest personal information or money. [BBB Scam Type: Other] [Business: No clear business name used. Implies its affiliated without mortgage lender through didn't name it.] [Location: OH, USA - 45122]
Received a suspicious “final notice” letter claiming to be from a “Private Lender” regarding a property. The letter, dated 11/25/2025, included a fake perforated check for $199 labeled “Allocated Waiver” and urged immediate contact at a toll-free number (1-800-209-5527) to avoid revocation of the waiver within 7 days. It featured a generic “Home Owner ID” (e.g., CH6883281), vague property details, and phrases like “IMMEDIATE RESPONSE REQUESTED” to create urgency. The letter included a disclaimer stating “THIS IS NOT A CHECK” and “Not affiliated with Private Lender,” raising red flags. While a legitimate lender or mortgage company was named, and the language was filled with jargon (e.g., “allocated waiver”) without substance, the lender listed is not the current holder of the homeowner's mortgage, but rather is the one that can be found in public records. The phone number and letter format match reports of mail-based phishing scams targeting recent homeowners, likely using public real estate records. Avoid calling or cashing the check, as it’s a tactic to harvest personal information or money. [BBB Scam Type: Phishing] [Business: Unknown] [Location: MA, USA - 01824]
An unidentifiable company sent a realistic check for 199.00 saying it was for a waiver and it will be revoked in 7 days. Final attempts and call immediately are all over the document. Phone number to call is 1800-209-5527. Targeted Pers [BBB Scam Type: Other] [Business: Unidentifiable company] [Location: MD, USA - 21009]
Mail notice implying that there is an issue with your Mortgage and that "Immediate Response to this notice requested" also says "This will be our FINAL ATTEMPT TO NOTIFY YOU 1-800-209-5527" [BBB Scam Type: Phishing] [Business: Quicken Loans / Impostor] [Location: WA, USA - 98038]
I received a letter which included a fake check. It included the name of my mortgage lender and stated that the "letter is to inform you about an important matter regarding the property at [my property address] secured by your lender which is [lender name]. We reserve the right to revoke allocated waiver after 7 days of receiving this notice." It included a fake check or "Allocated Waiver" for $199.00 with a fake Home Owner ID. There is no company name or contact information except for instructions to call 1-800-209-5527. [BBB Scam Type: Other] [Business: Unknown] [Location: TX, USA - 78748]
Received a suspicious “final notice” letter claiming to be from a “Private Lender” regarding a property. The letter, dated 12/30/2025, included a fake perforated check for $199 labeled “Allocated Waiver” and urged immediate contact at a toll-free number (1-800-209-5527) to avoid revocation of the waiver within 7 days. It featured a generic “Home Owner ID”, vague property details, and phrases like “IMMEDIATE RESPONSE REQUESTED” to create urgency. The letter included a disclaimer stating “THIS IS NOT A CHECK” and “Not affiliated with Private Lender,” raising red flags. My mortgage lender was named, and the language was filled with jargon (e.g., “allocated waiver”) without substance. The phone number and letter format match reports of mail-based phishing scams targeting recent homeowners, likely using public real estate records. Avoid calling or cashing the check, as it’s a tactic to harvest personal information or money. [BBB Scam Type: Fake Check/Money Order] [Business: Allocated Waiver] [Location: OR, USA - 97211]
Received a letter saying sensitive, immediate response requested and lender info with our mortgage lender listed on outside and our names and address listed on see through portion of envelope. Says Final Notice on inside with a date, contact phone 800-209-5527 on inside and a home owner id. Attention to us with our property address our lender info and a waiver lthat looks like a check with a value of $199.00. Place for a siganture. Says underneath not affiliated with our lender and that it's not a check. [BBB Scam Type: Fake Check/Money Order] [Business: Property Allocated Waiver Date Repo] [Location: OR, USA - 97219]
Received a suspicious “final notice” letter implying it was an official document regarding my mortgage. The letter, dated 1/7/2026, included a fake perforated check for $199 labeled “Allocated Waiver” and urged immediate contact at a toll-free number (1-800-209-5527) to avoid revocation of the waiver within 7 days. It featured a generic “Home Owner ID” (e.g., CHXXXXXXX), vague property details, and phrases like “IMMEDIATE RESPONSE REQUESTED" and "FINAL NOTICE." The letter included a disclaimer stating “THIS IS NOT A CHECK” and “Not affiliated with Private Lender." [BBB Scam Type: Phishing] [Business: None it only listed my home lender name it was not from my lender] [Location: IL, USA - 60096]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.