This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...
857-283-6909
Last reported Mar 20, 2026
- 1 community report from users
Campaign Intelligence
Details
Linked Company Activity
Connected Entities
Linked Companies
PENTAGON FEDERAL CREDIT UNION
campaign co-membercompanyCredit Services Corporation, LLC
campaign co-membercompanyIntegrity Group Inc
campaign co-membercompanyDirect, Inc
campaign co-membercompanyThe Bureaus, Inc.
campaign co-membercompanyEVERBANK, NATIONAL ASSOCIATION
campaign co-membercompanyCheckr, Inc
campaign co-membercompanyMOUNTAIN AMERICA FEDERAL CREDIT UNION
campaign co-membercompanyFuture Financial Inc.
campaign co-membercompanyReady Capital Corporation
campaign co-membercompanyREGIONS FINANCIAL CORPORATION
campaign co-membercompanyThe Collection Agency LLC
campaign co-memberRelated Phone Numbers
8553572202
campaign co-memberphone3186669555
campaign co-memberphone8009220204
campaign co-memberphone6789998212
campaign co-memberphone8889194623
campaign co-memberphone8009993355
campaign co-memberphone8007715361
campaign co-memberphone8009033637
campaign co-memberphone8884260179
campaign co-memberphone2025582508
campaign co-memberphone3025417253
campaign co-memberphone8887910954
campaign co-memberphone7656119812
campaign co-memberphone3473635189
campaign co-memberphone6095276573
campaign co-memberphone9096341137
campaign co-memberphone4122148209
campaign co-memberphone8446863816
campaign co-memberphone2013652729
campaign co-memberphone4077347620
campaign co-memberphone8004727563
campaign co-memberphone6468099698
campaign co-memberphone2028008504
campaign co-memberphone8446312193
campaign co-memberRelated Domains
130.12.180.43
campaign co-memberdomainimplementing-theft-metal-justin.trycloudflare.com
campaign co-memberdomainstaying-heavily-meaning-blowing.trycloudflare.com
campaign co-memberdomaincreations-venture-traditional-stainless.trycloudflare.com
campaign co-memberdomain103.125.219.204
campaign co-memberdomain206.123.145.26
campaign co-memberdomainarilprivate.storexyz.web.id
campaign co-memberdomain14.236.182.73
campaign co-memberdomain83.224.162.132
campaign co-memberdomain123.31.81.229
campaign co-memberdomain120.157.56.105
campaign co-memberdomain113.176.132.141
campaign co-memberRelated Emails
diana@ierek.com
campaign co-memberemailcfjtfl@verxl.com
campaign co-memberemailcbx-df@ceszx.com
campaign co-memberemailj.thompson8822@ymail.com
campaign co-memberemailbb.adige@libero.it
campaign co-memberemailhr@teknfix.com
campaign co-memberemailpangmyiuhk@yahoo.co.jp
campaign co-memberemailmarydavis09@zoho.com
campaign co-memberemailidentity@varomoney.com
campaign co-memberemailservicename@nickname.tld
campaign co-memberemaila4084163@trbvm.com
campaign co-memberemaillegalnotice@facebookmail.com
campaign co-memberCommunity Reports
They created an elaborate operation with fake websites (animalz-tech.com, animalz-pro.com, etc.), professional "customer service" support, and a WhatsApp group of 25+ members sharing fake success stories. I was told to complete "tasks" that would earn commissions, but they systematically trapped me with "combination tasks" - scenarios requiring larger deposits to "unlock" my previous payments. The financial demands escalated relentlessly: $30 "reset fee," $108 for MetaMask setup, then wire transfers of $100, $1,700, $4,000, $9,500, and then was asked for $30,000 to complete my $60k income task. My total losses exceed $15,000. They finally demanded $30,000 for the "last combination task" promising $60,000 return. Every time I would respond to my "mentor" the Customer Service team would reach out stating I may lose/get my account "frozen" to pay the merchant. They coached me through cryptocurrency purchases and wire transfers using multiple wallets across different platforms. I have complete documentation of everything along with all chat messages, phone #'s and names "used". (ETH: 0x5e316f85e81aDE5f5533EBC9574f942db6e6B00f, SOL: CdTBSbps2LPrdmnbaBSFEPVGpiwkPNVHsVS45Nj7HXSG, BNB: 0x7809766Cc3B7CB83BE60acD77EC308174CDCEa62). The sophistication suggests organized international crime with professional infrastructure designed to systematically extract maximum funds from vulnerable people. Please investigate immediately as cryptocurrency assets may still be recoverable and other elderly victims need protection FRAUDULENT WEBSITES (Sequential Domain Migration): www.animalz-tech.com https://animalz-romote.com/ https://animalz-pro.com/ animalz-shopping.com PHONE NUMBERS USED: Initial SMS recruitment: +1 (857) 283-6909 ("Icelynn") Primary scammer: +1 (920) 548-0044 ("Ha [BBB Scam Type: Investment] [Business: Animalz] [Location: IL, USA- 61019]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.