This cluster centers on 2451 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include cdn.discordapp.com, 91.92.241.152, 91.92.240.222, 158.94.208.174, 178.16.52.44, 158.94.211.102, 158.94.210.93, 158.94.208.52, i.postimg.cc, s3.us-east-2.amazonaws.com, storage.googleapis.com, 178.16.52.18, 158.94.211.101, 158.94.211.100, local-host.life, dropmefiles.com, limewire.com, 62.60.226.159, id8965.com, valfanto.com and 2431 more. 633 of these domains have been flagged by threat int...
866-256-0821
Last reported Apr 21, 2026
- 2 community reports from users
Campaign Intelligence
This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...
Cybersecurity analysts have identified a coordinated scam campaign centered around fraudulent banking communications that impersonate legitimate financial institutions. This campaign utilizes three core entities working in tandem: the phone number 866-256-0821, the domain alerts.com, and the email address boa@alerts.com. The email address appears designed to mimic Bank of America communications through its "boa" prefix while using the generic alerts.com domain to create an impression of legitima...
This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...
This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...
Details
Linked Company Activity
Connected Entities
Linked Companies
ACCOUNT SERVICES INC.
reported togethercompanyTRANSUNION INTERMEDIATE HOLDINGS, INC.
reported togethercompanyEQUIFAX, INC.
reported togethercompanyCredit Corp Solutions Inc.
reported togethercompanyInnovis
reported togethercompanyFlagstar Bank, N.A.
campaign co-membercompanyFirst Credit Services Inc.
campaign co-membercompanyPENTAGON FEDERAL CREDIT UNION
campaign co-membercompanyFIFTH THIRD FINANCIAL CORPORATION
campaign co-membercompanyCredit Services Corporation, LLC
campaign co-membercompanyIntegrity Group Inc
campaign co-membercompanyDirect, Inc
campaign co-memberRelated Phone Numbers
8553572202
campaign co-memberphone3186669555
campaign co-memberphone8667715844
campaign co-memberphone8339086865
campaign co-memberphone8009220204
campaign co-memberphone4097617631
campaign co-memberphone6789998212
campaign co-memberphone6512042449
campaign co-memberphone5187704680
campaign co-memberphone8887291403
campaign co-memberphone8889194623
campaign co-memberphone9805107108
campaign co-memberphone7712473445
campaign co-memberphone5858247925
campaign co-memberphone8009993355
campaign co-memberphone8007715361
campaign co-memberphone8009033637
campaign co-memberphone8884260179
campaign co-memberphone2025582508
campaign co-memberphone9297499563
campaign co-memberphone3025417253
campaign co-memberphone8887910954
campaign co-memberphone8334471291
campaign co-memberphone7656119812
campaign co-memberRelated Domains
alerts.com
reported togetherdomain130.12.180.43
campaign co-memberdomainimplementing-theft-metal-justin.trycloudflare.com
campaign co-memberdomainstaying-heavily-meaning-blowing.trycloudflare.com
campaign co-memberdomaincreations-venture-traditional-stainless.trycloudflare.com
campaign co-memberdomain103.125.219.204
campaign co-memberdomain206.123.145.26
campaign co-memberdomainarilprivate.storexyz.web.id
campaign co-memberdomain14.236.182.73
campaign co-memberdomain83.224.162.132
campaign co-memberdomain123.31.81.229
campaign co-memberdomain120.157.56.105
campaign co-memberRelated Emails
boa@alerts.com
reported togetheremaildiana@ierek.com
campaign co-memberemailcfjtfl@verxl.com
campaign co-memberemailcbx-df@ceszx.com
campaign co-memberemailj.thompson8822@ymail.com
campaign co-memberemailbb.adige@libero.it
campaign co-memberemailhr@teknfix.com
campaign co-memberemailpangmyiuhk@yahoo.co.jp
campaign co-memberemailmarydavis09@zoho.com
campaign co-memberemailidentity@varomoney.com
campaign co-memberemailservicename@nickname.tld
campaign co-memberemailxxxxxxxxxxxxxxxxxxxxxxxx@vmh5.grupoaldama.com.mx
campaign co-memberCommunity Reports
Would like some insight about exposure after a scam Hi all — not great that I (or anyone) need this sub, but I’m glad there’s a community of people who have gone through similar things so there’s less of a stigma and more problem-solving here. A few days ago, I received a text message from boa@alerts.com stating: “/ BofA / Fraud - A hold has been placed on your debit-card. Please call 866.256.0821 to resolve this issue. To unsubscribe, reply STOP.” I didn’t reply STOP, but instead called the number, where an automated voice asked me to enter (using the keypad) (1) my BOA debit card number; (2) CVV; (3) expiry date; and (4) SSN. I entered all of these, but I felt that there was something off after entering my SSN and hung up immediately. I locked my debit card later that day. Last night, I called BoA, and their fraud dept informed me there was no department associated with that number. They have canceled that card and are sending me a new one in the mail. This was a debit card linked to a checking account. To my knowledge, there have been no attempts to open new credit cards, nor have there been any strange charges on any of my accounts. Last night, I placed a credit freeze on Equifax Experion, Transunion, Innovis, and the Chex one (sorry, I’m on my phone and can’t look it up without deleting this text.) I also contacted Chase, my credit card company, and they have put additional security measures in place for my account. I’m planning also getting an ID PIN from the IRS soon, but I am abroad and either the website is crashing by itself or they have security measures to prevent accessing those pages from abroad (which would make sense). For context, I don’t have any mortgages, student loans, or small debts; I just have a balance on my credit cards. As a result, I’m also wondering whether I need to get a credit freeze on the various small credit bureaus that are listed in some of the posts on this sub. Additionally, if anyone has ideas as to additional preve
Would like some insight about exposure after a scam Hi all — not great that I (or anyone) need this sub, but I’m glad there’s a community of people who have gone through similar things so there’s less of a stigma and more problem-solving here. A few days ago, I received a text message from boa@alerts.com stating: “/ BofA / Fraud - A hold has been placed on your debit-card. Please call 866.256.0821 to resolve this issue. To unsubscribe, reply STOP.” I didn’t reply STOP, but instead called the number, where an automated voice asked me to enter (using the keypad) (1) my BOA debit card number; (2) CVV; (3) expiry date; and (4) SSN. I entered all of these, but I felt that there was something off after entering my SSN and hung up immediately. I locked my debit card later that day. Last night, I called BoA, and their fraud dept informed me there was no department associated with that number. They have canceled that card and are sending me a new one in the mail. This was a debit card linked to a checking account. To my knowledge, there have been no attempts to open new credit cards, nor have there been any strange charges on any of my accounts. Last night, I placed a credit freeze on Equifax Experion, Transunion, Innovis, and the Chex one (sorry, I’m on my phone and can’t look it up without deleting this text.) I also contacted Chase, my credit card company, and they have put additional security measures in place for my account. I’m planning also getting an ID PIN from the IRS soon, but I am abroad and either the website is crashing by itself or they have security measures to prevent accessing those pages from abroad (which would make sense). For context, I don’t have any mortgages, student loans, or small debts; I just have a balance on my credit cards. As a result, I’m also wondering whether I need to get a credit freeze on the various small credit bureaus that are listed in some of the posts on this sub. Additionally, if anyone has ideas as to additional preve
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.