Scam Detective
Phone Number

888-221-1161

Last reported May 1, 2026

High Risk
  • 12 FTC complaints filed against this number
  • 2 FCC robocall/robotext complaints
  • 5 community reports from users

Campaign Intelligence

This cluster centers on 2451 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include cdn.discordapp.com, 91.92.241.152, 91.92.240.222, 158.94.208.174, 178.16.52.44, 158.94.211.102, 158.94.210.93, 158.94.208.52, i.postimg.cc, s3.us-east-2.amazonaws.com, storage.googleapis.com, 178.16.52.18, 158.94.211.101, 158.94.211.100, local-host.life, dropmefiles.com, limewire.com, 62.60.226.159, id8965.com, valfanto.com and 2431 more. 633 of these domains have been flagged by threat int...

This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...

This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...

This cluster centers on 2107 connected domains tagged as GuLoader, NorthKorea, censys. The domains include storage.googleapis.com, cdn.discordapp.com, pastes.io, s3.us-east-2.amazonaws.com, dl.dropboxusercontent.com, 188.137.230.45, touchskins.io, 158.94.208.7, 74.0.32.149, 74.0.32.141, api.touchskins.io, 80.89.237.190, 188.137.254.207, api.wewpwsw.su, 188.137.229.136, 196.251.107.24, 104.194.152.180, link.storjshare.io, s3.g.s4.mega.io, 62.60.226.159 and 2087 more. 562 of these domains have bee...

This cluster centers on 2121 connected domains tagged as GuLoader, NorthKorea, censys. The domains include 59.182.90.199, 178.50.166.61, 113.168.249.76, 123.209.193.86, 113.165.6.38, 120.157.72.234, 171.235.194.253, 120.157.159.171, 37.142.77.163, 46.124.33.133, 46.124.40.3, 83.224.151.243, 88.86.246.233, 41.146.1.154, 59.182.119.128, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, cdn.discordapp.com and 2101 more. 576 of these domains have been flagged by threat intelligence feed...

This cluster centers on 1630 connected domains tagged as BABADEDA, pw-2026, wsh. The domains include storage.googleapis.com, cdn.discordapp.com, implementing-theft-metal-justin.trycloudflare.com, staying-heavily-meaning-blowing.trycloudflare.com, creations-venture-traditional-stainless.trycloudflare.com, arilprivate.storexyz.web.id, 206.123.145.26, 103.125.219.204, 45.87.43.154, 10cricofficial.com, justwatch.life, 195.16.44.75, advise-visual-playstation-closer.trycloudflare.com, 91.92.241.197, 6...

This cluster centers on 2141 connected domains tagged as GuLoader, NorthKorea, censys. The domains include 59.182.90.199, 91.80.129.100, 123.28.175.23, 120.61.247.2, 178.50.166.61, 113.168.249.76, 123.209.193.86, 113.165.6.38, 120.157.72.234, 171.235.194.253, 120.157.159.171, 37.142.77.163, 171.241.208.124, 120.157.229.220, 171.117.30.233, 91.80.136.9, 46.124.33.133, 46.124.40.3, 83.224.151.243, 88.86.246.233 and 2121 more. 596 of these domains have been flagged by threat intelligence feeds incl...

**Scam Campaign Report: PayPal Phishing Operation Using Connected Phone Numbers** This cybersecurity investigation has identified a coordinated scam campaign utilizing two connected phone numbers to execute PayPal phishing attacks targeting consumers across multiple states. The operation centers around phone numbers 888-221-1161 and 800-909-8635, which have been reported together with a confidence level of 0.50, indicating shared usage in the same fraudulent scheme. Phone number 888-221-1161 ha...

This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...

**Multi-Vector Financial Services Scam Campaign Targets Multiple Industries** This cybersecurity investigation has identified a sophisticated scam campaign operating across multiple financial service sectors, utilizing six connected phone numbers and targeting consumers through student loan, debt collection, and money transfer schemes. The campaign centers around phone number 8882211161, which has generated 10 FTC complaints and 2 FCC complaints, with documented activity in Fairfax, Virginia, G...

Details

FTC Complaints
12
FCC Complaints
2
FCC Call Types
Live Voice (1), Text Message (1)
Category
Other
First Seen
2/22/2026
Last Reported
5/1/2026
Area Code
888

Linked Company Activity

EQUIFAX, INC.
1 BBB complaint · Credit Cards] [Business: Equifax Impersonator] [Location: MD, USA- 21207]
TRANSUNION INTERMEDIATE HOLDINGS, INC.
4 BBB complaints · Phishing] [Business: TransUnion Imposter Sc
JPMORGAN CHASE & CO.
16 BBB complaints
CITIBANK, N.A.
23 BBB complaints
SELECT PORTFOLIO SERVICING, INC.
1 BBB complaint · Advance Fee Loan] [Business: Said they were from Select Portfolio Servicing] [Location:
WELLS FARGO & COMPANY
204 BBB complaints · Bank/Credit Card C

Connected Entities

Community Reports

email title: Your account processed a payout with a small deposit confirmation, and a $980 activation fee will be charged. If this is unauthorized, contact us at +1 (800) 909-8635 email sender: [email protected] body of email:Hello, Jessica Bryant PayPal michael sullivan sent you $0.01 USD Money received $0.01 USD Transaction ID 8A115021SA906052S Transaction date April 1, 2026 Smart money tip Now use your balance in stores with PayPal Debit. Plus earn 5% cash back in a monthly category you choose. Go to PayPal PayPal Help & Contact | Security | Apps Twitter Instagram Facebook LinkedIn The PayPal Debit Mastercard® is issued by The Bancorp Bank, N.A. (“Bancorp”) pursuant to a license by Mastercard International Incorporated and may be used everywhere Mastercard is accepted. Mastercard and the circles design are registered trademarks of Mastercard International Incorporated. Bancorp is issuer of the Card only and not responsible for the associated accounts or other products, services, or offers from PayPal. PayPal is a financial technology company, not a bank. The Card is linked to your PayPal Balance Account. See PayPal Balance Terms and Conditions. PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing Please don't reply to this email. To get in touch with us, click Help & Contact. PayPal Customer Service can be reached at 888-221-1161. Not sure why you received this email? Learn more Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131. PayPal RT003023:en_US(en-US):1.1.0:13655b37eb706 [BBB Scam Type: Phishing] [Business: PayPal / impostor / Debit Mastercard] [Location: WA, USA - 98125]

24 days ago

NAME- Here's your receipt. PayPal Thanks for paying with PayPal To see the payment details, log in to your PayPal account. Payment from NAME Payment to BallFly CO.LTD [email protected] Note to payment recipient You haven't included a note. Transaction ID 3PN510740B0723005 Date December 20, 2025 Payment Status COMPLETED Ship to NAME ADDRESS Description Unit price Qty Amount Women's Retro Christmas Casual Collared Top $33.99 USD 1 $33.99 USD Women's casual retro Christmas plaid corduroy shirt $38.99 USD 1 $38.99 USD Women'S White Christmas Print Casual Sweatshirt $24.99 USD 1 $24.99 USD Women's Merry Christmas Casual Knitted Sweater $34.90 USD 1 $34.90 USD Shipping and handling $0.00 USD Sales Tax $23.39 USD Discount -$15.94 USD Total $156.26 USD Payment $140.32 USD Transaction Summary Total amount of this Transaction: $140.32 USD Payment method: Payment to recipient $140.32 USD Amount you'll pay $140.32 USD PayPal Help & Contact | Security | Apps Twitter Instagram Facebook LinkedIn PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing Please don't reply to this email. To get in touch with us, click Help & Contact. PayPal Customer Service can be reached at 888-221-1161. Not sure why you received this email? Learn more Copyright © 1999-2025 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131. PayPal RT000403:en_US(en-US):1.0.1:b4154f986a17c [BBB Scam Type: Online Purchase] [Business: Hollyjollyboutique.com] [Location: NY, USA- 13316]

46 days ago

Urgent: Steps Needed for Your Recent Payment Inbox Inbox PayPal To: me · Wed, Mar 11 at 10:21 AM Visit site Message Body Hello, Spencer Marcus PayPal RLTY RUE sent you $0.02 USD Get instant access today in PayPal for free or transfer to a bank. Accept Money Money received $0.02 USD Transaction ID 67383715DJ1883309 Transaction date March 11, 2026 Note from RLTY RUE You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS PayPal Help & Contact | Security | Apps Twitter Instagram Facebook LinkedIn PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing Please don't reply to this email. To get in touch with us, click Help & Contact. PayPal Customer Service can be reached at 888-221-1161. Not sure why you received this email? Learn more Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131. PayPal RT003023:en_US(en-US):1.0.0:96a07d474a34f [BBB Scam Type: Fake Invoice/Supplier Bill] [Business: RLTY RUE] [Location: VA, USA- 23185]

51 days ago

My Paypal account received a $0.03 refund from Rocket Clothing Inc. with the email listed as [email protected] . PayPal Rocket Clothing Inc sent you $0.03 USD Get instant access today in PayPal for free or transfer to a bank. Accept Money Money received $0.03 USD Transaction ID (Transaction ID number was here but I deleted in case of PII) Transaction date March 9, 2026 Note from Rocket Clothing Inc You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS PayPal Help & Contact | Security | Apps Twitter Instagram Facebook LinkedIn PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing Please don't reply to this email. To get in touch with us, click Help & Contact. PayPal Customer Service can be reached at 888-221-1161. Not sure why you received this email? Learn more Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131. PayPal RT003023:en_US(en-US):1.0.0:3545f2d0b8b62 Transaction date March 9, 2026 Note from Rocket Clothing Inc You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS PayPal Help & Contact | Security | Apps Twitter Instagram Facebook LinkedIn PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify p [BBB Scam Type: Online Purchase] [Business: Rocket Clothing Inc] [Location: VA, USA- 20189]

51 days ago

PayPal Phishing Scam Wanted to report a Phishing scam to let others know and see if there's anything else I need to do (I wasn't fully awake so I hope I didn't do anything that compromised me). I received an e-mail from PayPal saying that I had a request from someone for a large sum of money. The e-mail was legitimately from [PayPal.com](https://PayPal.com). I went to the website manually and checked my dashboard. It had the request. I clicked "Cancel" and it also said to call a phone number to report a fraudulent charge. This number is illegitimate and is 1-888-221-1161 (don't call). I called to report the charge. There was no annoying customer service robot (Red Flag 1). I explained the situation to the person. He then told me someone has access to my account. I explained that a charge hadn't happened, that someone had just requested money from me. I didn't get a straight answer (Red Flag 2). He then tried to get me to download some software that allows VPN remote access (Red Flag 3). I didn't download it or install it. He instead told me to go to a website: [phelp.online](https://phelp.online) \- don't go to it. I stupidly did, but didn't enter any information, immediately closed it, and hung up on him. I found a different phone number on the PayPal website, called them, and reported it. What I stupidly hadn't realized is that the phone number I originally called was written as a note by the requester, not an official PayPal comment \*facepalm\* Anyway, I didn't give out any information, download anything, or anything like that. But I did go to that stupid phelp website very briefly. I'm on a Mac, all of my software is up to date. I immediately changed all important passwords just to be safe. Is there anything else I should do?

1205 days ago3 upvotes

Share Your Experience

What's Your Exposure?

Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.