Scam Detective
Phone Number

888-338-0640

Last reported Mar 23, 2026

Low Activity
  • 10 community reports from users

Campaign Intelligence

This cluster centers on 2451 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include cdn.discordapp.com, 91.92.241.152, 91.92.240.222, 158.94.208.174, 178.16.52.44, 158.94.211.102, 158.94.210.93, 158.94.208.52, i.postimg.cc, s3.us-east-2.amazonaws.com, storage.googleapis.com, 178.16.52.18, 158.94.211.101, 158.94.211.100, local-host.life, dropmefiles.com, limewire.com, 62.60.226.159, id8965.com, valfanto.com and 2431 more. 633 of these domains have been flagged by threat int...

This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...

This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...

This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...

**Multi-Vector Debt Relief Scam Campaign** This scam campaign operates through a network of 7 interconnected phone numbers and 3 companies, generating a total of 392 FTC complaints and 172 CFPB complaints. The operation primarily targets consumers with fraudulent debt relief services, using numbers 8559941953 (279 FTC complaints) and 6072949001 (97 FTC complaints) as the primary contact points. These numbers are linked through same-campaign relationships with confidence levels of 0.70, indicati...

**Multi-Vector Financial Services Scam Campaign Targets Multiple Industries** This cybersecurity investigation has identified a sophisticated scam campaign operating across multiple financial service sectors, utilizing six connected phone numbers and targeting consumers through student loan, debt collection, and money transfer schemes. The campaign centers around phone number 8882211161, which has generated 10 FTC complaints and 2 FCC complaints, with documented activity in Fairfax, Virginia, G...

This scam campaign involves a coordinated network of five phone numbers operating in conjunction with two companies to target consumers with fraudulent debt collection and payment decline schemes. The campaign centers around phone number 8885025824, which connects to all other numbers in the network including 8883380640, 8887070540, 6148052524, and 8776951552 through same-campaign relationships with 0.70 confidence scores. These numbers are linked to United Group Inc., which has accumulated 75 C...

Details

First Seen
3/20/2026
Last Reported
3/23/2026
Area Code
888

Linked Company Activity

EQUIFAX, INC.
1 BBB complaint · Credit Cards] [Business: Equifax Impersonator] [Location: MD, USA- 21207]
TRANSUNION INTERMEDIATE HOLDINGS, INC.
4 BBB complaints · Phishing] [Business: TransUnion Imposter Sc
JPMORGAN CHASE & CO.
16 BBB complaints
CITIBANK, N.A.
23 BBB complaints
SELECT PORTFOLIO SERVICING, INC.
1 BBB complaint · Advance Fee Loan] [Business: Said they were from Select Portfolio Servicing] [Location:
WELLS FARGO & COMPANY
204 BBB complaints · Bank/Credit Card C

Connected Entities

Community Reports

Note from Rocket Clothing Inc: quote You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. It was for $.03, I’m not familiar with Rocket Clothing and suspected scam; searched the "customer service" # provided, finding it associated with various scams. [BBB Scam Type: Phishing] [Business: PayPal IMPOSTER] [Location: CA, USA- 95464]

51 days ago

Money received $0.02 USD Transaction ID ***************** Transaction date March 9, 2026 Note from Rocket Clothing Inc You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS [BBB Scam Type: Bank/Credit Card Company Imposter] [Business: Rocket Clothing Inc] [Location: NY, USA- 11411]

51 days ago

Sent $.03 to PayPal account with note: You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. [BBB Scam Type: Phishing] [Business: RLTY RUE] [Location: CA, USA- 90230]

51 days ago

Money received $0.02 USD Transaction ID 98A77699F72947945 Transaction date March 11, 2026 Note from RLTY RUE You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. [BBB Scam Type: Online Purchase] [Business: RLTY RUE] [Location: LA, USA- 70454]

51 days ago

Note from RLTY RUE You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. [BBB Scam Type: Other] [Business: PayPal IMPOSTER] [Location: FL, USA- 32819]

51 days ago

I received an email seemingly from PayPal that reported I’d recused a $.04 deposit from RLTY RUE. Email contents below. When I called the number, they said I was victim of identity theft. They asked me to open up a google browser on a laptop, not my phone, so they could give me a code to protect my account. When I expressed confusion, the woman insisted I needed to let he help me protect my bank account. When I was skeptical, she said, ok, you can check and call me back. Money received $0.04 USD Transaction ID (Omitted) Transaction date March 11, 2026 Note from RLTY RUE You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS [BBB Scam Type: Phishing] [Business: Unknown] [Location: DC, USA- 20008]

51 days ago

Not sure if a scam but highly suspicious. Notification email from Paypal: "You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1(888) 338-0640 immediately to secure your account and request a refund". The email was legitimate from PayPal. The deposit was for $0.03. Not purchases were recently made using this PayPal account. The only hit I can find on RLTY RUE is for a traveling hair dresser. https://rltyrue.square.site/ (may not be affiliated). Will update if there is a false purchase on the account. This may be a scam testing account numbers. [BBB Scam Type: Phishing] [Business: Paypal RLTY RUE] [Location: PA, USA- 16505]

51 days ago

They have sent $.04 to my Paypal which triggers an actual email from Paypal saying: " Money received $0.04 USD Transaction ID 2VX134844J974XXXXX Transaction date March 11, 2026 Note from RLTY RUE You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. GOODS" [BBB Scam Type: Fake Invoice/Supplier Bill] [Business: RLTY RUE] [Location: NY, USA- 10036]

54 days ago

Email from PayPal saying Rocket Clothing Inc made a deposit of $.03 in my PayPal account. Never heard of this company and it sounded suspicious. Note from Rocket Clothing Inc: quote You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please contact PayPal Customer Care at +1 (888) 338-0640 immediately to secure your account and request a refund. It was for $.03, I’m not familiar with Rocket Clothing and suspected scam; searched the "customer service" # provided, finding it associated with various scams. [BBB Scam Type: Retail Business Business name Rocket Clothing Inc] [Business: Rocket Clothing Inc] [Location: NY, USA- 14850]

54 days ago

You received this email because your PayPal account processed a payout by small deposit confirmation. If you authorized it, no action is needed. If not, please call PayPal customer care at +1 (888) 338-0640 immediately to secure your account and request a refund. Dollars Lost $0.04 [BBB Scam Type: Phishing] [Business: Gentry Zakery] [Location: CA, USA- 95158]

54 days ago

Share Your Experience

What's Your Exposure?

Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.