Scam Detective
Phone Number

888-389-8100

Last reported Mar 20, 2026

Low Activity
  • 1 community report from users

Campaign Intelligence

This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...

Details

First Seen
3/20/2026
Last Reported
3/20/2026
Area Code
888

Linked Company Activity

EQUIFAX, INC.
1 BBB complaint · Credit Cards] [Business: Equifax Impersonator] [Location: MD, USA- 21207]
TRANSUNION INTERMEDIATE HOLDINGS, INC.
4 BBB complaints · Phishing] [Business: TransUnion Imposter Sc
JPMORGAN CHASE & CO.
16 BBB complaints
CITIBANK, N.A.
23 BBB complaints
WELLS FARGO & COMPANY
204 BBB complaints · Bank/Credit Card C
AMERICAN EXPRESS COMPANY
105 BBB complaints
PNC Bank N.A.
22 BBB complaints

Connected Entities

Community Reports

This operation relies on a "ghost hub" located at 85 Dunstall Hill, Wolverhampton, WV6 0SR. While this address is a small, two-story residential property, it is currently the registered headquarters for nearly 900 active UK Limited companies. This "mailbox factory" allows international criminal syndicates (primarily operating from Nigeria and Spain) to project a facade of UK-based legitimacy. ?How the Scam Operates ?The syndicate uses a network of companies registered at this address to perform different roles in a coordinated theft cycle: ?The "Payment Bridge" (e.g., Net Fusion Tech Services Ltd): This company (Company No. 16397389) acts as a financial gateway. The scammers hijack or create professional-looking webshops (often using hijacked German .de domains like richter-uhren.de). When a victim makes a purchase, the money is processed through this UK entity, making it difficult for European banks to claw back the funds. ?Logistics Manipulation (The FedEx Weight-Hack): The most dangerous aspect is the manipulation of shipping data. In a documented case involving an order for 1,000 kg (1 Tonne) of firewood/fuel, the syndicate used a logistics front to generate a FedEx label (Tracking: 888389810094). ?The Hack: The physical package sent weighed only 300g (containing conifer waste). ?The Deception: By injecting a fraudulent "Proof of Delivery" photo into the FedEx and PayPal systems, the scammers "prove" delivery to the victim's address. This defeats automated buyer protection, as the system sees a "successful delivery" for a 1-tonne order that was physically impossible. ?Diversified Fraud Portfolio: The same address at 85 Dunstall Hill hosts a variety of other suspicious entities that target different victims: ?Ghost Retailers: Companies like Grab N Go E-Commerce Ltd facilitate rapid-fire shop scams. ?Rigged Auctions: Bid &a [BBB Scam Type: Online Purchase] [Business: Netfusiontechservices.com Date Re

54 days ago

Share Your Experience

What's Your Exposure?

Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.