This scam campaign centers around fraudulent debt collection activities involving multiple entities impersonating legitimate debt collectors through coordinated phone and web-based operations. The cluster includes four phone numbers generating consumer complaints across multiple states, with 888-991-5696 receiving the highest volume of 3 FTC and 4 FCC complaints specifically targeting debt reduction services in St. Cloud, Florida, Cleveland, Ohio, and Show Low, Arizona. Phone number 888-251-9830...
Phone Number
888-991-5696
Last reported May 13, 2026
Suspicious
- 3 FTC complaints filed against this number
- 4 FCC robocall/robotext complaints
- 32 community reports from users
Campaign Intelligence
This cluster centers on 2451 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include cdn.discordapp.com, 91.92.241.152, 91.92.240.222, 158.94.208.174, 178.16.52.44, 158.94.211.102, 158.94.210.93, 158.94.208.52, i.postimg.cc, s3.us-east-2.amazonaws.com, storage.googleapis.com, 178.16.52.18, 158.94.211.101, 158.94.211.100, local-host.life, dropmefiles.com, limewire.com, 62.60.226.159, id8965.com, valfanto.com and 2431 more. 633 of these domains have been flagged by threat int...
This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...
This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...
This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...
**Debt Collection Network Operates Through Interconnected Companies and Communication Channels** Our analysis has identified a debt collection operation involving three companies that share communication infrastructure and have generated significant consumer complaints. Shepherd Outsourcing, LLC has received 437 CFPB complaints, while Credit Corp Solutions Inc. has accumulated 2,722 CFPB complaints, and ACCOUNT SERVICES INC. has logged 8 CFPB complaints. All three companies operate in the debt ...
This scam campaign involves a sophisticated debt collection operation utilizing multiple phone numbers and entities to target consumers across several states. The campaign centers around three phone numbers operating as part of the same scheme: 8889915696 (7 total complaints), 8337841940 (7 total complaints), and 8884710109 (2 total complaints). These numbers are connected through shared campaign activities and have generated complaints in locations including St. Cloud, Florida; Cleveland, Ohio;...
This scam campaign involves a coordinated network of 8 phone numbers and 4 financial services companies operating across multiple fraud categories, with a total of 466 FTC complaints, 22 FCC complaints, and 2890 CFPB complaints. The campaign centers around phone number 8004907479, which connects to all other numbers in the network through same-campaign relationships with 70% confidence. The most prolific number, 8002949424, has generated 416 FTC complaints alone and primarily targets victims wit...
This cybersecurity analysis identifies a coordinated debt relief and impersonation scam campaign operating through a network of 5 connected phone numbers targeting consumers across multiple states. The campaign centers around four primary numbers operating with high confidence same-campaign relationships: 8778893628 (2 FTC complaints), 8889915696 (3 FTC and 4 FCC complaints), 4699825007 (4 FTC complaints), and 2127640191 (11 FTC complaints). These numbers are linked to a fifth number, 8779564502...
This scam campaign operates through a network of three phone numbers that target consumers with deceptive calls impersonating legitimate businesses and government entities. The primary numbers in this operation are 844-244-6363 with 25 FTC complaints and 10 FCC complaints, 833-784-1940 with 5 FTC complaints and 3 FCC complaints, and 888-991-5696 with 3 FTC complaints and 4 FCC complaints. Analysis shows these numbers are connected through same campaign relationships with 0.70 confidence levels, ...
Details
Linked Company Activity
EQUIFAX, INC.
1 BBB complaint · Credit Cards] [Business: Equifax Impersonator] [Location: MD, USA- 21207]
BANK OF AMERICA, NATIONAL ASSOCIATION
175 BBB complaints
TRANSUNION INTERMEDIATE HOLDINGS, INC.
4 BBB complaints · Phishing] [Business: TransUnion Imposter Sc
JPMORGAN CHASE & CO.
16 BBB complaints
CAPITAL ONE FINANCIAL CORPORATION
161 BBB complaints
CITIBANK, N.A.
23 BBB complaints
Resurgent Capital Services L.P.
1 BBB complaint
SELECT PORTFOLIO SERVICING, INC.
1 BBB complaint · Advance Fee Loan] [Business: Said they were from Select Portfolio Servicing] [Location:
WELLS FARGO & COMPANY
205 BBB complaints
FIFTH THIRD FINANCIAL CORPORATION
26 BBB complaints
Connected Entities
Linked Companies
company
Shepherd Outsourcing, LLC
reported togethercompanyACCOUNT SERVICES INC.
reported togethercompanyCredit Corp Solutions Inc.
reported togethercompanyFlagstar Bank, N.A.
campaign co-membercompanyFirst Credit Services Inc.
campaign co-membercompanyPENTAGON FEDERAL CREDIT UNION
campaign co-membercompanyFIFTH THIRD FINANCIAL CORPORATION
campaign co-membercompanyCredit Services Corporation, LLC
campaign co-membercompanyIntegrity Group Inc
campaign co-membercompanyDirect, Inc
campaign co-membercompanyThe Bureaus, Inc.
campaign co-membercompanyEVERBANK, NATIONAL ASSOCIATION
campaign co-memberRelated Phone Numbers
phone
8553572202
campaign co-memberphone3186669555
campaign co-memberphone8667715844
campaign co-memberphone8339086865
campaign co-memberphone8009220204
campaign co-memberphone4097617631
campaign co-memberphone6789998212
campaign co-memberphone6512042449
campaign co-memberphone5187704680
campaign co-memberphone8887291403
campaign co-memberphone8889194623
campaign co-memberphone9805107108
campaign co-memberphone7712473445
campaign co-memberphone5858247925
campaign co-memberphone8009993355
campaign co-memberphone8007715361
campaign co-memberphone8009033637
campaign co-memberphone8884260179
campaign co-memberphone2025582508
campaign co-memberphone9297499563
campaign co-memberphone3025417253
campaign co-memberphone8887910954
campaign co-memberphone8334471291
campaign co-memberphone7656119812
campaign co-memberRelated Domains
domain
portal.shepherdoutsourcing.com
reported togetherdomain130.12.180.43
campaign co-memberdomainimplementing-theft-metal-justin.trycloudflare.com
campaign co-memberdomainstaying-heavily-meaning-blowing.trycloudflare.com
campaign co-memberdomaincreations-venture-traditional-stainless.trycloudflare.com
campaign co-memberdomain103.125.219.204
campaign co-memberdomain206.123.145.26
campaign co-memberdomainarilprivate.storexyz.web.id
campaign co-memberdomain14.236.182.73
campaign co-memberdomain83.224.162.132
campaign co-memberdomain123.31.81.229
campaign co-memberdomain120.157.56.105
campaign co-memberRelated Emails
email
diana@ierek.com
campaign co-memberemailcfjtfl@verxl.com
campaign co-memberemailcbx-df@ceszx.com
campaign co-memberemailj.thompson8822@ymail.com
campaign co-memberemailbb.adige@libero.it
campaign co-memberemailhr@teknfix.com
campaign co-memberemailpangmyiuhk@yahoo.co.jp
campaign co-memberemailmarydavis09@zoho.com
campaign co-memberemailidentity@varomoney.com
campaign co-memberemailservicename@nickname.tld
campaign co-memberemailxxxxxxxxxxxxxxxxxxxxxxxx@vmh5.grupoaldama.com.mx
campaign co-memberemaila4084163@trbvm.com
campaign co-memberCommunity Reports
Received the following text message: This text is from Shepherd Outsourcing, a debt collector regarding your FEB / ROOMS TO GO (for which the current creditor is DNF Associates LLC) account. Visit https://portal.shepherdoutsourcing.com/s/xxxxxxxxx. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. License Number 10916-99 SO Ref# 1014071684 Reply STOP to opt out. [BBB Scam Type: Other] [Business: Shepherd Outsourcing] [Location: TX, USA - 76049]
1 day ago
This text is from Shepherd Outsourcing, a debt collector regarding your CAPITAL ONE NATIONAL ASSOCIATION (WILLIAMS SONOMA CARD - for which the current creditor is JEFFERSON CAPITAL SYSTEMS LLC) account. Visit https://portal.shepherdoutsourcing.com/s/G5otu. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. License Number 10916-99 SO Ref# 1011578004 Reply STOP to opt out. Take advantage of your repayment options for your CAPITAL ONE NATIONAL ASSOCIATION (WILLIAMS SONOMA CARD - for which the current creditor is JEFFERSON CAPITAL SYSTEMS LLC) account while we have the chance to work with you. Visit https://portal.shepherdoutsourcing.com/s/ndp1snPqOn or call 888-251-9830. This text is from Shepherd Outsourcing, a debt collector. License Number 10916-99. Reply stop to opt-out [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: CO, USA - 80209]
4 days ago
Take control of your Acima Digital LLC (GOLD & DIAMONDS - OMAHA - for which the current creditor is Landmark Strategy Group, LLC) account. Visit https://portal.shepherdoutsourcing.com/s/gUjub or call 888-991-5696. This text is from Shepherd Outsourcing, a debt collector. Reply stop to opt-out [BBB Scam Type: Debt Collections] [Business: Landmark Strategy Group LLC Date Re] [Location: IL, USA - 60005]
28 days ago
I've been getting texts almost daily since November 3, 2025: What follows is the content of the first text message I received. I have been getting follow-up text messages nearly daily from CreditNinja: "If your CreditNinja (Installment Loan - for which the current creditor is Plaza Services, LLC) account is returned to our client we may not be able to renew these offers. Save up to $1,097.22 in up to 11 payments when you visit https://portal.shepherdoutsourcing.com/s/gdpsj or call 888-991-5696. This text is from Shepherd Outsourcing, a debt collector. Reply stop to opt-out" (collections business representing Plaza Services, LLC.) The text message is from Shepherd Outsourcing, a debt collector. [BBB Scam Type: Other] [Business: CreditNinja] [Location: TN, USA - 37370]
28 days ago
I received a text message early in the morning from 91651 stating "This text is from Shepherd Outsourcing, a debt collector regarding your JEFFERSON CAPITAL SYSTEMS LLC account. Visit https://portal.shepherdoutsourcing.com/s/gEuj0. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. . SO Ref# 1007075417 Reply STOP to opt out." I do not have any debts or such accounts and, upon looking it up, found that A LOT of people were receiving the same or similar messages from the same number and that different debt collectors names were being used. This is obviously a scam and just wanted to add further reporting. [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: CO, USA - 81004]
29 days ago
First message: We have limited time to work with you before we return your Winter Haven Hospital (for which the current creditor is CF Medical, LLC) account to our client. See your options at https://portal.shepherdoutsourcing.com/s/gtWSm or call 888-991-5696. This text is from Shepherd Outsourcing, a debt collector. Reply stop to opt-out. Second message: If your Winter Haven Hospital (for which the current creditor is CF Medical, LLC) account is returned to our client we may not be able to renew these offers. Save up to $104.09 in up to 7 payments when you visit https://portal.shepherdoutsourcing.com/s/gH3Nk or call 888-991-5696. This text is from Shepherd Outsourcing, a debt collector. Reply stop to opt-out [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: FL, USA - 33133]
29 days ago
I received this text after having no affiliation with JCP credit card. This text is from Shepherd Outsourcing, a debt collector regarding your SYNCHRONY BANK (JCP CREDIT CARD - for which the current creditor is JEFFERSON CAPITAL SYSTEMS LLC) account. Visit https://portal.shepherdoutsourcing.com/s/gyCSY. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. . SO Ref# 1007582218 Reply STOP to opt out. [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: MI, USA - 48159]
29 days ago
Received in a text to personal CP: "If your Morton Plant Hospital (for which the current creditor) is CP Medical, LLC) account is returned to our client we may not be able to renew these offers. Save up to $2,174.40 in up to 23 payments why you visit https://portal.shepherdoutsourcing.com/s/g8JR3 or call (888) 991-5696. This text is from Shepherd Outsourcing, a debt collector. Reply stop to opt-out" [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: VA, USA - 22079]
29 days ago
I keep getting this text from 91651: This text is from Shepherd Outsourcing, a debt collector regarding your Radiology Partners (for which the current creditor is CF Medical, LLC) account. Visit https://portal.shepherdoutsourcing.com/s/gEgfL. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. Reply STOP to opt out. They won't stop texting me with this fake medical debt. I do not have any debt from Radiology Partners and there has been nothing posted to my credit concerning this. [BBB Scam Type: Other] [Business: Shepherd Outsourcing] [Location: TX, USA - 78656]
30 days ago
Received the following text message: This text is from Shepherd Outsourcing, a debt collector regarding your WEBBANK (PETAL CARD - for which the current creditor is JEFFERSON CAPITAL SYSTEMS LLC) account. Visit https://portal.shepherdoutsourcing.com/s/drtOC. Reply stop to opt-out or call 888-991-5696. # of messages varies. Message & data rates may apply. This is an attempt to collect a debt and any information obtained will be used for that purpose. SO Ref# 1008895522 Reply STOP to opt out. See attached for screenshot. [BBB Scam Type: Debt Collections] [Business: Shepherd Outsourcing] [Location: MI, USA - 48093]
35 days ago
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.