DESTROYING 5 COMPUTERS IN THE SAME CALL CENTRE! [RAT + RANSOMWARE]

when you're just browsing around on the internet and a pop-up like disappears you will probably understand that this is a scam the pop-up is made to scare unknowing and thus gullible people these people will call the number on screen and will get connected to a scam call center probably somewhere in india the people on the other side of the phone will make you believe something is wrong with your pc and they will make you pay a lot of money for a non-existing anti-virus service or any other program that basically does nothing when i get these numbers i like to call the numbers and reverse the connection on this camera so i always have access to his pc without his knowledge okay it's it it just closed leave your mouth now oh can you see this ring leave your mouth okay i don't see that leave your mouth okay okay yes do not touch anything i'll go ahead and get off it okay yes thank you thank you very much since how long are you getting this problem um well i've had the problem before but today it came back up again it seems i don't know what the problem is i'm not very smart with computers right here that's fine that's fine how long are you getting this problem just right now or what what exactly you were trying to do with your device when you were getting this message um well i wasn't really doing anything you see i was just trying to get to facebook right here but it doesn't it seemed like it wasn't really working for me leave your mouth okay no problem no problem yep there we go there he is so the first thing i always like to do when i get this connection is to check out the ip address and to geolocate to see where this camera is and as you can see on the screen this camera is based in the guru gram in the region hariana and their isp is xiaomi spectra pvt ltd then i decided to download the scammers files and i will show you guys what those files are so these are the scanners files the first picture incentive well this file was on all the pcs in the call center and it seems like this is some kind of way that the scammers get sort of bonus on top of their loan if they're doing well with sales not really sure how it works but it seems as if that is the case maybe one of you guys understands what it's saying and then the second file said payment link i will get back to that later the third file was empty the fourth and the fifth file were the same and the fourth and the fifth file are on the screen right now and this is basically what the scammer has to fill in when he makes a sale when the person that he's coming is making a payment and in this notepad file we can find the real name of the scammer which is jay singh i then decided to watch this camera for a little bit and well not surprising he was actually scamming someone what this camera is doing he runs the tree command which basically shows a big list of programs and stuff and he makes it seem like it's some kind of scan that he's doing and then when it's finished he types very quickly on the screen that there is a virus found which is crss.exe he then takes the victim to some kind of fake webpage and then he talks about how dangerous this virus is for the pc even though the virus isn't even on the pc you're there with me [Applause] can you please do me a favor richard can you read this paragraph for me a bit loudly so we both of them understand what is this and why you're getting this problem that what i'm talking about it is kind of a hidden monitor software that may impact on your personal information such as credit card social security number email address websites as well as your ip address as well that can sent to the third party users to damage your computer to sending viruses spywares malwares personal information from fraud purchases so doing a phishing thing is that what it is this camera then goes to cmd where he shows the victim all the connections and he tells him that these connections are from outsiders when it's really not it's just a pc connected to things like google and stuff but this is what all scammers do to scare their victims into paying can you see this here on your screen where it says active connections [Music] active connection means this is your internet connection of yours which you are using at your place the local address means this is your ip address of your internet do you have any knowledge about an ip address what is that means or should i explain you what it is he then talks to the victim keeps telling him that his network firewall is expired he keeps talking about ip address about hackers whatever just the basic stuff that all tech support scammers do and then at some point he finally convinces the victim into paying for the service and he says that he's going to work on the computer for about 40 minutes and then everything will be okay for the victim [Applause] no no huge i just only need a couple of information which you have to fill it by yourself like your name billing address email address and the best number to reach you back i then decide to step in because i do not want the 69 year old man to get scammed out of his money i restart his camera's calling device so the call hangs up and i decide to call the victim and tell him all about the scam sir can you hear me hello who's this yeah you are speaking to scammers right now the guys that are on your computer are scammers please disconnect your computer just turn off your computer right now just turn it off they're trying to scam you for a lot of money and i just want to warn you that these guys are scammers if they call you back do not pick up the phone just wait and just restart your computer make sure they're not connected to your computer well they were they already had access to it because they were so good at what they were doing uh yeah but if they if you restart your computer right now i think if you put turn on the computer they will not be connected anymore but everything that they were telling you is fake information there's no virus nothing there's nothing wrong with your internet nothing everything that they were saying is fake information okay i appreciate that but uh how did you know it was me uh well they have a dialing system like a dialing software on their computers and i could see your number they they're calling you from they're not calling you from a telephone they're calling you from like a software it's very hard to explain but i could see your number on their screen and i can see your name they have all your information all right yeah because i couldn't break loose from them i was going to call somebody that i know and see if they knew anything about this deal and everything yeah were you planning on paying them any money or well they were looking they were looking for the way it was funny because that was a flag there it went from a thousand dollars for five years down to 200 for five years yeah they were very desperate to get any any amount of money out of you man they they were very they're very hungry for money because they get commission if they scam someone they get commission so that's why they want to scam people very badly i then talk to the victim for about five minutes six minutes or something just explaining everything to him who i was what i do what the scammers were doing and all that kind of stuff and this is not the only victim we prevented from getting scammed i think in the time we were watching these cameras we prevented about 20 to 30 scams which all went kind of the same way like this just stopping this scammers calling system and then just calling up the victim explaining them everything and they were always very appreciative of our work okay well i appreciate that and i'll take a look at it and spread the word all right no worries have a good day thank you too bye-bye bye after watching this camera's pc for a while i noticed that this camera was connected to a lan network and i knew from watching a bit of youtube and stuff that a fellow youtuber which his name is louis tech and his friend cuds they have the possibility to spread the remote connection across a lan network so i decided to hit up lewis on twitter we got in contact on discord together with cuds and a friend of mine sinister and we successfully spread our remote connection across a few computers that were in this call center i'm now going to tell you guys all the information that i've gathered throughout all the days that i was watching all these computers together with cuts sinister and luis we monitored all these pcs in the call center and all the information that i'm gonna name is also being sent to the gurgram police cyber police and they've worked with jim browning in the past to arrest and roll up a call center also in gurgram so let's hope that our scammers will also get arrested to make things easier as you can see on the screen i've named all the systems since they all have the same names for the system as you can see we are missing system 6 which never came back we got the connection the initial day but it never came back then we have the system icon which is a pc that was not being used and then the guy we spread through seemed like he installed some kind of antivirus or maybe another scam bait to destroy them or whatever because we also lost connection to him so we only have five connections left but we did get information on the guide that we spread through and system six we don't have any information and also not for icon because it was never active to receive payments the scammers use five different web pages pcsafenetwork.com topviruspro.com pcprotex.com usa pc and pcsafepro.com on the screen you can see by which company the websites are being hosted and we've reported the websites to the hosts they've not taken any action yet but usually that takes a little bit longer and how the payments work on these webpages is just they offer some kind of fake anti-firewall whatever so you're basically just paying like on a normal webpage so like on amazon with your credit card but you're basically just paying for nothing they also sometimes use a check to receive payments and the name on the checks that they use is smith tech holdings llc as you can see on the screen right now the two numbers on the screen right now are their toll-free numbers that are always up and they have plenty of like flex numbers that they can always take down when scam baiters find it and stuff that's the numbers that pop up on the screen with the fake virus alerts to make calls and to receive calls they use the call method e title which is kind of the same method as the others cameras use like grasshopper fizzite dio and stuff and the address that you see on the screen is the address that they log into and they all use the same password which is sunshine78 and every single agent has a different uh login like a different username so their sales can be tracked and all their calls can be tracked as well like how they're doing why people are not interested and all that kind of stuff okay now a quick little insight on what we found on the pc that we had well the guy that we spread through his uh real name is jay singh his entire login username is two one six eight four uh he had a sennheiser cheap little headset to use for a microphone then the name that we found on the icon pc so the pc that wasn't really being used is barfinder roti his entitled login was 21675 and he had a logitech cheap little usb headset for a microphone then system number one we couldn't really find a name the only name that we found everywhere was joel so that seems like some kind of fake name and his entitled login is three he was using a sennheiser cheap headset as well for his microphone then system two the real name of the guy is solomon noth his username was two one six one three and on the screen you can see all his passwords that we found while we obviously changed all the passwords so you guys cannot really use this but still then system three the real name of the guy that uses this pc is a vikka charade he also has a logitech headset to use for a microphone and his entitled login is two one six eight six then system four real name of the guy that was using system four is srikant we found a username and a password for go to assist that you can see on the screen and obviously we changed this as well he was also using a sennheiser headset for a microphone and he was the guy that received a check and then system five the real name of the person who was using system five uh was vikas gupta and he had like five different microphones including a sennheiser headset and on the screen you can see a whole list of names that we found in their lan messenger because to contact each other and to communicate they were using lan messenger and all the names on the screen where the names that we found in this lan messenger and in the agent client for their calling device you could see like which people were on a call which people were online which people were offline and all that kind of stuff all right so this was all the information that i could show you guys for legal purposes because we are working together with the police we cannot show everything that we have trust me we are gonna do our best to get these guys arrested and to stop this big operation and if i say big then i mean really big because on average there was about like 50 people working at the same time every single day except for in the weekends and on average a scammer made about eight hundred dollars a day which means that they make forty thousand dollars a day and let's say they work like 52 weeks a year with five days a week and then they make around 10 million dollars a year which is an insane amount of money and after collecting all this information we decided to destroy the pcs that we have uh we didn't get everything on the record there's one that's like fully unrecorded you guys can see on the screen right now this particular pc we destroyed with mrs major but the rest we all destroyed with the ptr and a system locker so if they bypass it they still cannot use the pc we don't know what the impact will be because they can just restore the pc format the hard drive but we hope that this slows them down a little bit but yeah i hope you guys enjoyed the video if you did make sure to like subscribe you can check out my patreon in the description if you want to help the channel with some money and yeah see you in the next one

Channel: Scambaiter

Views: 1,177,847

Rating: 4.9287996 out of 5

Keywords: scammer, files, deleted, file, delete, scammers, indian, tech, support, refund, scammerrevolts, payback, acces, rat, pc, destroying, destroy, all, facebook, ip, ratted, dox, exposed, expose, memz, memz virus, ratting a scammer, scammer memz, syskeying a scammer, syskey, destroying scammer computer, memz scammer, ratting scammer, memz trojan, rat scammer, memz virus scammer, scammer syskey, scammer rat, scammer ratted, ratting scammer pc, scambaiter, ransomware, tech support scam

Id: CtksWoTUKac

Length: 14min 45sec (885 seconds)

Published: Sat Sep 19 2020