org:We care 4 u LLC

Feeding Our Future fraud scheme
8 findings 2 connections 0 entities

All Connections

2 total

wecare4llc.com and hadef.org share: identical WordPress theme (ekko), identical WP Fastest Cache hash (qiyc4fz1), same phone (612-800-4888), same hosting provider and Shodan org (Brander Group Inc./Hostinger AS47583), and identical page structure. The wecare4llc.com contact page incorrectly lists HADEF's Suite 225 address, confirming the LLC site was built by cloning HADEF's template.

org:Brander Group Inc. corporate medium

Both wecare4llc.com and hadef.org are attributed to 'Brander Group Inc.' in Shodan host data on Hostinger (AS47583). The shared attribution suggests both sites were built or managed by the same web developer entity. This developer is the likely bridge between We Care 4 U LLC and HADEF's digital infrastructure.

All Findings

8 total
infrastructure high 2023-07-29
confirmed

We Care 4 U LLC operates wecare4llc.com, launched July 2023 with first cert from ZeroSSL; hosted on Hostinger (AS47583, IP 147.79.79.118)

wecare4llc.com received its first SSL certificate (ZeroSSL) on July 29, 2023 — approximately 4 years after We Care 4 U LLC was incorporated (September 2019) and 20 months before its DHS HCBS license was issued (March 2025). The cert history shows 22 unique certificates through February 2026, with regular Let's Encrypt renewals.

infrastructure high 2024-08-08
confirmed

wecare4llc.com had a burst of 7 subdomain cert issuances in August 2024 (app, admin, backend, dev, staging, demo, ftp) — indicating a healthcare application platform build-out prior to DHS license activation

CT logs show certificate issuances for admin.wecare4llc.com, app.wecare4llc.com, backend.wecare4llc.com, dev.wecare4llc.com, staging.wecare4llc.com, demo.wecare4llc.com in early August 2024 — approximately 7 months before the DHS HCBS license was issued (March 14, 2025). These subdomains are now NXDOMAIN, suggesting a transient development/staging environment. The 'app' and 'backend' subdomains suggest a client-facing healthcare portal was built.

infrastructure high 2025-01-16
confirmed

wecare4ullc.com (typo variant) had a GoDaddy cert Jan 2024–Jan 2025, now NXDOMAIN — likely registered as placeholder then abandoned in favor of wecare4llc.com

A separate domain wecare4ullc.com (with double 'l') received a GoDaddy SSL cert on January 16, 2024 (expired January 16, 2025). The domain now resolves to NXDOMAIN. It received only one cert across its lifetime, suggesting it was registered as a typo-variant or placeholder domain but never actively used.

infrastructure high 2026-03-27
confirmed

We Care 4 U LLC uses two emails: operational inbox [email protected] and personal/alternative Gmail [email protected]

wecare4llc.com contact page identifies two contact emails: '[email protected]' (embedded in contact page text) and '[email protected]' (sidebar popup widget). The Gmail address may indicate early-stage operation or an alternate operational inbox. Neither email appears in breach data or business directories (not searched).

infrastructure medium 2026-03-27

HADEF maintains active @hadeforg social accounts on three platforms; We Care 4 U claims @wecare4u but all social links are dead/redirect to homepage

HADEF (hadef.org) has an active social media presence under handles @hadeforg: Facebook (web.facebook.com/hadeforg), Twitter/X (twitter.com/hadeforg), Instagram (instagram.com/hadeforg/). All three are linked from the live hadef.org footer. We Care 4 U's website claims @wecare4u handles on the contact page but all social icon links redirect to wecare4llc.com homepage — the accounts may not exist or were never established.

pattern high 2026-03-27
confirmed

wecare4llc.com contact page lists HADEF's Suite 225 address instead of We Care 4 U's Suite 224 — reveals website was built by cloning HADEF's template

The wecare4llc.com contact page states address as '2833 13th ste 225 Minneapolis MN 55407'. The entity's registered address (MN SOS, DHS license 1114633, OpenCorporates) is Suite 224. Suite 225 is HADEF's registered address. This error has not been corrected and persists on the live website as of March 2026.

pattern medium 2026-03-27

wecare4llc.com and hadef.org share identical WordPress stack including theme (ekko), cache hash (qiyc4fz1), and hosting org — consistent with single administrator or shared web developer

Both wecare4llc.com and hadef.org use: (1) identical WordPress theme 'ekko' by Key Design; (2) identical WP Fastest Cache path hash 'qiyc4fz1' appearing in each site's JS bundle path; (3) identical Contact Form 7 contact form structure; (4) identical footer/navigation layouts; (5) same jQuery Migrate 3.4.x; (6) identical popup contact widget showing (612)-800-4888. Both are hosted on Hostinger (AS47583) with the same Shodan org attribution 'Brander Group Inc.'

connection high 2026-03-27
confirmed

Phone (612) 800-4888 is shared between We Care 4 U LLC's DHS license record, MN.gov provider listings, wecare4llc.com, and hadef.org — confirming operator identity across entities

Phone (612) 800-4888 appears in: (1) MN DHS HCBS license record for We Care 4 U LLC (license 1114633); (2) MN.gov provider directory listings for multiple We Care 4 U services; (3) wecare4llc.com popup contact widget; (4) hadef.org popup contact widget. The same number serves as the public contact for both entities.

Full Timeline

8 events
We Care 4 U LLC operates wecare4llc.com, launched July 2023 with first cert from ZeroSSL; hosted on Hostinger (AS47583, IP 147.79.79.118)
2023-07-29
wecare4llc.com had a burst of 7 subdomain cert issuances in August 2024 (app, admin, backend, dev, staging, demo, ftp) — indicating a healthcare application platform build-out prior to DHS license activation
2024-08-08
wecare4ullc.com (typo variant) had a GoDaddy cert Jan 2024–Jan 2025, now NXDOMAIN — likely registered as placeholder then abandoned in favor of wecare4llc.com
2025-01-16
wecare4llc.com contact page lists HADEF's Suite 225 address instead of We Care 4 U's Suite 224 — reveals website was built by cloning HADEF's template
2026-03-27
wecare4llc.com and hadef.org share identical WordPress stack including theme (ekko), cache hash (qiyc4fz1), and hosting org — consistent with single administrator or shared web developer
2026-03-27
Phone (612) 800-4888 is shared between We Care 4 U LLC's DHS license record, MN.gov provider listings, wecare4llc.com, and hadef.org — confirming operator identity across entities
2026-03-27
We Care 4 U LLC uses two emails: operational inbox [email protected] and personal/alternative Gmail [email protected]
2026-03-27
HADEF maintains active @hadeforg social accounts on three platforms; We Care 4 U claims @wecare4u but all social links are dead/redirect to homepage
2026-03-27