Tech-support scam: fake security alert that locks the browser and asks you to call 'support'
Pages that show a fake Microsoft, Windows Defender or Apple security alert (a blocked or infected computer, an error code, a warning sound), switch the browser to full screen, capture the keyboard and block leaving the page so the visitor cannot close it, and tell the visitor to call a 'support' phone number. The call is the scam: the caller is talked into paying for fake repairs or into installing remote-access software. One campaign places the alert on random subdomains of Azure Storage static websites (*.web.core.windows.net) and passes the phone number in the address (?phone=...), in English ('WIndows Err') and Japanese ('読み込みエラー') versions; its lure addresses are matched even after a site has been taken down. No genuine security warning locks the browser or asks you to phone a number.
Anchors
domain:*.web.core.windows.net AND url:*phone=*Provenance
Sightings (48)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| rubarodav.z1.web.core.windows.net | 1c29cbbb… | — | query | 2026-10-16 17:52 |
| rubarodav.z1.web.core.windows.net | 0700a01f… | — | query | 2026-10-16 17:52 |
| gasevinul.z1.web.core.windows.net | cfbd6b29… | — | query | 2026-10-16 17:51 |
| gasevinul.z1.web.core.windows.net | 9aa56fb6… | — | query | 2026-10-16 17:51 |
| gasevinul.z1.web.core.windows.net | 4640a659… | — | query | 2026-10-16 17:51 |
| pewaweyet.z1.web.core.windows.net | 355e38e6… | — | query | 2026-10-16 12:50 |
| pewaweyet.z1.web.core.windows.net | fa3bf7f1… | — | query | 2026-10-16 12:50 |
| cewegebit.z31.web.core.windows.net | 9838c0f0… | — | query | 2026-10-16 12:50 |
| cewegebit.z31.web.core.windows.net | fbd0f9f4… | — | query | 2026-10-16 12:50 |
| vagesomay.z21.web.core.windows.net | 8016ba9d… | — | query | 2026-10-11 05:27 |
| dusayotu.z5.web.core.windows.net | 7118ab3a… | https://dusayotu.z5.web.core.windows.net/eey0kr/#html | yara | 2026-10-10 03:22 |
| rubarodav.z1.web.core.windows.net | d7548456… | https://rubarodav.z1.web.core.windows.net/gx/index.html?phone=%2B1-844-959-2863#html | yara | 2026-10-09 16:52 |
| rubarodav.z1.web.core.windows.net | d7548456… | — | query | 2026-10-09 16:52 |
| rubarodav.z1.web.core.windows.net | f672d172… | https://rubarodav.z1.web.core.windows.net/gx/index.html#html | yara | 2026-10-09 16:52 |
| rubarodav.z1.web.core.windows.net | 75a640cc… | https://rubarodav.z1.web.core.windows.net/?phone=%2B1-844-959-2863#html | yara | 2026-10-09 16:52 |
| rubarodav.z1.web.core.windows.net | 75a640cc… | — | query | 2026-10-09 16:52 |
| rubarodav.z1.web.core.windows.net | 243c44fa… | https://rubarodav.z1.web.core.windows.net/?phone=#html | yara | 2026-10-09 16:51 |
| rubarodav.z1.web.core.windows.net | 243c44fa… | — | query | 2026-10-09 16:51 |
| rubarodav.z1.web.core.windows.net | 12fd8b9f… | https://rubarodav.z1.web.core.windows.net/#html | yara | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | d2390c24… | https://gasevinul.z1.web.core.windows.net/gx/index.html?phone=%2B1-844-959-2863#html | yara | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | d2390c24… | — | query | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | 77d91e1b… | https://gasevinul.z1.web.core.windows.net/gx/index.html#html | yara | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | 66e56919… | https://gasevinul.z1.web.core.windows.net/?phone=%2B1-844-959-2863#html | yara | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | 66e56919… | — | query | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | 2bacd7f5… | https://gasevinul.z1.web.core.windows.net/?phone=#html | yara | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | 2bacd7f5… | — | query | 2026-10-09 16:51 |
| gasevinul.z1.web.core.windows.net | e1574654… | https://gasevinul.z1.web.core.windows.net/#html | yara | 2026-10-09 16:51 |
| pewaweyet.z1.web.core.windows.net | 924ac189… | — | query | 2026-10-09 11:51 |
| pewaweyet.z1.web.core.windows.net | f791c2b1… | — | query | 2026-10-09 11:51 |
| cewegebit.z31.web.core.windows.net | e3d0db94… | — | query | 2026-10-09 11:50 |
| cewegebit.z31.web.core.windows.net | f43bbf80… | — | query | 2026-10-09 11:50 |
| cewegebit.z31.web.core.windows.net | fecb2243… | — | query | 2026-10-09 11:50 |
| gabogeveba.z1.web.core.windows.net | d0561dad… | https://gabogeveba.z1.web.core.windows.net/?phone=%2B1-844-959-2863#html | yara | 2026-10-07 13:36 |
| gabogeveba.z1.web.core.windows.net | d0561dad… | — | query | 2026-10-07 13:36 |
| locolacus.z1.web.core.windows.net | c9f108fd… | https://locolacus.z1.web.core.windows.net/?phone=%2B1-844-959-2863#html | yara | 2026-10-06 13:29 |
| locolacus.z1.web.core.windows.net | c9f108fd… | — | query | 2026-10-06 13:29 |
| fururefif.z1.web.core.windows.net | 337a43d3… | — | query | 2026-10-05 00:55 |
| fuvofepa.z14.web.core.windows.net | 25e8713f… | — | query | 2026-10-02 05:45 |
| spiderman-one-delta.vercel.app | bc116b7f… | https://spiderman-one-delta.vercel.app/assets/Home-PduBlHy5.js | yara | 2026-10-01 14:45 |
| spiderman-one-delta.vercel.app | 60cf49e0… | https://spiderman-one-delta.vercel.app/assets/Home-PduBlHy5.js | yara | 2026-10-01 00:45 |
| puselili.z20.web.core.windows.net | 02d0295a… | — | query | 2026-09-29 09:02 |
| isoihg-dpnllatkc5tk.edgeone.dev | 34b12e3c… | https://isoihg-dpnllatkc5tk.edgeone.dev/js/HsdqpNsd.js | yara | 2026-09-28 12:45 |
| isoihg-dpnllatkc5tk.edgeone.dev | 60395b4d… | https://isoihg-dpnllatkc5tk.edgeone.dev/js/HsdqpNsd.js | yara | 2026-09-28 02:50 |
| pinemamu.z1.web.core.windows.net | 2748631e… | https://pinemamu.z1.web.core.windows.net/i1jgc8m/#html | yara | 2026-09-26 05:40 |
| mipipave.z28.web.core.windows.net | 38a41a2d… | https://mipipave.z28.web.core.windows.net/mcily9hd/#html | yara | 2026-09-17 11:30 |
| supp0rt-assistance.vercel.app | 923d4ab0… | https://supp0rt-assistance.vercel.app/js/app.js | yara | 2026-08-30 12:45 |
| uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net | 21d4cd0c… | https://uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net/MacAbhwebsi018/main.js | yara | 2026-03-20 16:43 |
| uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net | 21d4cd0c… | https://uisnasxxii-gzgubwebchcncmbk.z02.azurefd.net/MacAbhwebsi018/main.js#html | yara | 2026-03-20 16:43 |