'+844-391-8111' Pop-Ups
The '+844-391-8111' pop-up windows are produced on phishing pages that you are more than likely to find on domains that are not controlled by Microsoft Corp. The '+844-391-8111' pop-up windows are usually produced by pages, which appears in the URL bar as hxxp://[phishing domain]/call-for-microsoft-support-[phone line]. We have received numerous reports from Web surfers that have complained from disturbing 'Microsoft Security Tollfree:+844-391-8111' alerts on their screen. The first complaints associated with the '+844-391-8111' phone line were registered in October 2018, and it was discovered that there are many phishing domains hosted on the 104.248.237.69 IP address. The phishing domains were used to deploy misleading information to Web surfers and affect their Web browsers in a way that simulates a potential security compromise. The '+844-391-8111' pop-ups were generated by hxxps://www.zsede[.]cf/call-for-microsoft-support-1-844-391-8111 and featured the following message:
'Microsoft Security Tollfree:
+1-844-391-8111
VIRUS ALERT FROM MICROSOFT
This computer is BLOCKED
Do not close this windows and restart your computer
Your computer's registration key is Blocked.
Why blocked your computer?
The window's registration is using pirated software.
This window is sending virus over the internet.
This window is hacked or used from undefined location.
We block this computer for your security.
Contact microsoft helpline to reactivate your computer.'
Also, the page loaded in the user's browser initiates an automatic download of numerous copies of 'This computer is infected.html.' Another script on hxxps://www.zsede[.]cf/call-for-microsoft-support-1-844-391-8111 was responsible for loading an altered screenshot of Support.microsoft.com in full-screen mode. PC users were suggested that they have activated a pirated copy of Windows and their machine was sending viruses over the Internet. The text on hxxps://www.zsede[.]cf/call-for-microsoft-support-1-844-391-8111 is not authored by Microsoft employees, and you should not call the '+844-391-8111' phone line. We have found that there are more than a few phishing domains on the 104.248.237.69 IP address that should be avoided staring with:
hxxps://www.gcix[.]cf/call-for-microsoft-support-1-877-286-9666
hxxps://www.icix[.]cf/call-for-microsoft-support-1-866-571-9777
hxxps://www.ncix[.]cf/call-for-microsoft-support-1-877-324-0222
hxxps://www.nsede[.]cf/call-for-microsoft-support-1-844-628-5888
hxxps://www.ssede[.]cf/call-for-microsoft-support-1-855-915-7111
hxxps://www.zsede[.]cf/call-for-microsoft-support-1-844-391-8111
Pc users are encouraged to ignore the 'Microsoft Security Tollfree:+844-391-8111' alerts and terminate the browser's process if it is needed to remove the '+844-391-8111' notifications. You should note that the domains connected to the '+844-391-8111' technical support tactic include several other phone lines. Do not call any number listed on your screen because you are likely to contact con artists. Microsoft does not operate the 'zsede[.]cf' domain and the '+844-391-8111' phone line. You should seek help with Windows at the official support hub on https://support.microsoft.com and avoid lines like:
844-391-8111
844-628-5888
855-915-7111
866-571-9777
877-286-9666
877-324-0222
