'Your device is under threat' Pop-Ups

The 'Your device is under threat' pop-ups from pages like h[tt]p://akrons[.]xyz/ should not be trusted. The 'Your device is under threat' pop-up windows, and new tabs may feature the title 'Security Warning,' as well as a modified screenshot of the security panel in the Windows 10 to convince users into following the displayed instructions for securing their device. The 'Your device is under threat' warnings are displayed on phishing pages that promote the services of fake computer support agencies. The 'Your device is under threat' new tabs offer misleading information and aim to trick the user into paying hundreds of dollars to uncertified helpdesk representatives. The 'Your device is under threat' alerts were found on the h[tt]p://akrons[.]xyz/ Web page and the IP address lookup — 23.229.183.37 — revealed there are many more phishing pages with the same type of content. The pages used to display the 'Your device is under threat' alerts appear to follow a certain naming pattern as seen below:

• h[tt]p://[RANDOM WORD].xyz/securities-firewall-failure.ml/index.html
• h[tt]p://[RANDOM WORD].xyz/securities-firewall-failure.ml/[124 RANDOM NUMBERS]
• h[tt]p://[RANDOM WORD].xyz/microsoft-virus-support0.xyz/index.html

A few examples to point out are:

h[tt]p://melots[.]xyz/microsoft-virus-support0.xyz/index.html
h[tt]p://kralos[.]xyz/securities-firewall-failure.ml/index.html

A sample of the 'Your device is under threat' messages can be found below:

'Your device is under threat
turn on Real-time protection?
Virus&threat Protection
Real-time protection is off,
Leaving your device vulnerable.

The server – is asking for your username and password. The server reports that it is from Suspicious activity detected on your IP address due to harmful virus installed on your computer. Call Toll Free now for any assistance. Your data is at a serious risk. There is a system file missing due to some harmful virus Debug malware error, system failure. Please contact technicians to rectify this issue. Please do not open Internet browser for your security issue to avoid data corruption on your operating system.'

Do not call toll-free phones lines like 844-384-6777 that may be promoted on the 'Your device is under threat' pop-ups. Additionally, the 'Your device is under threat' notifications may request that you enter your Windows account credentials and "verify your identity to the server." It is not recommended to enter your Microsoft credentials in the 'Your device is under threat' window. Your account may be hijacked if you follow through with the instructions displayed on phishing pages like h[tt]p://akrons[.]xyz/. Blocking the 'Your device is under threat' pop-ups can be blocked via your AV product of choice but you may want to add extensions like uBlock Origin and Adblock as well. We have recorded that the 23.229.183.37 IP address hosts the following pages associated with the 'Your device is under threat' technical support tactic:

agogls[.]xyz, andois[.]xyz, kalors[.]xyz, kemts[.]xyz, krodis[.]xyz, olegas[.]xyz, rekods[.]xyz, akrons[.]xyz, alrons[.]xyz, kalks[.]xyz, kdrons[.]xyz, kronds[.]xyz, airnds[.]xyz, akaks[.]xyz, alopns[.]xyz, kreons[.]xyz, rentors[.]xyz, kilosps[.]xyz, krongs[.]xyz, knors[.]xyz, aknos[.]xyz, deips[.]xyz, dronis[.]xyz, kojis[.]xyz, konis[.]xyz, koros[.]xyz, landswemrealty[.]com, wintos[.]xyz, gaglis[.]xyz, kiloks[.]xyz, kornis[.]xyz, morningskatepod[.]com, kalkos[.]xyz, kealos[.]xyz, kekols[.]xyz, kermos[.]xyz, ktors[.]xyz, kaklos[.]xyz, kakros[.]xyz, kolors[.]xyz, renkos[.]xyz, derons[.]xyz, keois[.]xyz, kworls[.]xyz, denros[.]xyz, kalits[.]xyz, kernds[.]xyz, kervs[.]xyz, korms[.]xyz, kalist[.]xyz, kerafs[.]xyz, kralos[.]xyz, kwels[.]xyz, abors[.]xyz, ajnls[.]xyz, anikols[.]xyz, anils[.]xyz, autins[.]xyz, kemors[.]xyz, kenosm[.]xyz, melots[.]xyz, abilos[.]xyz, abros[.]xyz, alovns[.]xyz, anilos[.]xyz, aronds[.]xyz, latons[.]xyz, abufs[.]xyz, aklans[.]xyz, albas[.]xyz, amips[.]xyz, amonfs[.]xyz, azlam[.]xyz, akroms[.]xyz, alibas[.]xyz, alvios[.]xyz, aronis[.]xyz, akrao[.]xyz, alhads[.]xyz, alvino[.]xyz, amola[.]xyz, amontis[.]xyz, azarko[.]xyz, anerts[.]xyz, aopils[.]xyz, apitis[.]xyz, aplios[.]xyz