harugasumi warns S3-hosted tech-support scam page with international callback
Tracker @harugasumi says account-confirmation emails lead to an S3-hosted tech-support scam page urging calls to an international number ending 16358.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 6 November 2026 the Japanese scam tracker @harugasumi posted on X that suspicious emails with subjects such as ご利用のアカウントから送信されたメールの確認について (about confirming mail sent from your account) lead to a tech-support scam page hosted at hxxps://rsg63gpp.s3.us-east-2.amazonaws.com/index.html. The post urged readers never to call the international phone number shown on the site, which ends in 16358.
How the scam works
The email claims there is a problem with messages sent from the recipient's account and asks them to check through a link. That link opens a page stored in an Amazon S3 cloud storage bucket, a service anyone can rent, so the amazonaws.com address does not mean Amazon or any email provider is involved. Tech-support scam pages typically show a frightening warning that the computer or account has been compromised and tell the visitor to call a support number immediately.
When victims call, a fake technician usually asks them to install remote-access software, then claims to find infections or fraud and demands payment, gift cards or online banking access to fix it. Some callers are talked into moving money to a so-called safe account. In this case the number is international, so calling it may also be expensive. The tracker tagged the post #サポート詐欺 (support scam) and #Phishing, and a follow-up the same day said the campaign had resumed after roughly two quiet days.
Genuine email providers and security companies do not ask you to phone a number shown on a pop-up page. Close the browser tab, or restart the browser if it will not close, and do not call. If you already called and allowed remote access, disconnect the computer from the internet, have it checked, change passwords from another device and tell your bank. The details come from the tracker's post and have not been independently checked by scammers.com.
Source
Post by @harugasumi on X, 6 November 2026, on an S3-hosted tech-support scam page. Not independently verified by scammers.com.
Red flags
- An unexpected email saying mail sent from your account needs confirming.
- A link that opens a warning page on a cloud storage address such as s3.amazonaws.com.
- A pop-up page telling you to phone an international support number.
- A caller who asks you to install remote-access software or pay to fix a problem.
If you were targeted
- 1Do not call any phone number shown on an unexpected security-warning page.
- 2Close the tab or restart the browser; real warnings do not require a phone call.
- 3If you called and gave remote access, disconnect the device and have it checked.
- 4Change passwords from a different device and tell your bank if you paid or shared banking details.
- 5Report the email to your provider and delete it.