Tech support scam page on d1g9mpv1gr3wxx.cloudfront.net pushed via fake "security alert" emails
@harugasumi reported on 1 November 2026 that “security alert” emails lead to a tech-support scam page at d1g9mpv1gr3wxx.cloudfront.net. The page is on Amazon CloudFront hosting, which is being misused. Do not call the number shown.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese researcher @harugasumi posted on X on 1 November 2026 about suspicious emails with a subject along the lines of “【重要】<domain> セキュリティアラート：未承認のアクティビティが検出されました” (“[Important] <domain> security alert: unauthorised activity detected”). According to the post, links in these emails, such as d1g9mpv1gr3wxx.cloudfront.net, lead to a tech-support scam (サポート詐欺) site. The researcher warns people never to call the international phone number shown on the site. The page is hosted on Amazon CloudFront, a content-delivery service that the scammers are misusing; the hosting company is not involved.
How the scam works
The screenshot of the email shows a message that looks as if it comes from the recipient's own Japanese internet provider, with the provider's ne.jp domain written into the subject, greeting and signature. It says an abnormal sign-in attempt was detected, listing repeated login failures from an unrecognised device in Kyiv, Ukraine, with a partly hidden IP address. It says some features, such as sending email and access to shared storage, are temporarily restricted, and tells the reader to sign in through a link to complete a security check and reset the password. It warns that the account will be fully locked within 24 hours if this is not done. The names and addresses of the recipient and sender are blacked out.
The design is aimed at two things. A personalised alert with the real domain makes the message look official, and a 24-hour deadline pushes people to click. The page behind the link then follows the usual tech-support pattern of a loud security warning and a phone number. The post does not describe the call itself.
A real provider's alert will not demand that you call an international number, and you can always check your account by going to the provider's site yourself.
Source
@harugasumi on X, post of 1 November 2026 (email screenshot). Not independently verified by scammers.com.
Red flags
- An email claiming unauthorised activity or restricted features, with the provider's domain in the subject.
- A 24-hour threat that the account will be locked unless you sign in through a link.
- A link to a cloudfront.net address instead of your provider's own site.
- A page that shows a loud security warning and an international phone number.
- A location, such as a foreign city, quoted in the alert to create alarm.
If you were targeted
- 1Do not call the number shown on d1g9mpv1gr3wxx.cloudfront.net or any similar page.
- 2Do not click the link in the email; check your account by typing the provider's address yourself.
- 3If you called or gave access, disconnect the device, change passwords from a clean device and contact your bank if you paid.
- 4Never install remote-access software for someone who contacts you about a security alert.
- 5Report the email as phishing to your provider.