Tech support scam page on movecogi.z16.web.core.windows.net pushed via fake "email sent from your account" alerts
@harugasumi reported on 1 November 2026 that emails titled “About emails sent from your own account” lead to a tech-support scam page on Azure hosting at movecogi.z16.web.core.windows.net. Do not call the number on the page.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese researcher @harugasumi, who tracks scam emails, posted on X on 1 November 2026 about suspicious emails with the subject “ご自身のアカウントから送信されたメールについて” (“About emails sent from your own account”). According to the post, links in these emails, such as movecogi.z16.web.core.windows.net/cvpbqha/, lead to a tech-support scam (サポート詐欺) site. The researcher warns people not to call the international phone number shown on the site, and notes that it ends in 16422. The page is hosted on web.core.windows.net, Microsoft's Azure static-website hosting. Microsoft's service is being misused; the hosting domain itself is not run by the scammers.
How the scam works
The email screenshot in the post is a Japanese-language message dated 1 November 2026 and headed “Important notice”. It says that an unusual email has been confirmed as sent from the reader's account, that the sender recorded is the account the reader is currently using, and that if the reader does not recognise the message they should check their recent sending history. It then offers two links, to check sending history and to check the account's access history, both pointing to the same Azure address, and is signed “Security Team”. The sender and recipient details are blacked out by the researcher. A second screenshot from the urlscan.io service flags the page as potentially malicious and shows a pop-up posing as a Windows Defender warning with a technical-support phone number.
Tech-support scams work by frightening people into calling. The page shows a fake virus or security alert, often full-screen, and tells the visitor to phone “support”. The person on the line then asks for remote access, payment or card details. Scammers like cloud storage and static-hosting addresses because they have a trusted name, cost little and are replaced quickly. The post does not say what happens on the phone call.
A real security warning from Windows or a browser never asks you to call a phone number.
Source
@harugasumi on X, post of 1 November 2026 (email screenshot and urlscan.io result). Not independently verified by scammers.com.
Red flags
- An email saying an unusual message was sent from your own account, with links to check “sending history”.
- A link to a web.core.windows.net address that has nothing to do with your email provider.
- A page showing a fake Windows or antivirus alert with an international phone number.
- A message that warns of risk but gives you no way to check it inside your real account.
- Pressure to call a number or install software to “fix” a problem.
If you were targeted
- 1Do not call the phone number shown on movecogi.z16.web.core.windows.net or any similar page.
- 2Close the page; if it will not close, restart the browser rather than clicking anything on it.
- 3If you called, never allow remote access, never read out codes, and contact your bank at once if you paid.
- 4Check your real email account directly through the provider's own app or site.
- 5Report the email as phishing to your provider, and tell family members who may be targeted.