Recent Reports

Tech support scams

Pop-ups or calls claiming your device is infected, then asking for remote access or payment.

Browse by type of scam

Investing & crypto136Fake trading apps, crypto, Ponzi schemes and 'recovery' offers.
Impersonation68Fake government agents, tech support, family members, deepfakes and debt collectors.
Phishing, texts & email33Fake links, toll and delivery texts and gift-card payment demands.
Shopping & online84Fake stores, marketplaces, counterfeits, tickets, pets and car deals.
Jobs, prizes & offers0Fake jobs and recruiters, prizes, lotteries, loans, grants and charities.
Banking, cards & identity0Account takeovers, card and check fraud, identity theft, hacking and money mules.
Home, health & travel2Rentals, contractors, movers, timeshares, travel, insurance and Medicare.
Romance, personal & other0Romance scams, sextortion, scams aimed at older adults and everything else.

Showing 4 reports in

ImpersonationTech supportClear filters

Infoblox ties Help TDS tech-support scams on 20,000+ abused Cloudflare Pages (pages.dev) subdomains to Hotejka

Infoblox links the Help TDS traffic system, which sends victims to fake Microsoft support pages on throwaway Cloudflare Pages subdomains, to the Hotejka affiliate program, a likely rebrand of ROI777.

roi777.com (historical ROI777 command-and-control domain used 2018–2020, per GoDaddy; not a current scam site)
Hotejka affiliate program; Telegram @hotejka_hot; disposable *.pages.dev tech support scam pages

Reported Oct 15, 20261 report

Tech supportReviewed

Hornetsecurity: retailer and bank callback tech-support scam uses Onoff numbers

Hornetsecurity found 150,000+ messages posing as Darty, BUT, Cdiscount and French bank alerts that push people to call fake 'support' numbers; the retailers and banks are impersonated.

(018) 962-9302
Callback numbers on the Onoff virtual-number service (Onoff not implicated, per Hornetsecurity); impersonates Darty, BUT, Cdiscount and French banks

Reported Oct 15, 20261 report

Tech supportReviewed

Fake Claude installer at claude-desk-code.com pushed via Google Ads

Push Security found Google search ads routed through Bing redirects sending people searching "claude mac" to claude-desk-code.com, a fake Claude download page that copies a malicious command.

claude-desk-code.com
Payload host: lake-90.com

Reported Oct 13, 20261 report

Tech supportReviewed

Tech support scam page on basiviro.z1.web.core.windows.net

A user reported a tech support scam lure whose link led to basiviro.z1.web.core.windows.net, a fake warning page that pushes victims to call an international phone number.

basiviro.z1.web.core.windows.net

Reported Oct 13, 20261 report