TECH SUPPORT SCAM WAVE — 20,000+ FAKE ALERT DOMAINS
Is that "Windows Security Alert" real — or a scam?
On October 15, 2026, researchers at Infoblox reported that a long-running scam network called Help TDS — now linked to an affiliate program named Hotejka — is serving fake Microsoft Windows security alerts across more than 20,000 domains on Cloudflare's free hosting. The alerts lock your browser, show a phone number, and the call center on the other end talks victims into installing remote-access software. Spot one in 30 seconds with the check below. No signup, nothing installed.
The 30-second spot-the-scam check
1
You can't close the tab. The page goes fullscreen, or the alert pops straight back when you try to leave. Real Microsoft warnings never trap your browser.
2
It shows a phone number to call. Microsoft will never ask you to call a number from a browser popup. That number reaches a scam call center, not support.
3
Scare language and fake error codes. "Virus detected!", "Your computer is blocked", long codes like 0x800... — all written to panic you into acting fast.
4
It tells you to install something. Especially "remote support" or screen-sharing software. That is the actual goal: getting inside your computer.
5
Check the address bar. If it is not microsoft.com, it is not Microsoft. This wave runs on throwaway domains, many on free pages.dev hosting.
Two or more of these → it is a scam. Close it, call nobody, install nothing.
A genuine Windows Security notification comes from the Windows Security app on your own PC — never from a website, never with a phone number.
A fake alert just popped up — do this
Do not call the number. Do not install anything. Nothing on that page can help you; everything on it can hurt you.
Kill the tab: press Alt+F4 on Windows (or force-quit the browser on Mac). If the browser offers to restore tabs, say no.
Revoke notification permission if you ever clicked "Allow" on a suspicious popup: Settings → Privacy → Site settings → Notifications — remove the site. This is how the follow-up spam reaches you.
Warn the people scammers want most: older relatives and anyone who panics at a virus warning. Send them this page.
Why this wave is hard to stop
It runs like a business: hacked websites funnel visitors into a traffic system that profiles each visitor and routes the most convincing targets to the fake alert.
Everyone else's traffic gets resold to fake "verify you are human" pages that ask for notification permission — then monetized with spam pushes.
The domains are disposable (20,000+ and rotating daily). The scam kit behind them is not — which is why defenders now fingerprint the kit, not the domains.
Source: Infoblox threat research on Help TDS / Hotejka, reported October 15, 2026.