SafeHop
Scam breakdown
Inside a fake Windows alert scam spread through online ads
Published 27 September 2026 · based on what we observed on 26 September 2026
In short: scammers running a Japanese-language tech-support scam placed ordinary-looking display ads. Anyone checking the ads saw harmless business and shop pages. Real visitors were quietly sent to a brand-new website that filled the screen with a fake "Windows Defender" warning and a phone number to call. Here is how each trick worked, and how to spot it.
We don't name the websites involved or print the scam phone number. This article is about the tricks, so you can recognise them wherever they appear next.
1. Where the ads appeared
The ads appeared on an ordinary Japanese-language entertainment website, the kind of photo slideshow with an ad on every slide. That website was not the scam. Like most websites, it shows ads chosen by an ad network, and some of those ads led to scams.
Every ad click carries an ID for the website the ad was shown on. That helps: when a scam ad is confirmed, other ads shown on the same website deserve a closer look. SafeHop keeps a list of websites where confirmed scam ads appeared and checks the ads shown there more strictly.
2. The decoy pages
Ad networks check where an ad leads before they run it. So the ads didn't point straight at the scam. They pointed at harmless-looking decoy pages:
- Template "company" websites: a business site with Japanese company-style text, where the menu links go nowhere.
- A "seasonal clothing shop" hosted in a cloud storage bucket instead of on a real shop platform.
The shop page looked like a shop at first. After it loaded and the mouse moved, it swapped in different, hidden content, without anything being clicked. Reviewers and automated scanners usually don't move a mouse, so they only ever see the decoy.
3. Same setup, same operation
Two of the decoy websites were never linked to each other openly, but they were set up in exactly the same way: the same domain registrar, the same DNS provider and the same hosting company.
Any one of these on its own means nothing. Those are ordinary, legitimate companies used by thousands of honest websites. But a brand-new site that matches a confirmed scam site on all three at once is worth a warning. SafeHop calls this a campaign fingerprint: once one site in an operation is confirmed, sites set up the same way get a warning when someone clicks them.
4. The scam page itself
Visitors who came from a real ad click ended up on a website registered just two days earlier. It showed a full-screen, blue, Windows-style warning in Japanese:
- a "Windows Defender security warning" heading;
- a claim that access to the PC had been blocked "for security reasons", and not to restart the computer;
- a "Microsoft Support" phone number to call.
Nothing on the computer is actually blocked. It is only a website in full-screen mode. In scams like this, the person who answers the phone typically asks for remote access to the computer and payment for a "repair". Microsoft does not put phone numbers in its security warnings.
The site also hid from anyone who didn't arrive through an ad. Opened directly, it simply sent the visitor on to google.com, and the phone number was not written on the page in plain text. So someone checking the address saw nothing unusual, while a real visitor saw the fake alert.
5. How SafeHop catches each step
| Step | What SafeHop sees | Result |
|---|---|---|
| Ad click to the cloud-storage "shop" | An ad leading straight to a file in a cloud storage bucket, not a real website | Warn |
| The shop page swaps its content | The page replaced itself after a mouse move, with no click | Block |
| Template "company" decoy | An ad from a website where scam ads were confirmed, landing on a template page with dead links | Warn |
| A second decoy set up the same way | Same registrar, DNS provider and hosting as a confirmed scam site | Warn |
| The two-day-old scam site | A brand-new domain reached from an ad | Warn |
| The fake Windows alert | Full-screen "your PC is blocked" wording with a support phone number, in Japanese or English | Block |
None of this depends on the sites already being on a blocklist. SafeHop judges them by what they do. The confirmed scam sites have also been added to SafeHop's blocklist, so every user is protected from them directly.
One honest limit: the very first decoy page of a brand-new operation, on a website with no scam-ad history, looks like a normal small business at the moment you click. SafeHop can't warn about that click. It catches the scam page that follows.
6. How to protect yourself
- A web page cannot lock your computer. If a page says your PC is blocked, press
Escto leave full screen and close the tab. If the tab won't close, pressCtrl+Shift+Escand end the browser in Task Manager. - Never call a number shown in a pop-up. Microsoft, Apple and antivirus companies don't put phone numbers in warnings.
- Never let a stranger connect to your computer with AnyDesk, TeamViewer or a "support tool".
- If you already called or paid, contact your bank or card company, change your passwords from a different device, and in Japan you can call the police consultation line
#9110or the consumer hotline188.
Get SafeHop
SafeHop is a free browser extension that follows every redirect behind a link, including ads, and warns you in plain words before a scam page opens. It doesn't need an account and doesn't track you.
This article describes what we observed on the date above, for public awareness. Websites change, and the sites involved may no longer exist. SafeHop is not affiliated with Microsoft, Google or any company mentioned; their names appear only because the scam imitated them or their services were involved. If you believe something here is inaccurate, write to [email protected] and we will review it promptly.