Tech-support scams turn a website visit into a support call.

A tech-support scam page claims the visitor's computer or phone is locked, infected or involved in a suspicious payment, then tells them to call support. On a compromised website, injected JavaScript loads a remote stage that redirects the browser to that page.

compromised website
  -> injected script fetches and runs a remote stage
  -> redirect through changing hosts
  -> fake security alert, full-screen warning or locked-screen page
  -> alarm, exit traps and an attacker-supplied support number

An injected loader sends the visitor to the alert

StripCall fetches a remote response with cache: "no-store", removes its script wrappers and runs the text with eval. Its retained stage sends the browser through a randomly generated sslexmo[.]info subdomain and path. The captured chain reaches a fake Microsoft Firewall and Defender warning that asks the visitor to call Windows support.

Other fetch-and-strip loaders run the returned text through indirect eval or the Function constructor. The initial website holds the loader, while the remote response supplies the redirect. Inspect both the website's source and the requests that follow it.

The page makes a browser tab look like a locked computer

Fake Windows warnings request full-screen mode, hide the cursor and call navigator.keyboard.lock(). Keyboard handlers suppress keys such as Escape and the refresh key. The Microsoft alert reached through the captured redirect chain adds pointer lock and alarm audio. English and Japanese warning pages repeat support numbers beside claims that access to the system has been blocked.

The number can come from a phone query parameter. One retained Windows error page decodes a percent-encoded HTML wrapper, writes that number into repeated warnings, requests full-screen mode and loops an alarm. Other pages put a Windows ID and password prompt beside the support number.

Leaving the page triggers more interference. Scripts add browser-history entries and replace them when the visitor presses Back, use beforeunload handlers to interrupt navigation, and keep warning overlays visible. A captured anti-exit script hides this behaviour from Meta and Google ad-review crawlers before installing its history and full-screen traps.

Phone lures reopen warnings and telephone links

Fake Apple support pages claim an Apple Pay charge or illegal activity has locked the device. Some open a tel: handler as soon as the page loads. Others reopen a dismissed alert, repeatedly trigger telephone links or flood the page with call links. The warning and support number are supplied by the page's JavaScript.

What we see across these sites

Month	New sites
September	290
October so far	36

Of the 113 sites captured since 25 September, 76 ran WordPress. Among those WordPress sites, 27 had Contact Form 7 and 21 had Elementor.

Of the 44 sites recaptured at least 25 days after their first match, 32 still served tech-support scam code (73%).

Finding and removing the redirect

Preserve the page source and network log, then compare the website with a trusted deployment. Check for:

• added scripts that fetch remote text, strip script tags and pass the result to eval or Function
• redirects through changing subdomains before a Microsoft, Windows or Apple warning
• a support number supplied by a URL parameter or a separate configuration script
• full-screen, keyboard-lock and pointer-lock calls beside a fake security alert
• alarm audio, suppressed keyboard events, history traps and beforeunload handlers
• repeated telephone links or alerts that reopen after dismissal

Remove the injection and restore changed site files from trusted sources. Review CMS, hosting and deployment access, rotate affected credentials and clear caches. Test the original reported path again and record every redirect it makes.