whackYahoo Mail malvertising: two cloaked tech support scam chains
Two scam operations ran ads in the same sponsored slot of AT&T's Yahoo Mail on October 7 and 8, 2026. In whack.sh scans of the original ad click links, only Windows desktops on home broadband received the fake Microsoft security alert and its toll-free number. Our visits from a data center and from a phone received a dating or personal finance article.
The first ad framed the alert over a dating article on checkouters[.]app. The second ad passed through a Branch deep link and a filtering server (TDS) at maizerubyen[.]site. That server sent our home broadband visit to a scam page on Azure static website hosting. The first operation's scam kit appears in 747 public scans of 536 cloud hostnames. The scans run from July 12 to October 10, 2026, the 90 days our archive search reaches.
William Vincent, a whack.sh customer, noticed something off about the ads and sent us the original click links. A second review by Kirk of ohey.ca added 31 hostnames and three Azure environments to the kit's footprint.
The story on tuxxin.com lists the reports we filed with each provider and explains what to do after seeing the alert.
The ad and its click tracker
The ad sat in the inbox list like an email. Its sender line read "CHECKOUTERS" and its subject read "(1) New Message". A small "Ad" label marked it as sponsored.
A click passed through Taboola's click tracker under the publisher ID yahoo-mail-att. That is the AT&T edition of Yahoo Mail, which serves att.net, sbcglobal.net, bellsouth.net and other AT&T addresses. Taboola sells the native ads across Yahoo's sites under a 30-year agreement.
The first ad's tracking link listed a cost of 0.25 per click, with no currency.
What each network received
whack.sh opens one link from several networks at once and compares what each receives. We classified every exit address with WorldIP, which reports an address's owner, country and network type.
| Ad | Network (WorldIP) | Device | Page served |
|---|---|---|---|
| First ad | Home broadband, Comcast, US | Windows desktop | Full-screen scam frame on one visit, plain article on the next |
| First ad | Home broadband, Charter, US | Windows desktop | Full-screen scam frame |
| First ad | Home broadband, Cox, US | Windows desktop | Full-screen scam frame |
| First ad | Mobile carrier, T-Mobile, US | Android phone | Dating article |
| Second ad | Data center, OVH, France | Windows desktop | Personal loan article |
| Second ad | Home broadband, Cox, US | Windows desktop | Scam alert page |
The scam appeared only on visits that arrived through a fresh ad click. We opened the first ad's landing page directly eight times, with and without its tracking codes. Every visit returned the dating article.
The first ad's frame was intermittent. Our Comcast visits received the frame once and the plain article on the next try. No data center visit ran on the first ad's link.
First chain: an Azure frame over a dating article
The first ad led to checkouters[.]app, a dating article site registered on September 23, 2026. On Windows desktops on home broadband, the page covered itself with a full-screen frame served from Microsoft Azure Container Apps.
The frame displayed the fake alert and a toll-free number. The address bar kept showing the dating site.
The frame came from zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]io and showed +1 888-883-5786.
Second chain: a Branch link and a filtering server (TDS)
The second ad passed through a Branch deep link, 325235dgsg.app[.]link, and then through maizerubyen[.]site. That server sent our data center visit to a personal finance article on another site.
Our visit from a home broadband address went to a page on Azure static website hosting, w08win10m844n2491c001.z13.web.core.windows[.]net. It showed the alert and the number +1 844-959-2491.
The scam page checked each visitor's location with two IP lookup services and loaded a Tawk.to live chat window. The chat account was created in June 2024.
The same chat account and lookup key appeared on another Azure page on September 24. A Taboola ad and a second Branch deep link, walletsaver.app[.]link, led to that page.
Dating the infrastructure with issued.live
issued.live tracks Certificate Transparency (CT) logs, domain registrations and DNS address history for more than 477 million domains. We used it to date the domains in both chains.
The filtering domain maizerubyen[.]site was registered on September 17, 2026. It went three weeks without a TLS certificate.
Its first certificate, valid from 12:44 UTC on October 8, reached the CT logs at 13:43 UTC. The ad click we analyzed came about two hours later, at 15:51 UTC. issued.live's reverse IP lookup found no other domain on the filtering server (TDS) at 64.177.41[.]125.
The second chain's scam page also loaded a tracking script from userstatics[.]com. That domain was registered in 2020. issued.live first recorded it on its current server, 94.154.32[.]91, on August 13, 2026.
Public certificate logs show certificates for the domain without a break since November 2020. issued.live's certificate history for its current server shows new certificates in July, August and September 2026. Neighboring addresses host sites whose names imitate Polish marketplace offers and Dutch delivery notices.
The domain dates to 2020, and different scam kits load it.
The scam kit runs on hundreds of cloud hostnames
The first operation's scam page comes from a kit, a set of files reused on every host. We found it in 747 public urlscan scans between July 12 and October 10, 2026, the furthest back our search reaches. About 600 of those scans captured the kit itself.
Kirk's review added 31 of those hostnames and three more Azure environments. The scans by month:
| Period | Public scans |
|---|---|
| July 12 to 31 | 186 |
| August | 206 |
| September | 275 |
| October 1 to 10 | 80 |
The pages sat on 536 different hostnames, most of them on Azure Container Apps across 13 Azure regions. By platform, 382 ran on Azure Container Apps, 106 on Azure Front Door, 34 on Laravel Forge, 9 on Cloudflare Workers, 4 on Cloudflare Pages and 1 on Vercel.
The pages listed 160 phone numbers, 126 of them US toll-free numbers. A Japanese-language version writes North American numbers in the format for dialing from Japan. A few numbers are in Hong Kong, Switzerland and Japan.
The kit's front page sends each visitor to a version for their operating system: Windows, macOS, Android or iOS. The Windows version, in English and Japanese, adds a fake locked screen with a Microsoft account sign-in box. Its fields are read-only, and the box points the visitor to the phone number.
These counts cover only pages that someone submitted to a public scanner. A few archived links carry tags that label the traffic as paid Facebook ads, and at least one carries a push-traffic click ID. These tags point to traffic sources beyond Taboola.
Detection trails the ads
On October 10, none of the 92 vendors on VirusTotal flagged checkouters[.]app. Two vendors rated the filtering domain suspicious, and none rated it malicious. Neither result had changed on October 11.
On the evening of October 11, Microsoft Edge showed a phishing warning for checkouters[.]app. When the warning first appeared, and what triggered it, is unknown.
Status on October 11
We re-checked the 536 hostnames at about 00:40 UTC on October 11 through webfetch.io. Nine still served the kit, and public scans had recorded eight of them in October.
Of the rest, 167 no longer resolved, 108 returned not-found errors and 228 did not answer within 60 seconds. Another 15 showed block or takedown pages from Cloudflare, Laravel Forge and Vercel. The remaining nine returned unrelated pages or errors.
In the same check, the first ad's landing page still loaded, and both Branch deep links still redirected. The second operation's filtering server (TDS) no longer answered. Its deep link sent our visits from data center and ISP addresses to the finance article, and its scam pages from October 8 and September 24 no longer resolved.
These checks ran before we filed the abuse reports listed in the tuxxin.com story.
Indicators
Domains and addresses are defanged. First seen is the earliest date in our scans, public scan archives or issued.live.
| Type | Indicator | First seen |
|---|---|---|
| Ad landing page | checkouters[.]app | 2026-10-07 |
| Filtering server (TDS) | maizerubyen[.]site | 2026-10-08 |
| Filtering server (TDS) address | 64.177.41[.]125 | 2026-10-08 |
| Deep link | 325235dgsg.app[.]link | 2026-10-06 |
| Deep link | walletsaver.app[.]link | 2026-09-24 |
| Scam page | zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]io | 2026-10-08 |
| Scam page | w08win10m844n2491c001.z13.web.core.windows[.]net | 2026-10-08 |
| Tracker | userstatics[.]com | 2020-11-05 (registered) |
| Tracker server | 94.154.32[.]91 | 2026-08-13 |
| Phone | +1 844-959-2491 | 2026-10-08 |
| Phone | +1 888-883-5786 | 2026-10-08 |
| Phone (seen by William Vincent) | +1 866-949-7055 | 2026-10-08 |
The full list of 536 scam kit hostnames, defanged, with the first and last date each was seen, is in yahoo-mail-scam-kit-hosts-2026-10-10.csv.
36988b0009b0a91a55de19380ea36eeac36f22c01d3d20d8708e35700dfefcb9 yahoo-mail-scam-kit-hosts-2026-10-10.csvTools used in this investigation
| Step | Tool | What it showed |
|---|---|---|
| Compare what each network receives | whack.sh multi-source scan | The scam for Windows desktops on home broadband, an article for our data center and phone visits |
| Rebuild the redirect chain | whack.sh request log | Ad click, deep link, filtering server (TDS) and scam page, hop by hop |
| Classify each address | WorldIP | Network type, owner and country for each of our exits |
| Date domains and certificates | issued.live | Registration dates, first certificate times and address history |
| Map neighbors | issued.live | Domains sharing an address and certificate history per address |
| Count public sightings | urlscan | 747 scans, 536 hostnames and 160 phone numbers |
| Find more hosts running the kit | Netlas and urlscan (partner review) | 31 more hostnames and three more Azure environments |
| Check vendor detection | VirusTotal | 0 of 92 vendors flagged the landing domain |
| Read older certificate history | crt.sh | Certificates for the tracker since November 2020 |
| Re-check which hosts are still live | webfetch.io | 9 of 536 hostnames still served the kit on October 11 |
Tuxxin LLC, which publishes this article, runs whack.sh, issued.live, WorldIP and webfetch.io.
For coordinated disclosure: [email protected].