There are 7 Incidents in the last weeks with this URL (only different numerics).
http://www[.]support.microsoft03adenmsf9158.com[.]s3-website.eu-central-1.amazonaws[.]com
We're using Sophos SAV-DI on our webgateway but the Url is passing trough. Fortunately our host av-scanner (F-secure and TrendMicro) are blocking this url.
In testenvironment this url-website shows a fake message of windows defender: your computer was blocked / someone has collect your data / please call [this telehon number]
(this message parts were translated from german)
It will be fine, if Sophos checks this and update the pattern.
Jan R.
