Amazon AWS - fake

There are 7 Incidents in the last weeks with this URL (only different numerics).

http://www[.]support.microsoft03adenmsf9158.com[.]s3-website.eu-central-1.amazonaws[.]com

We're using Sophos SAV-DI on our webgateway but the Url is passing trough. Fortunately our host av-scanner (F-secure and TrendMicro) are blocking this url.

In testenvironment this url-website shows a fake message of windows defender: your computer was blocked / someone has collect your data  / please call [this telehon number]

(this message parts were translated from german)

It will be fine, if Sophos checks this and update the pattern.

 

Jan R.

Anonymous