Yahoo Mail ad chains hid a fake Microsoft alert from data-center and phone visits
Two tech-support scams ran ads in AT&T's Yahoo Mail on Oct 7 and 8 that showed a fake Microsoft alert only to Windows desktops on home broadband. In scans by Tuxxin's Daniel Jones, visits from a data center and a phone got an ordinary dating or finance article.
The Engineer · Build desk
The first operation's scam kit appears in 747 public scans of 536 cloud hostnames from July 12 to October 10, 2026, about 1.4 public scans per hostname. A second review by Kirk of ohey.ca added 31 hostnames to the kit's footprint.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Public scans showing the first operation's scam kit | 747 scans | 21 | |
| Added in Kirk's review | 31 hostnames | 22 | |
| Scans per hostname, about | 1.4 public scans | 25 |
What happened
- The first ad sat in the inbox list like an email, with sender line CHECKOUTERS, subject (1) New Message and a small Ad label.
- Its click passed through Taboola's tracker under publisher ID yahoo-mail-att, the AT&T edition that serves att.net, sbcglobal.net and bellsouth.net addresses.
- The first ad led to checkouters[.]app, a dating article site registered September 23, where a full-screen Azure Container Apps frame covered the page for home-broadband Windows visitors.
- The second ad ran through a Branch deep link to a filtering server at maizerubyen[.]site, which routed the data-center visit to a personal finance article on another site.
- The first operation's kit appears in 747 public scans of 536 cloud hostnames between July 12 and October 10, 2026.
Why it matters
- constraint Fetching a landing page from a report will not confirm the scam: eight direct opens of the first ad's page, with and without tracking codes, all returned the dating article.
- exposure On the first chain a user who checks the address bar sees the dating site, so nothing in the browser chrome points to Microsoft or to the Azure host serving the frame.
- decision Verifying a chain like this means replaying the fresh click from several networks at once and comparing what each receives. That is the method the write-up used.
On the second chain the visitor's location is checked twice. The hop at maizerubyen[.]site makes the first cut [13]. The Azure static-hosting page that the home-broadband visit reached then looked up each visitor's IP address with two separate services and opened a live chat window from Tawk.to [15]. It showed the alert and the number +1 844-959-2491 [14].
All of this comes from one post, by Daniel Jones of Tuxxin LLC, who notes it was drafted with AI assistance [24]. The first chain is the less tidy half. Its frame was intermittent: one Comcast visit received the frame, and a repeat visit received only the plain article [2]. The first ad's link was never tested from a data center, so the data-center result rests on the second chain alone [2] [13]. The post reports what visitors received. It does not report what Taboola's or Yahoo's ad review fetched, so whether review missed these creatives is not shown.
The slot is Taboola inventory. Under a 30-year deal, Taboola sells the native advertising on Yahoo's properties [8]. The tracking link on the first ad shows 0.25 as the cost per click and names no currency [9].
The filtering domain's timeline is short. maizerubyen[.]site was registered on September 17 and went three weeks without a TLS certificate [18], which is 21 days to the start of the first certificate's validity [27]. That certificate was valid from 12:44 UTC on October 8 and reached the CT logs at 13:43 UTC [19]. The ad click the author analyzed came at 15:51 UTC, 2 hours 8 minutes after the log entry [19] [26]. issued.live's reverse IP lookup found no other domain on the server at 64.177.41[.]125 [20].
The kit's footprint extends past the 536 hostnames. Kirk, of ohey.ca, reviewed it separately and found 31 more hostnames and three more Azure environments [22]. At about 1.4 scans per hostname [25], we would not key a detection on hostnames.
The chat account is a better bet. It was created in June 2024 [16], and the post places it, with the same lookup key, on a second Azure page on September 24, reached through a Taboola ad and a Branch link at walletsaver.app[.]link [17]. The second chain also loaded a tracking script from userstatics[.]com, a domain registered in 2020 and first recorded on its current server on August 13, 2026 [23].
What to watch
- Whether Taboola or Yahoo say what their ad review fetched for these two creatives, or act on the yahoo-mail-att inventory.
- Whether the chat account and lookup key, or the userstatics[.]com script, turn up in scans after October 10, where the archive search stops.
- What comes of the reports the authors filed with each provider, which the post says are listed on tuxxin.com.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap0
- Incentives35
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The scam appeared only on visits that arrived through a fresh ad click; the authors opened the first ad's landing page directly eight times, with and without its tracking codes, and every visit returned the dating article.
- [2]
The first ad's frame was intermittent: Comcast visits received the frame once and the plain article on the next try. No data center visit ran on the first ad's link.
- [3]
Two scam operations ran ads in the same sponsored slot of AT&T's Yahoo Mail on October 7 and 8, 2026.
- [4]
In whack.sh scans of the original ad click links, only Windows desktops on home broadband received the fake Microsoft security alert and its toll-free number.
- [5]
The authors' visits from a data center and from a phone received a dating or personal finance article.
- [6]
The first ad sat in the inbox list like an email; its sender line read CHECKOUTERS, its subject read (1) New Message, and a small Ad label marked it as sponsored.
- [7]
A click on the first ad passed through Taboola's click tracker under the publisher ID yahoo-mail-att, the AT&T edition of Yahoo Mail, which serves att.net, sbcglobal.net, bellsouth.net and other AT&T addresses.
- [8]
Taboola sells the native ads across Yahoo's sites under a 30-year agreement.
- [9]
The first ad's tracking link listed a cost of 0.25 per click, with no currency.
- [10]
whack.sh opens one link from several networks at once and compares what each receives; every exit address was classified with WorldIP, which reports an address's owner, country and network type.
- [11]
The first ad led to checkouters[.]app, a dating article site registered on September 23, 2026; on Windows desktops on home broadband, the page covered itself with a full-screen frame served from Microsoft Azure Container Apps.
- [12]
The frame displayed the fake alert and a toll-free number while the address bar kept showing the dating site.
- [13]
The second ad passed through a Branch deep link, 325235dgsg.app[.]link, and then through maizerubyen[.]site, a filtering server (TDS) that sent the authors' data center visit to a personal finance article on another site.
- [14]
The authors' home broadband visit on the second chain went to a page on Azure static website hosting that showed the alert and the number +1 844-959-2491.
- [15]
The second chain's scam page checked each visitor's location with two IP lookup services and loaded a Tawk.to live chat window.
- [16]
The Tawk.to chat account was created in June 2024.
- [17]
The same chat account and lookup key appeared on another Azure page on September 24; a Taboola ad and a second Branch deep link, walletsaver.app[.]link, led to that page.
- [18]
The filtering domain maizerubyen[.]site was registered on September 17, 2026, and went three weeks without a TLS certificate.
- [19]
The domain's first certificate, valid from 12:44 UTC on October 8, reached the Certificate Transparency logs at 13:43 UTC; the ad click the authors analyzed came about two hours later, at 15:51 UTC.
- [20]
issued.live's reverse IP lookup found no other domain on the filtering server at 64.177.41[.]125.
- [21]
The first operation's scam kit appears in 747 public scans of 536 cloud hostnames; the scans run from July 12 to October 10, 2026, the 90 days the authors' archive search reaches.
- [22]
A second review by Kirk of ohey.ca added 31 hostnames and three Azure environments to the kit's footprint.
- [23]
The second chain's scam page also loaded a tracking script from userstatics[.]com, a domain registered in 2020 that issued.live first recorded on its current server, 94.154.32[.]91, on August 13, 2026.
- [24]
The post is by Daniel Jones, Founder, Tuxxin LLC, and states it was drafted with AI assistance.
- [25]
The kit averages about 1.4 public scans per hostname.
- [26]
The analyzed click came 2 hours 8 minutes after the certificate reached the CT logs.
- [27]
The domain had no certificate for 21 days, from registration on September 17 to the start of the first certificate's validity on October 8.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toYahoo Mail malvertising: two cloaked tech support scam chains
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Tech support scamsFollow
- Traffic cloakingFollow
- Certificate TransparencyFollow
- MalvertisingFollow