Avoid getting scammed by websites displaying fake safety warnings
Written by Tomas Meskauskas on (updated)
What kind of scam is "Safety Warning"?
"Safety Warning" is a multi-variant scam that warns users of various fake threats present on their devices. Often, the purported source is a visit(s) to a compromised/malicious site(s). The schemes hide under the names of legitimate software/services, which are then supposedly used to perform system scans and detect these nonexistent threats.
"Safety Warning" scam overview
As mentioned in the introduction, the common throughline of the "Safety Warning" scam variants is running a bogus system scan that detects threats on users' computers. Known disguises include TotalAV, Norton, and McAfee security tools.
It must be reiterated that regardless of how legitimate these pages may appear – they are fake, and no website can detect issues present on visitors' systems. It must also be stressed that these schemes are in no way associated with any existing programs or services.
Most of the versions claim that the origin of the nonexistent infection is a malicious website(s) like illegal streaming, hosting adult-oriented content, compromised/ infected with malware, etc. Some variants are more elaborate and mention authorities like CISA (Cybersecurity and Infrastructure Security Agency), detail the dangers posed by the infections, and/or praise and offer discounts for a particular security product.
The purpose of such schemes can differ. For example, one of the "Safety Warning" variants that we analyzed led us to the official website of a genuine program. In this case, the goal is for the scammers to collect illegitimate commissions through this abuse of the "promoted" content's affiliate programs.
Keep in mind that there are no guarantees that a scam will continue to redirect to a reputable site, as it could instead lead users to imitator webpages that promote dangerous content or operate as phishing scams.
Another common reason behind these scams is the promotion of untrustworthy, harmful, and even malicious software. The endorsed applications/ browser extensions could operate as fake anti-viruses, adware, browser hijackers, PUAs (Potentially Unwanted Applications), trojans, ransomware, cryptocurrency miners, etc.
In summary, victims of scams like "Safety Warning" can experience system infections, serious privacy issues, financial losses, and identity theft.
| Name | "Safety Warning" pop-up |
| Threat Type | Phishing, Scam, Social Engineering, Fraud |
| Fake Claim | Website visitor's device is infected/ at risk. |
| Disguise | TotalAV, Norton, McAfee |
| Related Domains | information25[.]info |
| Detection Names (information25[.]info) | N/A (VirusTotal) |
| Serving IP Address (information25[.]info) | 146.190.42.206 |
| Symptoms | Fake error messages, fake system warnings, pop-up errors, hoax computer scan. |
| Distribution methods | Compromised websites, rogue online pop-up ads, potentially unwanted applications. |
| Damage | Loss of sensitive private information, monetary loss, identity theft, possible malware infections. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Similar scam examples
We have investigated thousands of online scams; "iolo - Your PC is infected with 18 viruses!", "McAfee - Computer Is At Risk Of Virus Infection", "WARNING: Antivirus Protection EXPIRED!", "AVG - Your PC Is Infected With 18 Viruses", and "McAfee - Subscription Payment Failed" are just some of our newest articles on ones similar to "Safety Warning".
Another kind of scheme that utilizes fake threat detection lures is called a technical support scam; however, there are significant differences between the goals and threats associated with this type.
The Internet is rife with deceptive and malicious content. While it is often poorly made and full of errors, it can be competently put together and even convincingly disguised as associated with legitimate entities (e.g., companies, service providers, organizations, authorities, etc.).
Due to how widespread scams are and how well-crafted they can be – we highly recommend caution when browsing.
How did I open a scam website?
Online scams are primarily endorsed via websites that utilize rogue advertising networks, spam (e.g., emails, PMs/DMs, SMSes, browser notifications, social media/ forum posts, etc.), intrusive adverts (malvertising), misspelled URLs (typosquatting), and adware.
How to avoid visiting scam websites?
Caution is key to online safety. Therefore, be vigilant when browsing and avoid online content making threats or promises that sound too good to be true. Take note of URLs and enter them attentively. Do not use sites offering pirated programs/media or other dubious services (e.g., Torrenting, illegal streaming/downloading, etc.), as they are usually monetized via rogue advertising networks.
Treat incoming emails and other messages carefully; do not open attachments or links found in suspect/irrelevant mail. Do not enable questionable pages to deliver browser notifications; instead, ignore or deny their requests (i.e., select "Block", "Block Notifications", etc.).
Download only from official/trustworthy sources and treat installations carefully (e.g., study terms and options, use "Custom/Advanced" settings, and opt out of additional apps, extensions, tools, etc.) – to prevent bundled/hazardous software (like adware) from infiltrating the system.
If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate all threats.
Text presented in the Safety Warning scam's pop-up:
TOTALAV
Safety warning!
You may have recently browsed to malicious websites that were likely infected with viruses
As a result, your computer could currently be at risk of a virus infection.
Your PC recently browsed to compromised websites with illegal streaming and/or adult content. This could expose your computer to viruses. To remove any potential viruses, you must run an antivirus scan immediately.
Run a Quick Scan Now
Appearance of the TotalAV version of the "Safety Warning" pop-up scam (GIF):
Screenshot of the last page displayed by this version of the "Safety Warning" scam:
Screenshot of the "Safety Warning" scam (Norton version):
Screenshot of the "Safety Warning" scam (McAfee version):
Screenshot of the "Safety Warning" scam (another McAfee version):
Text presented in this scam version's pop-up:
McAfee
Safety warning!
Operating system: Windows 10.0, Chrome
Address: North Carolina,
Ip address: 172.59.215.224
An attempt to hack your device when trying to visit a prohibited site has been prevented. Your data has been added to the CISA (Cybersecurity and Infrastructure Security Agency) blacklist, because your device could be infected and attackers could have access to it.
Therefore, your device might currently be under virus threat !
Your personal data, banking information and other sensitive information are at risk of being accessed by hackers !
If you ignore this message, access to your banking details might be at risk of being sold to 3rd parties. Please start your McAfee Total Protection to eliminate all threats !
Your device recently browsed to compromised websites with illegal streaming
and/or adult content. This might lead to getting your device infected by viruses.
To remove all potential threats, we strongly recommend you run an antivirus
scan immediately.
Start McAfee Total Protection
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is "Safety Warning" pop-up?
- How to identify a pop-up scam?
- How do pop-up scams work?
- How to remove fake pop-ups?
- How to prevent fake pop-ups?
- What to do if you fell for a pop-up scam?
How to identify a pop-up scam?
Pop-up windows with various fake messages are a common type of lures cybercriminals use. They collect sensitive personal data, trick Internet users into calling fake tech support numbers, subscribe to useless online services, invest in shady cryptocurrency schemes, etc.
While in the majority of cases these pop-ups don't infect users' devices with malware, they can cause direct monetary loss or could result in identity theft.
Cybercriminals strive to create their rogue pop-up windows to look trustworthy, however, scams typically have the following characteristics:
- Spelling mistakes and non-professional images - Closely inspect the information displayed in a pop-up. Spelling mistakes and unprofessional images could be a sign of a scam.
- Sense of urgency - Countdown timer with a couple of minutes on it, asking you to enter your personal information or subscribe to some online service.
- Statements that you won something - If you haven't participated in a lottery, online competition, etc., and you see a pop-up window stating that you won.
- Computer or mobile device scan - A pop-up window that scans your device and informs of detected issues - is undoubtedly a scam; webpages cannot perform such actions.
- Exclusivity - Pop-up windows stating that only you are given secret access to a financial scheme that can quickly make you rich.
Example of a pop-up scam:
How do pop-up scams work?
Cybercriminals and deceptive marketers usually use various advertising networks, search engine poisoning techniques, and shady websites to generate traffic to their pop-ups. Users land on their online lures after clicking on fake download buttons, using a torrent website, or simply clicking on an Internet search engine result.
Based on users' location and device information, they are presented with a scam pop-up. Lures presented in such pop-ups range from get-rich-quick schemes to fake virus scans.
How to remove fake pop-ups?
In most cases, pop-up scams do not infect users' devices with malware. If you encountered a scam pop-up, simply closing it should be enough. In some cases scam, pop-ups may be hard to close; in such cases - close your Internet browser and restart it.
In extremely rare cases, you might need to reset your Internet browser. For this, use our instructions explaining how to reset Internet browser settings.
How to prevent fake pop-ups?
To prevent seeing pop-up scams, you should visit only reputable websites. Torrent, Crack, free online movie streaming, YouTube video download, and other websites of similar reputation commonly redirect Internet users to pop-up scams.
To minimize the risk of encountering pop-up scams, you should keep your Internet browsers up-to-date and use reputable anti-malware application. For this purpose, we recommend Combo Cleaner Antivirus for Windows.
What to do if you fell for a pop-up scam?
This depends on the type of scam that you fell for. Most commonly, pop-up scams try to trick users into sending money, giving away personal information, or giving access to one's device.
- If you sent money to scammers: You should contact your financial institution and explain that you were scammed. If informed promptly, there's a chance to get your money back.
- If you gave away your personal information: You should change your passwords and enable two-factor authentication in all online services that you use. Visit Federal Trade Commission to report identity theft and get personalized recovery steps.
- If you let scammers connect to your device: You should scan your computer with reputable anti-malware (we recommend Combo Cleaner Antivirus for Windows) - cyber criminals could have planted trojans, keyloggers, and other malware, don't use your computer until removing possible threats.
- Help other Internet users: report Internet scams to Federal Trade Commission.
Frequently Asked Questions (FAQ)
What is a pop-up scam?
Pop-up scams are a type of deceptive content hosted on the Web; its goal is to deceive users into performing specific actions. For example, victims can be lured into purchasing products, subscribing to services, downloading/installing software, sending money to scammers, disclosing sensitive information, calling fake support lines, and so on.
What is the purpose of a pop-up scam?
The purpose of pop-up scams is to generate revenue at victims' expense. Cyber criminals primarily profit by promoting content (e.g., sites, software, products, services, etc.), obtaining funds through deception, abusing/selling private information, and spreading malware.
Why do I encounter fake pop-ups?
Pop-up scams are mainly distributed via websites using rogue advertising networks, mistyped URLs, spam (e.g., emails, PMs/DMs, SMSes, social media/ forum posts, browser notifications, etc.), intrusive adverts, and adware.
Will Combo Cleaner protect me from pop-up scams?
Combo Cleaner can scan visited websites and detect deceptive/malicious content. Therefore, should you happen upon such a page – you will be immediately warned, and further access to it will be restricted.
Outstanding!
▼ Show Discussion