Here’s a large collection of phone numbers from the one pop-up. It’s the noisy Windows Defender screen then change to a Black/Disk error screen. Here are some examples of when these were active.
URL Active date
hxxp://van01manage01.site/YYYY/index.html 30/12/16-31/12/16
hxxp://van01manage02.site/YYYY/index.html 30/12/16-31/12/16
hxxp://van01manage03.site/YYYY/index.html 30/12/16-31/12/16
hxxp://van01manage04.site/YYYY/index.html 30/12/16-31/12/16
hxxp://van02manage01.site/YYYY/index.html 01/01/17-02/01/17
hxxp://van02manage02.site/YYYY/index.html 01/01/17-02/01/17
hxxp://van02manage03.site/YYYY/index.html 01/01/17-02/01/17
hxxp://van02manage04.site/YYYY/index.html 01/01/17-02/01/17
http://van03manage01.site/YYYY/index.html 03/01/17-04/01/17
http://van03manage02.site/YYYY/index.html 03/01/17-04/01/17
hxxp://van03manage03.site/YYYY/index.html 03/01/17-04/01/17
hxxp://van03manage04.site/YYYY/index.html 03/01/17-04/01/17
Code: 00xO4C08
From experience, the URL changes every couple of days, but there are usually around 20 different active phone numbers for both the UK and US variants. The current list is as follows:
YYYY Number
duk1 02038688965
duk2 02038688957 <- Active on 30/12/16
duk3 01183151059 <- Active on 04/01/17
duk4 01183151077 5-6pm U.S. voice
duk5 01473378273
duk5 01473378283
duk7 01473378209
duk8 01473378288
buk9 01473378273
uk11 01183151089
uk12 01524488062
uk13 02038089899
uk14 01782491080
afuk2 01993460018
e1 01923381148 5-6pm U.S. voice
e2 02038088348
j1 +18884981127
j2 +18884893458
j3 +18887256599
j4 +18885996742
j5 +18886320378
j6 +18884892005
j7 +18882336830
j8 +18888301739