Popup - https://grabnewdeals.store
Registered via Hostinger on March 13, 2025 - Whois grabnewdeals.store
Popup redirects users to https://nextge.nextgenmodes.store/
Registered via Hostinger on March 4, 2025 - Whois nextgenmodes.store
The popup is designed to automatically have mobile users call the scammers to “verify the security” of their Apple account. Other times, the popup will be used to play voice alerts or prevent users from closing the fake popup.
The number the scammers used was 804-753-2539, an Onvoy line that couldn’t accept calls from my Google Voice line, which received the text message. The text message came from (323) 524-7176, which is carried via Pinger.