New research shows that browser based Tech Support Scams are starting to utilize services normally found in legitimate call center operations. These services, called call optimization services, are typically used by call centers to perform call load balancing, call routing, dynamic generation of phone numbers, and more.

Source: Symantec

When a visitor accesses a browser-based tech support scam, the page typically utilizes some sort of behavior that makes it difficult to close the page. This could be a form, as shown above, display notification dialogs, entering full screen mode, or a javascript routine that causes the screen to become unresponsive.

This is done to scare a visitor into calling the listed phone numbers by keeping the scam on the screen without allowing it to be closed.

According to research by Symantec, tech support scammers have started to utilize call optimization services in order to dynamically insert phone numbers into a tech support scam page. These services are used when the tech support scam url contains a specific variable. If that variable exists, the phone number will be retrieved via a call optimization service, and if not, will be retrieved from an XML file.

Call Optimization Service Script
Call Optimization Service Script (Source: Symantec)

By using a Call Optimization Service, scammers can insert numbers that are appropriate for the visitor’s geographic location, dynamically generate new ones that are not already well known or blacklisted, or use numbers that have low call volume.

“However, by using the call optimization service’s tag in the URL the scammers can dynamically insert phone numbers…