A surge of fraudulent websites claiming to verify antivirus software functionality has emerged, using the name SysScan and misleadingly asserting that Windows no longer supports third-party antivirus solutions. These sites conduct fake security scans, gather personal information, and set up a refund scam. Eleven such websites were found hosted on a single server, executing similar deceptive tactics. They can access basic browser data but cannot conduct genuine security scans. Microsoft continues to support third-party antivirus software, and legitimate refund processes do not require uninstalling security tools. The scams instruct users to remove their antivirus software to facilitate further manipulation and to collect information about the antivirus in use. The customer information forms collect extensive personal data and are designed to send this information to a Telegram bot API. Victims are promised a refund call after submitting their information, which is part of the scam's manipulation. Signs of such scams include claims of deep problems with the computer, consistently negative diagnostic results, requests to uninstall antivirus software, and demands for banking information. If affected, victims should disconnect from the internet, remove remote-access tools, and contact their bank. The hosting IP address for these sites is 157.230.180.90, with multiple associated domains listed.