press-continue.2a6rwlv7ew4w.top
Open in
urlscan Pro
185.246.188.125
Malicious Activity!
Public Scan
URL:
https://press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/
Submission: On October 24 via api from CA — Scanned from CA
Submission: On October 24 via api from CA — Scanned from CA
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 14 HTTP transactions.
The main IP is 185.246.188.125, located in
Netherlands and
belongs to FLOKINET, IS.
The main domain is press-continue.2a6rwlv7ew4w.top.
The Cisco Umbrella rank of the primary domain is 386089.
TLS certificate: Issued by R11 on September 25th 2024. Valid for: 3 months.
This is the only time press-continue.2a6rwlv7ew4w.top was scanned on urlscan.io!
TLS certificate: Issued by R11 on September 25th 2024. Valid for: 3 months.
This is the only time press-continue.2a6rwlv7ew4w.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 185.246.188.125 185.246.188.125 | 200651 (FLOKINET) (FLOKINET) | |
| 5 | 194.63.140.103 194.63.140.103 | 50113 (SUPERSERV...) (SUPERSERVERSDATACENTER) | |
| 1 | 2607:f8b0:400... 2607:f8b0:400d:c1d::5f | 15169 (GOOGLE) (GOOGLE) | |
| 14 | 3 |
5
194.63.140.103
(Moscow Oblast, Russian Federation)
ASN50113 (SUPERSERVERSDATACENTER, CZ)
ASN50113 (SUPERSERVERSDATACENTER, CZ)
| loadingscripts.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
2a6rwlv7ew4w.top
press-continue.2a6rwlv7ew4w.top — Cisco Umbrella Rank: 386089 |
905 KB |
| 5 |
loadingscripts.com
loadingscripts.com — Cisco Umbrella Rank: 124655 |
110 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
1 KB |
| 14 | 3 |
| Domain | Requested by | |
|---|---|---|
| 8 | press-continue.2a6rwlv7ew4w.top |
press-continue.2a6rwlv7ew4w.top
|
| 5 | loadingscripts.com |
press-continue.2a6rwlv7ew4w.top
|
| 1 | fonts.googleapis.com |
loadingscripts.com
|
| 14 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 2a6rwlv7ew4w.top R11 |
2024-09-25 - 2024-12-24 |
3 months | crt.sh |
| loadingscripts.com R11 |
2024-10-21 - 2025-01-19 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/
Frame ID: 2D85E86600A8E9C831AC200474F6E35D
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
AttentionDetected technologies
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/ |
20 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
animate.css
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
78 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pwa_custom.js
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
notification.js
loadingscripts.com/progress_p/pwa_links/default_scripts/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_free.svg
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading.svg
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
386 B 652 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qr2.png
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.png
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.gif
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
835 KB 835 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
close.svg
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
download-gif.gif
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
102 KB 102 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fav.png
press-continue.2a6rwlv7ew4w.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
545 B 913 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDontLeavePopup object| eddOptions0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
loadingscripts.com
press-continue.2a6rwlv7ew4w.top
185.246.188.125
194.63.140.103
2607:f8b0:400d:c1d::5f
0175bfd9afe9543559c705914fac010a6d609017f0a2edcffe599549561fb5d0
03d593cbf7b72d3c70caedac0c0259330ce8b1a45b708e92e3f19245b6ca9929
306d7910500ae32624462375434beaab45581fdfb743af6f3efa5b096a403721
34ca666275595ea71b9787f7269141b947e95af772221947f5ddb060448ed77f
57f3beab79949364321ffc25d65e4f36ff51b480c578db0593615ad701826361
7cc6012f5a5ab1b73b2ea693bfdf2b456a36eabb2775d5bf523e7fdfcb6f1c14
89bcc9a26f3ed7fb196ca1d744395e6fb79f4561ced17605eb27105a9f67e56e
8c8549291722875346b6e050a092cdda6088d579aba282a66304299616c55871
9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21
b1d3e86c81061bd76770790bf5e2f0ffa7b45f2c4e3fc3400a7142bf9b3a53fb
bbb8033431308d56b3ca1ca801be7c56eb232aae77d2226bf2884dcf68aecd8f
d1413e8c95a61b36e4ea9441e9ead3cce29089e85043b0706453597016c01fdb
d4d917c84ef07493d6dc83306cb754ddddc1cdb4fc879e09f5b54a0b6f11d451
ff708dfd7d816c51832a47cebfaf051422ddd0ab0d96588b55a1a2b89c1f3f73