press-continue.4k7kca7aj0s4.top
Open in
urlscan Pro
194.63.143.96
Malicious Activity!
Public Scan
URL:
https://press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/
Submission: On December 09 via manual from IE — Scanned from IL
Submission: On December 09 via manual from IE — Scanned from IL
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 14 HTTP transactions.
The main IP is 194.63.143.96, located in
Moscow Oblast, Russian Federation and
belongs to SuperServersDatacenter NTX Technologies s.r.o., CZ.
The main domain is press-continue.4k7kca7aj0s4.top.
TLS certificate: Issued by R11 on November 24th 2024. Valid for: 3 months.
This is the only time press-continue.4k7kca7aj0s4.top was scanned on urlscan.io!
TLS certificate: Issued by R11 on November 24th 2024. Valid for: 3 months.
This is the only time press-continue.4k7kca7aj0s4.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 194.63.143.96 194.63.143.96 | 50113 (SuperServ...) (SuperServersDatacenter NTX Technologies s.r.o.) | |
| 5 | 185.246.188.124 185.246.188.124 | 200651 (FlokiNET ...) (FlokiNET FlokiNET ehf) | |
| 1 | 172.217.16.202 172.217.16.202 | 15169 (GOOGLE) (GOOGLE) | |
| 14 | 3 |
8
194.63.143.96
(Moscow Oblast, Russian Federation)
ASN50113 (SuperServersDatacenter NTX Technologies s.r.o., CZ)
PTR: teach-compare.scenegermany.com
ASN50113 (SuperServersDatacenter NTX Technologies s.r.o., CZ)
PTR: teach-compare.scenegermany.com
| press-continue.4k7kca7aj0s4.top |
1
172.217.16.202
(United States)
ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f10.1e100.net
ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f10.1e100.net
| fonts.googleapis.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
4k7kca7aj0s4.top
press-continue.4k7kca7aj0s4.top |
905 KB |
| 5 |
loadingscripts.com
loadingscripts.com — Cisco Umbrella Rank: 106163 |
110 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
| 14 | 3 |
| Domain | Requested by | |
|---|---|---|
| 8 | press-continue.4k7kca7aj0s4.top |
press-continue.4k7kca7aj0s4.top
|
| 5 | loadingscripts.com |
press-continue.4k7kca7aj0s4.top
|
| 1 | fonts.googleapis.com |
loadingscripts.com
|
| 14 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 4k7kca7aj0s4.top R11 |
2024-11-24 - 2025-02-22 |
3 months | crt.sh |
| loadingscripts.com R11 |
2024-10-21 - 2025-01-19 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-11-04 - 2025-01-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/
Frame ID: 3BAC5137B9B0704380E8141C4B33E1CC
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
AttentionDetected technologies
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/ |
20 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
animate.css
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
78 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pwa_custom.js
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
notification.js
loadingscripts.com/progress_p/pwa_links/default_scripts/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_free.svg
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading.svg
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
386 B 652 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qr2.png
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.png
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.gif
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
835 KB 835 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
close.svg
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
download-gif.gif
loadingscripts.com/progress_p/pwa_links/main/cinema/custom_cinema_fullpage/1/ |
102 KB 102 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fav.png
press-continue.4k7kca7aj0s4.top/e102479204fcec81f6dfb01f2462a2dfa451531d/qq1/assets/ |
545 B 913 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDontLeavePopup object| eddOptions0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
loadingscripts.com
press-continue.4k7kca7aj0s4.top
172.217.16.202
185.246.188.124
194.63.143.96
0175bfd9afe9543559c705914fac010a6d609017f0a2edcffe599549561fb5d0
03d593cbf7b72d3c70caedac0c0259330ce8b1a45b708e92e3f19245b6ca9929
306d7910500ae32624462375434beaab45581fdfb743af6f3efa5b096a403721
34ca666275595ea71b9787f7269141b947e95af772221947f5ddb060448ed77f
57f3beab79949364321ffc25d65e4f36ff51b480c578db0593615ad701826361
7cc6012f5a5ab1b73b2ea693bfdf2b456a36eabb2775d5bf523e7fdfcb6f1c14
89bcc9a26f3ed7fb196ca1d744395e6fb79f4561ced17605eb27105a9f67e56e
8c8549291722875346b6e050a092cdda6088d579aba282a66304299616c55871
9630c142a8c074cc1809ebf4109538cf29cc0baeb6c27726191f1cf5376e2e21
b1d3e86c81061bd76770790bf5e2f0ffa7b45f2c4e3fc3400a7142bf9b3a53fb
bbb8033431308d56b3ca1ca801be7c56eb232aae77d2226bf2884dcf68aecd8f
d1413e8c95a61b36e4ea9441e9ead3cce29089e85043b0706453597016c01fdb
d4d917c84ef07493d6dc83306cb754ddddc1cdb4fc879e09f5b54a0b6f11d451
ff708dfd7d816c51832a47cebfaf051422ddd0ab0d96588b55a1a2b89c1f3f73