xhbb.wrestpopdownloadnow.monster
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of xhbb.wrestpopdownloadnow.monster
The domain xhbb.wrestpopdownloadnow.monster appears to be a newly registered subdomain hosted behind Cloudflare rather than an established public-facing brand or business website. Its naming pattern is highly irregular and does not clearly correspond to a recognizable company, service, publisher, or organization based on the available domain data.
The screenshot shows a page styled to resemble a Cloudflare verification prompt, asking the visitor to complete keyboard-based steps before proceeding. Based on the visible content, the page appears to function as a verification or gateway screen rather than a normal informational, commercial, or media website. No operator identity, company details, or legitimate site purpose are evident from the scan data provided.
Safety Assessment for xhbb.wrestpopdownloadnow.monster
Automated scan results were mixed in the sense that no malware was detected by 0 out of 91 security engines, the malware scan reported no flagged files, and major threat databases did not list the domain at the time of this scan. However, those clean point-in-time scanner results are outweighed here by several contextual risk factors: the domain is only 16 days old, has no established traffic ranking, uses an unusual multi-part hostname, and presents a verification-style page that asks users to perform unusual keyboard actions rather than a standard browser challenge.
That interaction pattern may be consistent with so-called clickfix or social-engineering flows, where visitors are guided through steps that could trigger unwanted commands or actions on their device. Following a manual review by the PCRisk team, the published trust score has been adjusted to 0/100 based on additional context, including a recorded clickfix assessment. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued by Google Trust Services and is served through Cloudflare infrastructure on IP address 104.21.85.120, with nameservers darl.ns.cloudflare.com and mona.ns.cloudflare.com. Hosting through a major reverse-proxy network can improve availability and encryption, but it does not by itself indicate legitimacy.
From a domain-security perspective, the registration is very recent and DNSSEC appears to be unsigned. The scan did not identify malicious files, external links, or iframe activity at the time of analysis, but the combination of a newly created domain, obscured backend behind CDN infrastructure, and a suspicious verification workflow may warrant caution.
Share your experience with this website. Was it safe? Did you encounter any issues?