This URL was first seen by ConcealBrowse on April 4th, with the first security vendors reporting the site as malicious in March. It is currently detected by 11 vendors for malicious behavior and distributing malware. ConcealBrowse intervened with a 14% risk assessment due to suspicious behavior.

This page utilizes evasion techniques that cause the site to be inaccessible to most browsers. When being accessed by the target browser, it is being used to distribute a software known for browser hijacking. Browser hijacking occurs when a malicious download, typically a browser extension, causes unwanted redirects and changes to the victim’s settings, such as the home page. This can lead to excessive advertisements, violations of data privacy, and be a nuisance to the victim.

Conceal Recommends: This URL should be blocked to prevent access. While in an isolated session, users cannot download any harmful programs onto their machine. Although the site is not accessible on all browsers, ConcealBrowse continues to detect and defend against it.

This page was first detected by ConcealBrowse on March 25th, the same day that other security vendors began reporting. Only one vendor is reporting on this emerging threat. ConcealBrowse successfully intervened with a 51% risk score, citing proximity, phishing, and suspicious behavior.

Phishing pages from recognized brands, such as Microsoft, are becoming harder for the average user to detect. This page is seeking out specific email addresses and verifies that the input is correct before proceeding. This makes the page appear more legitimate and trustworthy to the victim. Because the site is in an isolated session, ConcealBrowse will still prevent any data from being entered by the user, keeping credentials secured.

Conceal Recommends: This URL should be blocked. ConcealBrowse’s live analysis is the best way to protect users against emerging threats such as this site.

This URL was first detected by ConcealBrowse on March 5th, before other security vendors began reporting on it. As of today, one other security vendor has marked this URL as containing malware. ConcealBrowse successfully intervened with a 44% risk assessment, citing proximity and malware.

Although the page that this URL leads to is now blank, the IP address leads to multiple campaigns for distributing the Turbo Ad Blocker adware. This malicious software pretends to be an ad blocker to convince the user to download it. Once installed, it hijacks browsers, forcing users to go to unwanted sites and causing multiple pop-ups to occur. This can lead the user exposed to further security risks, as the sites and pop-ups are frequently spam or malicious.

Conceal Recommends: This URL and IP address should be blocked. Consider implementing company policies that prevent the installation of untrusted software onto company machines.

This URL was first detected by ConcealBrowse on February 23rd and is not yet reported by any other security vendors. The page was given a 30% risk assessment, with ConcealBrowse citing possible phishing and malware.

This webpage has multiple indicators of selling an illegitimate product. Although this site may give the user a valid product key for Windows products, these keys are usually procured illegitimately and can be revoked at any point. Therefore, it is not safe to purchase keys from sites such as these, as doing so may cause interruptions in business flow and result in financial loss for the user.

Conceal Recommendation: This site should be considered an emerging threat and has not existed long enough for other security vendors to do a full analysis and publish their findings. Real-time analysis through ConcealBrowse detects novel techniques used by adversaries in order to disrupt these threats.

This URL was detected by ConcealBrowse on February 9th, 2024. It was originally seen by one security vendor in November of 2023 and is currently detected by 12 vendors for phishing and malicious content. ConcealBrowse successfully intervened with a 28% risk assessment, citing proximity to other malicious sites and possible malware.

This IP was recently linked to a scareware campaign; a special type of adware that is designed to scare the user into downloading malicious software. This example tries to convince the user that their machine is infected with malware and an antivirus software is necessary. The pressure caused by the alarming messages may cause users to react and install the malware.

Conceal Recommendation: To prevent these types of attacks, a dynamic scanning engine is required to keep pace with adversaries moving between different URLs. The ability to contain downloaded files and prevent them from executing on the user’s computer is also a necessity when encountering these threats.