Suspicious Gentlemen

A page styled like a Franceinfo culture article promotes an AI trading platform and promises large, regular earnings in exchange for a €250 starting investment.

The homepage displays an obfuscated PowerShell script with embedded Python bootstrap and download code.

A Spanish-language page styled as “Sucursal Virtual Personas” asks for a username, password, and dynamic key, then displays an Avianca transaction-authorization flow.

This Russian-language page appears to imitate Госуслуги, claiming a visitor’s biometric data and documents are being accessed.

Anonpad presents a tracker for wallets linked to 11 reported crypto thefts, with feeds for following wallet activity and interacting with those addresses.

A bank-branded homepage offers online banking, loans, cards, and foreign-exchange rates while repeatedly referring to “Voucher” information.

A detailed flight-booking page presents itself as “Czech Smartwings,” offering routes, fares, booking tools and cryptocurrency payment.

This page presents a deposit-insurance claims lookup, asking visitors to enter a Case ID on fdic-shield.com.

A client-portal interface presenting sign-in, device PIN setup, and access to banking records.

A Windows screenshot and screen-recording app whose page describes scrolling capture, annotations, OCR, and direct clipboard pasting.

A site presents a free Gowanus youth center, a MrBeast Foundation funding claim, and an unusually detailed public ledger.

The page solicits applications for three supposed private performances in Chicago, Los Angeles, and New York, listing 30 guests per city at $500 each.

A Chinese-language page catalogs purported AO3 mirror addresses, groups them by domain shape, and explains how to inspect a destination before following it.

The page presents a Fashion Creator Brand Deal Awards campaign, asking visitors to vote for a creator to receive a purported Burberry ambassador contract.

Vanua Trails presents small-group Fiji island tours and a tour-request form, but the site is hosted at suncorpbank.ltd.

A product catalog for Hasbro-branded collectibles hosted at hasbrropulsez.shop, whose page title calls it “Hasbro Pulse Official.”

Ispyaccess claims that entering someone’s phone number or email will reveal their live front and rear cameras, plus saved camera history.

An Indonesian-language review page presenting a claimed 90-day field investigation of the lkopen app, with security, performance, and competitor comparisons.

A TotalAV-branded support page offers subscription cancellation, billing help, account access, and a phone-based cancellation option.

An Indonesian-language page presents itself as an investigation of the lotusbet88 betting app, with claims of user interviews, security analysis, and comparisons.

A provider-side healthcare claims-analysis service says it rebuilds payer overpayment allegations from the full claims record for use in audits and appeals.

A yacht-builder homepage with Chinese company information, Fairway motor-yacht listings, and a title crowded with unrelated adult-search terms.

The domain opens the Supreme Court of Ohio’s .gov homepage, with case information, court rules, filing links, opinions, and public resources.

The supplied visit to fedexeae.com ends at Apple’s public storefront, showing product promotions and shopping links.