Popup - https://everyday.cf
Registered via Centrafrique TLD in Amsterdam, Netherlands
Associated YouTube account - Gregory Dalton - YouTube
Associated IP Address - 5.101.153.198
Popup redirects to a “Press allow to watch the video” TROJAN registered via NameCheap on October 18, 2021 (updated October 23, 2021) - Whois fresh-content.biz
Associated IP Addreesses:
157.245.79.75
178.62.214.139
If the allow button is pressed, users are redirected back to YouTube for a video that is no longer available.