![](/screenshots/0191819b-e72f-4828-b36c-52569f598379.png)
metamask.activity-suspicious.online
Open in
urlscan Pro
80.82.65.151
Malicious Activity!
Public Scan
Submission: On July 28 via automatic, source certstream-suspicious — Scanned from NL
Summary
TLS certificate: Issued by R3 on July 28th 2023. Valid for: 3 months.
This is the only time metamask.activity-suspicious.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 80.82.65.151 80.82.65.151 | 202425 (INT-NETWORK) (INT-NETWORK) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 3 |
ASN202425 (INT-NETWORK, SC)
metamask.activity-suspicious.online |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
activity-suspicious.online
metamask.activity-suspicious.online |
238 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 249 |
2 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
4 | metamask.activity-suspicious.online |
metamask.activity-suspicious.online
|
1 | cdnjs.cloudflare.com |
metamask.activity-suspicious.online
|
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
metamask.activity-suspicious.online R3 |
2023-07-28 - 2023-10-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://metamask.activity-suspicious.online/
Frame ID: 53233B8E6DE76A3E4C019F3E036B5D92
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
metamask.activity-suspicious.online/ |
341 KB 216 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FileSaver.min.js
cdnjs.cloudflare.com/ajax/libs/FileSaver.js/2.0.0/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.obfuscated.min.js
metamask.activity-suspicious.online/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mm.svg
metamask.activity-suspicious.online/files/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rom.jpg
metamask.activity-suspicious.online/files/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
257 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
55 KB 55 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
55 KB 55 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| saveAs object| FileSaver function| hexToDecimal function| a0_0x2eef function| connectMetamask function| getBalance function| a0_0x5c01 function| getGasPrice function| sendEthereum function| getIPAddress function| saveIPAndHost0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
metamask.activity-suspicious.online
2606:4700::6811:190e
80.82.65.151
0eb4b343b36aa2ef18a0ccb84c6b4e6acdbd42565740f356216548523777879f
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
8899b62d74d06f482f132b600d49c9a51cf13a3d830ac35d158f8cce65079c20
9b6c054e40c22e5dee7dfc84feb59efdefd6e0acf2bc18ee8548148a719865cc
b65e22c1fb9efb1408e4b29266efda862ad71d3461873596413a646b0112d415
dd6cd52bf15d2f5bf7519cd3d876ae2d37306e77d1a95a63e867e6c95ab9c49e
e45bfe2d09646fa743de9007cc96fb14b235892a8913d182cdaf8742d708d3a9
fb6ab3ac1742594fa69cb73651e57d4a1da4268509b40ae1bcd873658062fcb4