metamask.github.io
Open in
urlscan Pro
2606:50c0:8000::153
Malicious Activity!
Public Scan
Effective URL: https://metamask.github.io/phishing-warning/v1.1.0/
Submission: On August 25 via manual from IE — Scanned from DE
Summary
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 7th 2022. Valid for: a year.
This is the only time metamask.github.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 2606:50c0:800... 2606:50c0:8000::153 | 54113 (FASTLY) (FASTLY) | |
10 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
github.io
1 redirects
metamask.github.io — Cisco Umbrella Rank: 24681 |
112 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
11 | metamask.github.io |
1 redirects
metamask.github.io
|
10 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
github.com |
cryptoscamdb.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.github.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-07 - 2023-04-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://metamask.github.io/phishing-warning/v1.1.0/
Frame ID: 1469FB125CACE0880ADF6D8DFDB5D022
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
MetaMask Phishing DetectionPage URL History Show full URLs
-
http://metamask.github.io/phishing-warning/v1.1.0/
HTTP 301
https://metamask.github.io/phishing-warning/v1.1.0/ Page URL
Detected technologies
GitHub Pages (CDN) ExpandDetected patterns
- ^https?://[^/]+\.github\.io
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Ethereum Phishing Detector
Search URL Search Domain Scan URL
Title: please search for the domain on CryptoScamDB
Search URL Search Domain Scan URL
Title: please file an issue
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://metamask.github.io/phishing-warning/v1.1.0/
HTTP 301
https://metamask.github.io/phishing-warning/v1.1.0/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
metamask.github.io/phishing-warning/v1.1.0/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globalthis.js
metamask.github.io/phishing-warning/v1.1.0/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lockdown-install.js
metamask.github.io/phishing-warning/v1.1.0/ |
39 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lockdown-run.js
metamask.github.io/phishing-warning/v1.1.0/ |
797 B 656 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lockdown-more.js
metamask.github.io/phishing-warning/v1.1.0/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle.js
metamask.github.io/phishing-warning/v1.1.0/ |
102 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
design-tokens.css
metamask.github.io/phishing-warning/v1.1.0/ |
15 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
metamask.github.io/phishing-warning/v1.1.0/ |
2 KB 842 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
metamask-fox.svg
metamask.github.io/phishing-warning/v1.1.0/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EuclidCircularB-Regular-WebXL.ttf
metamask.github.io/phishing-warning/v1.1.0/fonts/ |
151 KB 58 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| assert0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
metamask.github.io
2606:50c0:8000::153
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c
14a39bf28a2337fd348c2cb936e08e37ef0d4b33ea0a6c82dcd8b824b63b5133
441218a51c55b14d1560d97d3a2f1358b5d7ef0e6b66a9bb695051ea7b5efe49
8a48cc29d223f53657b0c2d5da11ed12653187672a8bea4f4d78f97e7c78c849
8b927315ec4e4ba52ff37101ac56bcfe6547c8192f9c0db843659e4399cb37f0
c3b6a122531879c3eb9806358310b184295914c59c74eda677a5435587c34897
dc45bf034faf3761fce0e054677c2e7e4a511917cd41518f72b96cb9486f5b18
e15f961feac9c896f31c7b84842a3724026d63208602b4cb81de2326e2a2e8b0
ff1cf46d78ca421e5f2dc9a1bc609b9f7ff244d84385a45d33a5bf9cb8d84c97
ff2c65f4668bb1424c36b7a440aadf711fa44e7cc260e6229532863f5eec4e54