metamask.github.io Open in urlscan Pro
2606:50c0:8000::153  Malicious Activity! Public Scan

Submitted URL: http://metamask.github.io/phishing-warning/v1.1.0/
Effective URL: https://metamask.github.io/phishing-warning/v1.1.0/
Submission: On July 21 via manual from IE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:50c0:8000::153, located in United States and belongs to FASTLY, US. The main domain is metamask.github.io. The Cisco Umbrella rank of the primary domain is 19625.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 7th 2022. Valid for: a year.
This is the only time metamask.github.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
1 11 2606:50c0:800... 54113 (FASTLY)
10 1
Apex Domain
Subdomains
Transfer
11 github.io
metamask.github.io — Cisco Umbrella Rank: 19625
112 KB
10 1
Domain Requested by
11 metamask.github.io 1 redirects metamask.github.io
10 1

This site contains links to these domains. Also see Links.

Domain
github.com
cryptoscamdb.org
Subject Issuer Validity Valid
*.github.com
DigiCert TLS RSA SHA256 2020 CA1
2022-04-07 -
2023-04-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://metamask.github.io/phishing-warning/v1.1.0/
Frame ID: ACA292427C6A3A621E07F6DC53B95A95
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

MetaMask Phishing Detection

Page URL History Show full URLs

  1. http://metamask.github.io/phishing-warning/v1.1.0/ HTTP 301
    https://metamask.github.io/phishing-warning/v1.1.0/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • ^https?://[^/]+\.github\.io

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

111 kB
Transfer

328 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://metamask.github.io/phishing-warning/v1.1.0/ HTTP 301
    https://metamask.github.io/phishing-warning/v1.1.0/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
metamask.github.io/phishing-warning/v1.1.0/
Redirect Chain
  • http://metamask.github.io/phishing-warning/v1.1.0/
  • https://metamask.github.io/phishing-warning/v1.1.0/
5 KB
2 KB
Document
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
ff1cf46d78ca421e5f2dc9a1bc609b9f7ff244d84385a45d33a5bf9cb8d84c97

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
28
cache-control
max-age=600
content-encoding
gzip
content-length
1798
content-type
text/html; charset=utf-8
date
Thu, 21 Jul 2022 10:28:21 GMT
etag
W/"62cdd6ef-1303"
expires
Wed, 20 Jul 2022 23:13:36 GMT
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
permissions-policy
interest-cohort=()
server
GitHub.com
vary
Accept-Encoding
via
1.1 varnish
x-cache
HIT
x-cache-hits
1
x-fastly-request-id
b9f96ee1214b5e588d2ae00c3feeae1344e8813e
x-github-request-id
397C:6DD6:529224:56A9A1:62D88B70
x-origin-cache
HIT
x-proxy-cache
HIT
x-served-by
cache-mxp6959-MXP
x-timer
S1658399302.611924,VS0,VE1

Redirect headers

Accept-Ranges
bytes
Age
0
Connection
keep-alive
Content-Length
162
Content-Type
text/html
Date
Thu, 21 Jul 2022 10:28:21 GMT
Location
https://metamask.github.io/phishing-warning/v1.1.0/
Server
GitHub.com
Vary
Accept-Encoding
Via
1.1 varnish
X-Cache
MISS
X-Cache-Hits
0
X-Fastly-Request-ID
5652207c2ab7b34a0a75723e5640b5067fb8ba72
X-GitHub-Request-Id
4710:B6B2:310285:351E2B:62D92A45
X-Served-By
cache-mxp6959-MXP
X-Timer
S1658399301.355361,VS0,VE93
permissions-policy
interest-cohort=()
globalthis.js
metamask.github.io/phishing-warning/v1.1.0/
9 KB
3 KB
Script
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/globalthis.js
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
dc45bf034faf3761fce0e054677c2e7e4a511917cd41518f72b96cb9486f5b18

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
e2f2c46cf79095630f040e2cef4fe2df2ea09504
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
2754
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
A0DA:131E9:51DDF4:55F2D1:62D88B70
x-timer
S1658399302.655669,VS0,VE0
etag
W/"62cdd6ef-2339"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:38 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
3
lockdown-install.js
metamask.github.io/phishing-warning/v1.1.0/
39 KB
13 KB
Script
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/lockdown-install.js
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
441218a51c55b14d1560d97d3a2f1358b5d7ef0e6b66a9bb695051ea7b5efe49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
beb3f977ba372db38aa259a9f1076659750fc585
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
12788
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
A4BA:21F6:27DBF5:2AFBC8:62D88B70
x-timer
S1658399302.655574,VS0,VE0
etag
W/"62cdd6ef-9c89"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:38 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
3
lockdown-run.js
metamask.github.io/phishing-warning/v1.1.0/
797 B
620 B
Script
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/lockdown-run.js
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
e15f961feac9c896f31c7b84842a3724026d63208602b4cb81de2326e2a2e8b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
35ee1ed4596920b2e3e44242f3c411ac379c199a
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
443
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
733E:115D5:4FCBFF:53D28C:62D88B70
x-timer
S1658399302.655558,VS0,VE0
etag
W/"62cdd6ef-31d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:40 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
MISS
x-cache-hits
3
lockdown-more.js
metamask.github.io/phishing-warning/v1.1.0/
3 KB
2 KB
Script
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/lockdown-more.js
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
8a48cc29d223f53657b0c2d5da11ed12653187672a8bea4f4d78f97e7c78c849

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
99ba3b118a77bf3000eafa76feb4820e74626a39
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
1350
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
A212:6DD6:52922D:56A9AA:62D88B70
x-timer
S1658399302.655936,VS0,VE0
etag
W/"62cdd6ef-da8"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:17 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
3
bundle.js
metamask.github.io/phishing-warning/v1.1.0/
102 KB
29 KB
Script
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/bundle.js
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
8b927315ec4e4ba52ff37101ac56bcfe6547c8192f9c0db843659e4399cb37f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
68bc2416b60b7d326a59aa9b970ac172311cd3ef
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
29444
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
E826:BBFE:238D19:268D6E:62D88B70
x-timer
S1658399302.655917,VS0,VE0
etag
W/"62cdd6ef-196d4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:40 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
MISS
x-cache-hits
3
design-tokens.css
metamask.github.io/phishing-warning/v1.1.0/
15 KB
2 KB
Stylesheet
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/design-tokens.css
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
c3b6a122531879c3eb9806358310b184295914c59c74eda677a5435587c34897

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
432602da1ceeadae8e7e2f70e0381d5f474b3870
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
528
x-cache
HIT
content-length
2089
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
E8E8:6DD6:529230:56A9AB:62D88B70
x-timer
S1658399302.655105,VS0,VE0
etag
W/"62cdd6ef-3b50"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:40 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
MISS
x-cache-hits
3
index.css
metamask.github.io/phishing-warning/v1.1.0/
2 KB
935 B
Stylesheet
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/index.css
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
14a39bf28a2337fd348c2cb936e08e37ef0d4b33ea0a6c82dcd8b824b63b5133

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
9c28717c40d8a41f794c174ca486581fc464e849
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
165
x-cache
HIT
content-length
607
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
7DF4:1195C:52D4B1:56F435:62D88B70
x-timer
S1658399302.655088,VS0,VE1
etag
W/"62cdd6ef-762"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:20:40 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
1
metamask-fox.svg
metamask.github.io/phishing-warning/v1.1.0/
2 KB
1 KB
Image
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/metamask-fox.svg
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
ff2c65f4668bb1424c36b7a440aadf711fa44e7cc260e6229532863f5eec4e54

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask.github.io/phishing-warning/v1.1.0/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
34048226ad6954aed3f8d7c479e05b05c622d556
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
166
x-cache
HIT
content-length
1030
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
5694:131E9:51DE02:55F2E1:62D88B71
x-timer
S1658399302.745602,VS0,VE1
etag
W/"62cdd6ef-8c2"
vary
Accept-Encoding
content-type
image/svg+xml
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:15:35 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
1
EuclidCircularB-Regular-WebXL.ttf
metamask.github.io/phishing-warning/v1.1.0/fonts/
151 KB
58 KB
Font
General
Full URL
https://metamask.github.io/phishing-warning/v1.1.0/fonts/EuclidCircularB-Regular-WebXL.ttf
Requested by
Host: metamask.github.io
URL: https://metamask.github.io/phishing-warning/v1.1.0/index.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c

Request headers

Referer
https://metamask.github.io/phishing-warning/v1.1.0/index.css
Origin
https://metamask.github.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-fastly-request-id
26ae1c67166dcc53bf3b5d03f5c19c9b0ed2bb89
date
Thu, 21 Jul 2022 10:28:21 GMT
content-encoding
gzip
age
448
x-cache
HIT
content-length
59307
x-served-by
cache-mxp6959-MXP
access-control-allow-origin
*
last-modified
Tue, 12 Jul 2022 20:17:51 GMT
server
GitHub.com
x-github-request-id
A01E:CF8A:11C384:12F8F9:62D88B85
x-timer
S1658399302.787281,VS0,VE0
etag
W/"62cdd6ef-25a50"
vary
Accept-Encoding
content-type
font/ttf
via
1.1 varnish
expires
Wed, 20 Jul 2022 23:13:25 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
HIT
x-cache-hits
3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| assert

0 Cookies

1 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.