metamaskusan.azurewebsites.net
Open in
urlscan Pro
20.119.0.39
Malicious Activity!
Public Scan
Effective URL: https://metamaskusan.azurewebsites.net/
Submission: On February 10 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 02 on December 18th 2023. Valid for: 6 months.
This is the only time metamaskusan.azurewebsites.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Coinbase (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 20.119.0.39 20.119.0.39 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 142.250.186.74 142.250.186.74 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.26.8.49 104.26.8.49 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 185.15.59.240 185.15.59.240 | () () | |
2 | 142.250.184.227 142.250.184.227 | 15169 (GOOGLE) (GOOGLE) | |
11 | 172.67.38.66 172.67.38.66 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 8 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
metamaskusan.azurewebsites.net |
ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
tawk.to
embed.tawk.to — Cisco Umbrella Rank: 9815 va.tawk.to — Cisco Umbrella Rank: 9429 |
143 KB |
8 |
azurewebsites.net
1 redirects
metamaskusan.azurewebsites.net |
926 KB |
2 |
gstatic.com
fonts.gstatic.com |
16 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
10 KB |
1 |
wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 2785 |
2 KB |
1 |
freelogopng.com
freelogopng.com — Cisco Umbrella Rank: 681107 |
20 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223 |
17 KB |
25 | 7 |
Domain | Requested by | |
---|---|---|
8 | embed.tawk.to |
metamaskusan.azurewebsites.net
embed.tawk.to |
8 | metamaskusan.azurewebsites.net |
1 redirects
metamaskusan.azurewebsites.net
|
3 | va.tawk.to |
embed.tawk.to
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
metamaskusan.azurewebsites.net
|
1 | upload.wikimedia.org |
metamaskusan.azurewebsites.net
|
1 | freelogopng.com |
metamaskusan.azurewebsites.net
|
1 | cdnjs.cloudflare.com |
metamaskusan.azurewebsites.net
|
25 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.azurewebsites.net Microsoft Azure TLS Issuing CA 02 |
2023-12-18 - 2024-06-27 |
6 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
freelogopng.com GTS CA 1P5 |
2023-12-28 - 2024-03-27 |
3 months | crt.sh |
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2023-10-18 - 2024-10-16 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metamaskusan.azurewebsites.net/
Frame ID: C401A41D347FCC068270811C9CE14258
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
Metamask WalletPage URL History Show full URLs
-
http://metamaskusan.azurewebsites.net/
HTTP 301
https://metamaskusan.azurewebsites.net/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Tawk.to (Live Chat) Expand
Detected patterns
- //embed\.tawk\.to
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://metamaskusan.azurewebsites.net/
HTTP 301
https://metamaskusan.azurewebsites.net/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
metamaskusan.azurewebsites.net/ Redirect Chain
|
113 KB 45 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/ |
98 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
304 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.min.css
metamaskusan.azurewebsites.net/assets/css/ |
58 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
metamaskusan.azurewebsites.net/assets/css/ |
157 KB 157 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin.css
metamaskusan.azurewebsites.net/assets/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1683020772metamask-logo-png.png
freelogopng.com/images/all_img/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MetaMask_Fox.svg
upload.wikimedia.org/wikipedia/commons/3/36/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
metamaskusan.azurewebsites.net/assets/js/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popper.js
metamaskusan.azurewebsites.net/assets/js/ |
512 KB 512 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
metamaskusan.azurewebsites.net/assets/js/ |
62 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
28 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1hjl5fun7
embed.tawk.to/659c3f7b8d261e1b5f50daed/ |
2 KB 927 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-main.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
121 B 184 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-vendor.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
81 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-chunk-vendors.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
212 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-chunk-common.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
220 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-runtime.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twk-app.js
embed.tawk.to/_s/v4/app/65c5e36193a/js/ |
151 B 207 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
widget-settings
va.tawk.to/v1/ |
3 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
start
va.tawk.to/v1/session/ |
64 B 313 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
start
va.tawk.to/v1/session/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en.js
embed.tawk.to/_s/v4/app/65c5e36193a/languages/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Coinbase (Crypto Exchange)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap function| preventBack object| Tawk_API object| Tawk_LoadStart string| $_Tawk_AccountKey string| $_Tawk_WidgetId boolean| $_Tawk_Unstable object| $_Tawk object| tawkJsonp function| $__TawkEngine function| EventEmitter function| $__TawkSocket object| Tawk_Window2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
metamaskusan.azurewebsites.net/ | Name: twk_idm_key Value: pHjEEM82bFB3Ez0HSsZcu |
|
metamaskusan.azurewebsites.net/ | Name: TawkConnectionTime Value: 0 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
embed.tawk.to
fonts.googleapis.com
fonts.gstatic.com
freelogopng.com
metamaskusan.azurewebsites.net
upload.wikimedia.org
va.tawk.to
104.17.24.14
104.26.8.49
142.250.184.227
142.250.186.74
172.67.38.66
185.15.59.240
20.119.0.39
081fa6c7f6d8e3c60b771bacf9a7d10648907c155d08c1b1eadd3d45e9323a00
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd
3bf08f2d496182e7c6fc9cb2a9220b240039cbaa3c232667028fcad30ccedc4c
4224e42245d0dd2a433442d32a46e0ce45db2983e059e1a410f48fb91b30c0bf
630b047f8707abfeb8b369fa324ef86faab93b55da55f129f2c37a51870b9e50
66163eff2cc5b1567ba36a296b483f65542fd7e13859fdc34733da5e33de1236
6c062a83601e745c0b976a6897e8c9495cb796e2d69da86988543e92f110721d
6fdccee57d457513db6efee43b8467c6360b011be47104e1a92ec31781992076
705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c
75b20e74e3effa00e4b62b9da6df7d7542d91cb4b50078b8365112d556a73a7e
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7e7fd9f1e6fd2387dc2a5bb83cb72a1c44206347ad8ffde69bcab829cf88b1ff
8e8009b7cba1f1751155c8bec0942c7fb9ebf36f1642457948b14451ae8a3075
916c13b184fbc42c59463a47bf90611461bec9e17a10a37def3c751ade00dced
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
bd4b8349d52b4fe6a3ef806416f7f77f7bdcffb32dfe2737287e66a687927d55
cd6a85f5cdc27987405eddb33f8c620f9a3701d0925704070e6b013ddd80255e
ce47c8f68f541970eee8f34db5ee0aef2e29a7395d08656b8835089f34b98215
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fcd1fa4d2007137da13dd581c678acfda42358cbdbda0f0204874fbe2e2c4663
fe384d6150fae0d1a52854c9a928969917ca8f715d6eb6045506292d0d017b39