secure-app.top Open in urlscan Pro
2606:4700:3031::6815:3b74 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://signin-page.top/
Effective URL:
https://secure-app.top/get-started.html
Submission: On September 08 via api (September 8th 2023, 3:34:36 pm UTC) from US — Scanned from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3031::6815:3b74, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure-app.top.
TLS certificate: Issued by E1 on September 5th 2023. Valid for: 3 months.

This is the only time secure-app.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3036::6815:55cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:821::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::6815:3f94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3031::6815:3b74	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	4

4 2606:4700:3036::6815:55cb (United States)

ASN13335 (CLOUDFLARENET, US)

signin-page.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:3f94 (United States)

ASN13335 (CLOUDFLARENET, US)

easyvvallet.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3031::6815:3b74 (United States)

ASN13335 (CLOUDFLARENET, US)

secure-app.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	secure-app.top secure-app.top	143 KB
4	signin-page.top signin-page.top	10 KB
1	easyvvallet.top easyvvallet.top	903 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 406	30 KB
10	4

	Domain	Requested by
4	secure-app.top	easyvvallet.top secure-app.top
4	signin-page.top	signin-page.top
1	easyvvallet.top	signin-page.top
1	ajax.googleapis.com	signin-page.top
10	4

This site contains no links.

Subject Issuer	Validity	Valid
signin-page.top GTS CA 1P5	`2023-09-05` - `2023-12-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
easyvvallet.top E1	`2023-09-07` - `2023-12-06`	3 months	crt.sh
secure-app.top E1	`2023-09-05` - `2023-12-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secure-app.top/get-started.html
Frame ID: 39370A3E7A5E6A2939FF855554E4BA91
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MetaMask

Page URL History Show full URLs

https://signin-page.top/ Page URL
https://secure-app.top/get-started.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

183 kB
Transfer

1523 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://signin-page.top/ Page URL
https://secure-app.top/get-started.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
signin-page.top/ 13 KB
5 KB 562ms
349ms Document
text/html 2606:4700:3036::6815:55cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://signin-page.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:55cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42d11ae27eea324d35e150e9b65acba84b41dff86c8af94a7623497fee43988b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8038417e788d4bd2-BUF
content-encoding: br
content-type: text/html
date: Fri, 08 Sep 2023 15:34:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uXo4yySNzHGrgMtK5%2BBJ4HXg%2BhEN5uCy7rIbKvqIW5XYkzY8KIPAtxro61ppxMflY4trOYnULomxsFXjH0kPo7GyuFqhJwWFKd1%2BgbnNUAsXHipMcBz%2F5w0R43t18E3empp5xQKG84b91WInJVw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.5.1/ 83 KB
30 KB 196ms
80ms Script
text/javascript 2607:f8b0:4006:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js

Requested by

Host: signin-page.top
URL: https://signin-page.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://signin-page.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 23:48:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 575180
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29839
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Aug 2024 23:48:09 GMT

GET
H2 200 hover.js Show response
signin-page.top/js/ 337 B
529 B 364ms
360ms Script
application/javascript 2606:4700:3036::6815:55cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://signin-page.top/js/hover.js
Requested by: Host: signin-page.top
URL: https://signin-page.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:55cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f4a9224ce09c4b70cb8894d50d74a71a365a943ea7bb9c722d5aa7885d225a2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://signin-page.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 14 Jan 2013 04:01:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"50f3831a-151"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DDyQb3xLkaIWrQMImTspdaQlm6ZIfQSZkDOi2gz4dxg7Exm%2B5mGhxTjxfm6r1nW8jD5oh9x7roB4fgTqWmm5eJAU1Jf0ZVSNwaXkmAgOL%2F9bv4K8omz86h7NbdO41N7ZLdAjDf3nNflFNpnE5h8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 80384180b9104bd2-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Sep 2023 15:34:29 GMT

GET
H2 200 style.css
signin-page.top/styles/ 11 KB
3 KB 367ms
364ms Stylesheet
text/css 2606:4700:3036::6815:55cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://signin-page.top/styles/style.css
Requested by: Host: signin-page.top
URL: https://signin-page.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:55cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 339497e7fe89c7d71b92aa1f4c16928335585228e32da8cb52630cb416134dba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://signin-page.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 14 Jan 2013 04:01:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"50f3831a-2a2f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R3b0VWXuEXpeLE0rarMHF0OjBJ0qO6boInCbXh2AWUnjh7NSZMY8P1ktwgnxRL83uDGeCMb7WtShe9Pxiu3Yeed241jJxYv4YIgkWC85pzQQMKfSuTTuoOBJBeGP%2Ft81GY0z%2BalODhQBFzPZ%2Fi4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 80384180b90f4bd2-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Sep 2023 15:34:29 GMT

GET
H3 200 reset.css
signin-page.top/styles/ 940 B
1023 B 369ms
367ms Stylesheet
text/css 2606:4700:3036::6815:55cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://signin-page.top/styles/reset.css
Requested by: Host: signin-page.top
URL: https://signin-page.top/styles/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:55cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb257c277817f6182355b07fa61474210f8b3b656e63ba6071684d4854e02502

Request headers

accept-language: en-US,en;q=0.9
Referer: https://signin-page.top/styles/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 14 Jan 2013 04:01:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"50f3831a-3ac"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gZ7qloH9jjr6XkEjCPn%2FXmJ2Z1Pc3ofyHrHv2ska%2FH3wjqFswvzLDC2Zd5TZqqsCpbo9ID1jMsF8OdM82XTNXgsjH7m%2FEYNvBQEI%2F8x7qOSFoQPePlWFfy7yzrnUlowuuPShJ7%2F1fws5Y3i%2B7SU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 803841830b094bc1-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Sep 2023 15:34:29 GMT

GET
H2 200 5ZbcGV6N
easyvvallet.top/ 406 B
903 B 445ms
277ms Script
application/javascript 2606:4700:3035::6815:3f94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://easyvvallet.top/5ZbcGV6N?&se_referrer=&default_keyword=Homepage%20-%20Last%20Word%20on%20Sports%20%7C%20Blog%20news%20in%20world&&frm=script
Requested by: Host: signin-page.top
URL: https://signin-page.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:3f94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://signin-page.top/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Fri, 08 Sep 2023 15:34:30 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cioEIE6wjv7kZmIg8fiDS4L%2B1CEHyqeGGZVrCkYqLtPsBIbZ2IOv%2Beh4og5mOWJ0DAdpAnzob8wy1VutGM%2BboLJU0RXSJb5mf280jNsi4w7HugACICziOx%2B6Rp3%2Bkx8jt8qhtnqTPp2XYO1Q65k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 803841866c724bcf-BUF
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 Primary Request get-started.html Show response
secure-app.top/ 21 KB
3 KB 531ms
377ms Document
text/html 2606:4700:3031::6815:3b74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-app.top/get-started.html
Requested by: Host: easyvvallet.top
URL: https://easyvvallet.top/5ZbcGV6N?&se_referrer=&default_keyword=Homepage%20-%20Last%20Word%20on%20Sports%20%7C%20Blog%20news%20in%20world&&frm=script
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3b74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f2aaa809006a8fa70575f9b35ecc694ea59a01714d568f3571eb74fe3aa8039

Request headers

Referer: https://signin-page.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 803841892c9f4bcd-BUF
content-encoding: br
content-type: text/html
date: Fri, 08 Sep 2023 15:34:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2BK6ETFyxM0wtWSxVawNj8IDfokS0bJ5ExAJkOZ1EKqk3CwYE72dwFEbsmV5awjZdtLWbCWxEZp6nJpJKuONni14jn9H7Y5sg%2Bh003cTHW9sa44A3zroK4dII%2FbSY2%2F8LjyBtKGLM5mHIY8ToQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 index.css
secure-app.top/core/ 653 KB
62 KB 603ms
601ms Stylesheet
text/css 2606:4700:3031::6815:3b74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-app.top/core/index.css
Requested by: Host: secure-app.top
URL: https://secure-app.top/get-started.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3b74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8f2fa6acc872cf3c8d2a941917bea5d6bc305c5483c2448121e2a6096f682b2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://secure-app.top/get-started.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:31 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 10 Jul 2023 12:33:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64abfa8e-a3374"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2Ba5qexd7Df5%2FNh0aaB3jovCbY0wXymxdpOzCRTTSy%2B7v1fp1xt%2F44sypvj8fU6Dk3F%2FmEnFnO7pErcLBq4CmJJ7VTjg%2FOMl8JDzJR5oSj2RvNnONHKMe1EpPQGK8%2Bu0qGzwzGaRsn6VwvQr8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 8038418b8cc44bcd-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Sep 2023 15:34:31 GMT

GET
H2 200 index-rtl.css
secure-app.top/core/ 653 KB
62 KB 638ms
637ms Stylesheet
text/css 2606:4700:3031::6815:3b74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-app.top/core/index-rtl.css
Requested by: Host: secure-app.top
URL: https://secure-app.top/get-started.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3b74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41f00deb714276cc13a040620fec2e5aac7c16abbcb00852f0066affa16f406d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://secure-app.top/get-started.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:31 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 10 Jul 2023 12:33:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64abfa8c-a3284"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2X5%2B8lvbc1G6CdBiiqq5frSqt%2BCDAmwiVbHTLgc4qV5xCSuTNn1w39avaQh1PqVoD67hoRGY%2Fo6pR3UmMFoJCJ1VhhnC98ZtvXfOSsIxXRJhaPtVXDy5OtY3RzKjmPW%2Fjl3E3DGjsiNR3iM2WA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 8038418b8cc54bcd-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Sep 2023 15:34:31 GMT

GET
H3 200 EuclidCircularB-Regular-WebXL.ttf.html
secure-app.top/fonts/Euclid/ 88 KB
16 KB 371ms
370ms Font
text/html 2606:4700:3031::6815:3b74
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-app.top/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf.html
Requested by: Host: secure-app.top
URL: https://secure-app.top/core/index.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3b74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1802f0d9669c9649245e6d1a2b83d2f4835e5e0bcc275a873e14c0e077b84b77

Request headers

Referer: https://secure-app.top/core/index.css
Origin: https://secure-app.top
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 15:34:32 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ez04Qvr7LeUao%2BRHOyOb1H9%2F3c33V3FJR4j1o96U%2FBF61UqX4F%2BirgX2Fp4e2lEBeZNauDC%2Bgr%2FE7z%2BUY%2B6KQacMvM6AC9IZJ%2FT5Q8dKqHxC4buTYERfrfP06A1DekexGqARv5jBeogVy1KttQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cf-ray: 803841906a8a4bbb-BUF
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://signin-page.top/(Line 12) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://easyvvallet.top/5ZbcGV6N?&se_referrer=&default_keyword=Homepage%20-%20Last%20Word%20on%20Sports%20%7C%20Blog%20news%20in%20world&&frm=script, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://signin-page.top/(Line 12) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://easyvvallet.top/5ZbcGV6N?&se_referrer=&default_keyword=Homepage%20-%20Last%20Word%20on%20Sports%20%7C%20Blog%20news%20in%20world&&frm=script, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other	warning	URL: https://secure-app.top/get-started.html Message: Failed to decode downloaded font: https://secure-app.top/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf.html
other	warning	URL: https://secure-app.top/get-started.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://secure-app.top/get-started.html Message: Failed to decode downloaded font: https://secure-app.top/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf.html
other	warning	URL: https://secure-app.top/get-started.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://secure-app.top/get-started.html Message: Failed to decode downloaded font: https://secure-app.top/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf.html
other	warning	URL: https://secure-app.top/get-started.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://secure-app.top/get-started.html Message: Failed to decode downloaded font: https://secure-app.top/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf.html
other	warning	URL: https://secure-app.top/get-started.html Message: OTS parsing error: invalid sfntVersion: 1008813135

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
easyvvallet.top
secure-app.top
signin-page.top
2606:4700:3031::6815:3b74
2606:4700:3035::6815:3f94
2606:4700:3036::6815:55cb
2607:f8b0:4006:821::200a
0f2aaa809006a8fa70575f9b35ecc694ea59a01714d568f3571eb74fe3aa8039
1802f0d9669c9649245e6d1a2b83d2f4835e5e0bcc275a873e14c0e077b84b77
339497e7fe89c7d71b92aa1f4c16928335585228e32da8cb52630cb416134dba
41f00deb714276cc13a040620fec2e5aac7c16abbcb00852f0066affa16f406d
42d11ae27eea324d35e150e9b65acba84b41dff86c8af94a7623497fee43988b
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
8f4a9224ce09c4b70cb8894d50d74a71a365a943ea7bb9c722d5aa7885d225a2
eb257c277817f6182355b07fa61474210f8b3b656e63ba6071684d4854e02502
f8f2fa6acc872cf3c8d2a941917bea5d6bc305c5483c2448121e2a6096f682b2

secure-app.top Open in urlscan Pro 2606:4700:3031::6815:3b74 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

183 kBTransfer

1523 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

10 Console Messages

Indicators

secure-app.top Open in urlscan Pro
2606:4700:3031::6815:3b74 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

183 kB
Transfer

1523 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!