www.recover.metamask.cash Open in urlscan Pro
162.0.209.170  Malicious Activity! Public Scan

URL: https://www.recover.metamask.cash/
Submission: On January 22 via automatic, source certstream-suspicious

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main IP is 162.0.209.170, located in Canada and belongs to NAMECHEAP-NET, US. The main domain is www.recover.metamask.cash.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 7th 2020. Valid for: 2 years.
This is the only time www.recover.metamask.cash was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
13 162.0.209.170 22612 (NAMECHEAP...)
1 23.111.9.35 33438 (HIGHWINDS2)
4 2606:4700::68... 13335 (CLOUDFLAR...)
18 4
Apex Domain
Subdomains
Transfer
13 metamask.cash
www.recover.metamask.cash
139 KB
4 unpkg.com
unpkg.com
1008 KB
1 fontawesome.com
use.fontawesome.com
9 KB
18 3
Domain Requested by
13 www.recover.metamask.cash www.recover.metamask.cash
4 unpkg.com www.recover.metamask.cash
1 use.fontawesome.com www.recover.metamask.cash
18 3

This site contains no links.

Subject Issuer Validity Valid
*.web-hosting.com
Sectigo RSA Domain Validation Secure Server CA
2020-05-07 -
2022-04-05
2 years crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-13 -
2021-12-14
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-02 -
2021-08-02
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.recover.metamask.cash/
Frame ID: 17EB87383BD9A73B31050C8303FB4948
Requests: 19 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

18
Requests

28 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

1156 kB
Transfer

4086 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.recover.metamask.cash/
35 KB
11 KB
Document
General
Full URL
https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
fe1e37a799f302ec6574d8d99af76beda5e7805f1d40ed934bdeb7e356a3fd99

Request headers

:method
GET
:authority
www.recover.metamask.cash
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
server
Apache
last-modified
Fri, 22 Jan 2021 10:31:24 GMT
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
11039
content-type
text/html
index.css
www.recover.metamask.cash/
440 KB
61 KB
Stylesheet
General
Full URL
https://www.recover.metamask.cash/index.css
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
c66e0b190ffbe2ea94cf2dae84256d5fb1cac2df59ffa95c0cfb5a2532b51d6f

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Mon, 18 Jan 2021 18:11:14 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
61987
index-rtl.css
www.recover.metamask.cash/
439 KB
61 KB
Stylesheet
General
Full URL
https://www.recover.metamask.cash/index-rtl.css
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
891e35dce5346f0e07216a12f347a7bc0a1818e8debf56f3be89e053a2c79677

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Mon, 18 Jan 2021 18:12:10 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
61902
all.css
use.fontawesome.com/releases/v5.0.7/css/
35 KB
9 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.0.7/css/all.css
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
eee7283bce47f63001396d58cace92f57058ea0c5ee546579e841609a359d52e

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Mon, 26 Feb 2018 20:53:41 GMT
server
NetDNA-cache/2.2
etag
W/"16f4f6797931e43125885e1741f125a7"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
metamask-logo-horizontal.svg
www.recover.metamask.cash/images/logo/
5 KB
2 KB
Image
General
Full URL
https://www.recover.metamask.cash/images/logo/metamask-logo-horizontal.svg
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
a2779239ae69999a04e2e98ee5be8a282a21b41b7b4c6ce00c881ecc82fcaa50

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Mon, 18 Jan 2021 19:13:20 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
content-length
1696
metamask-fox.svg
www.recover.metamask.cash/images/logo/
3 KB
1 KB
Image
General
Full URL
https://www.recover.metamask.cash/images/logo/metamask-fox.svg
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
b855851451c3eb7220bc7331d6cf7f19dad4580ebc35610211f028848ba7fc34

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Mon, 18 Jan 2021 19:26:18 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
content-length
1188
eth_logo.svg
www.recover.metamask.cash/images/
919 B
570 B
Image
General
Full URL
https://www.recover.metamask.cash/images/eth_logo.svg
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
5cd740de2fa35767446eab37428c28eadeb35a105948e3e2cfcb8a4d01296200

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Thu, 21 Jan 2021 22:02:22 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
content-length
409
web3.min.js
unpkg.com/web3@1.3.1/dist/
1 MB
285 KB
Script
General
Full URL
https://unpkg.com/web3@1.3.1/dist/web3.min.js
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
782ba253fe9a9ea67ea5efa76d4ce7878a5ff8396a6692b21098f09961aae00a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
2369990
vary
Accept-Encoding
cf-request-id
07cc2c1a140000d6b1ea15f000000001
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"157a8c-J1ox7MaWlxEv3NpJ+fTYgU1aw5U"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
352ed404bf7557647dff4c72e57011cb
cache-control
public, max-age=31536000
cf-ray
615a1609bfbdd6b1-FRA
index.js
unpkg.com/web3modal@1.9.3/dist/
420 KB
192 KB
Script
General
Full URL
https://unpkg.com/web3modal@1.9.3/dist/index.js
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5851c751870f4d385689f84d0e346c92234a1c7776f98099222eb30565370864
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
946879
vary
Accept-Encoding
cf-request-id
07cc2c1a140000d6b106a1f000000001
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"68f32-0ZYh0dOOSItBfCiz79h5tIFWbYA"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
bfe30f2026dad5d4163d8997ecdf956f
cache-control
public, max-age=31536000
cf-ray
615a1609bfc0d6b1-FRA
index.min.js
unpkg.com/evm-chains@0.2.0/dist/umd/
22 KB
5 KB
Script
General
Full URL
https://unpkg.com/evm-chains@0.2.0/dist/umd/index.min.js
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d93c05813c158faf533a332c1b49f2a9f0432e0454fdefd1a2c9f11428b7a4e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
1324326
vary
Accept-Encoding
cf-request-id
07cc2c1a150000d6b1aca05000000001
last-modified
Mon, 02 Nov 2020 20:31:28 GMT
server
cloudflare
etag
W/"5881-yk4n8EqlvpHDLglCWD85vKUneh8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
70f161edb6f467d4ed8b99bafad8ab77
cache-control
public, max-age=31536000
cf-ray
615a1609bfc1d6b1-FRA
index.min.js
unpkg.com/@walletconnect/web3-provider@1.3.4/dist/umd/
1 MB
527 KB
Script
General
Full URL
https://unpkg.com/@walletconnect/web3-provider@1.3.4/dist/umd/index.min.js
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2126506fcef4cc5e5cb24b39bd50735efb3c559a0e09a2c1b27337222c816d5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
332657
vary
Accept-Encoding
cf-request-id
07cc2c1a150000d6b108b75000000001
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"145d22-tU6yONxLdIz2qTLcdkITT8TrkWI"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
377622b8fb0375de0f8466728abef5b8
cache-control
public, max-age=31536000
cf-ray
615a1609bfc2d6b1-FRA
example.js
www.recover.metamask.cash/
7 KB
3 KB
Script
General
Full URL
https://www.recover.metamask.cash/example.js
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash
b7248b3127ced1e6f805071fe13b26c7d78c6a7fe96fb7dfa352317239853568

Request headers

Referer
https://www.recover.metamask.cash/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:13 GMT
content-encoding
gzip
last-modified
Fri, 22 Jan 2021 10:29:56 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
2491
EuclidCircularB-Regular-WebXL.ttf
www.recover.metamask.cash/fonts/Euclid/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
EuclidCircularB-Bold-WebXL.ttf
www.recover.metamask.cash/fonts/Euclid/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Euclid/EuclidCircularB-Bold-WebXL.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4d17514e4c6ec3082d1321979a48ca6975a2fa1682a8e633a320fcff5e1a67c2

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
Roboto-Medium.ttf
www.recover.metamask.cash/fonts/Roboto/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Roboto/Roboto-Medium.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
Roboto-Black.ttf
www.recover.metamask.cash/fonts/Roboto/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Roboto/Roboto-Black.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
Roboto-Regular.ttf
www.recover.metamask.cash/fonts/Roboto/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Roboto/Roboto-Regular.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
Roboto-Bold.ttf
www.recover.metamask.cash/fonts/Roboto/
0
0
Font
General
Full URL
https://www.recover.metamask.cash/fonts/Roboto/Roboto-Bold.ttf
Requested by
Host: www.recover.metamask.cash
URL: https://www.recover.metamask.cash/index.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.0.209.170 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium180-2.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Origin
https://www.recover.metamask.cash
Referer
https://www.recover.metamask.cash/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 22 Jan 2021 14:50:14 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 object| Web3Modal object| evmChains object| WalletConnectProvider function| init function| fetchAccountData function| sleep function| refreshAccountData function| onConnect function| onDisconnect function| updateWeb3Modal number| yOffset number| acceleration

0 Cookies

5 Console Messages

Source Level URL
Text
console-api log URL: https://www.recover.metamask.cash/example.js(Line 29)
Message:
Initializing example
console-api log URL: https://www.recover.metamask.cash/example.js(Line 30)
Message:
WalletConnectProvider is class extends u{constructor(e){var t;if(super({pollingInterval:e.pollingInterval||8e3}),this.bridge="https://bridge.walletconnect.org",this.qrcode=!0,this.qrcodeModalOptions=void 0,this.rpc=null,this.infuraId="",this.http=null,this.isConnecting=!1,this.connected=!1,this.connectCallbacks=[],this.accounts=[],this.chainId=1,this.networkId=1,this.rpcUrl="",this.bridge=e.connector?e.connector.bridge:e.bridge||"https://bridge.walletconnect.org",this.qrcode=void 0===e.qrcode||!1!==e.qrcode,this.qrcodeModalOptions=e.qrcodeModalOptions,this.wc=e.connector||new i.default({bridge:this.bridge,qrcodeModal:this.qrcode?o.default:void 0,qrcodeModalOptions:this.qrcodeModalOptions,clientMeta:null===(t=e)||void 0===t?void 0:t.clientMeta}),this.rpc=e.rpc||null,!(this.rpc||e.infuraId&&"string"==typeof e.infuraId&&e.infuraId.trim()))throw new Error("Missing one of the required parameters: rpc or infuraId");this.infuraId=e.infuraId||"",this.chainId=void 0!==e.chainId?e.chainId:1,this.networkId=this.chainId,this.updateRpcUrl(this.chainId),this.addProvider(new f({eth_hashrate:"0x00",eth_mining:!1,eth_syncing:!0,net_listening:!0,web3_clientVersion:"WalletConnect/v1.x.x/javascript"})),this.addProvider(new c),this.addProvider(new p),this.addProvider(new h),this.addProvider(new d),this.addProvider(new l({getAccounts:e=>n.__awaiter(this,void 0,void 0,(function*(){try{const t=(yield this.getWalletConnector()).accounts;t&&t.length?e(null,t):e(new Error("Failed to get accounts"))}catch(t){e(t)}})),processMessage:(e,t)=>n.__awaiter(this,void 0,void 0,(function*(){try{const r=yield this.getWalletConnector(),n=yield r.signMessage([e.from,e.data]);t(null,n)}catch(e){t(e)}})),processPersonalMessage:(e,t)=>n.__awaiter(this,void 0,void 0,(function*(){try{const r=yield this.getWalletConnector(),n=yield r.signPersonalMessage([e.data,e.from]);t(null,n)}catch(e){t(e)}})),processSignTransaction:(e,t)=>n.__awaiter(this,void 0,void 0,(function*(){try{const r=yield this.getWalletConnector(),n=yield r.signTransaction(e);t(null,n)}catch(e){t(e)}})),processTransaction:(e,t)=>n.__awaiter(this,void 0,void 0,(function*(){try{const r=yield this.getWalletConnector(),n=yield r.sendTransaction(e);t(null,n)}catch(e){t(e)}})),processTypedMessage:(e,t)=>n.__awaiter(this,void 0,void 0,(function*(){try{const r=yield this.getWalletConnector(),n=yield r.signTypedData([e.from,e.data]);t(null,n)}catch(e){t(e)}}))})),this.addProvider({handleRequest:(e,t,r)=>n.__awaiter(this,void 0,void 0,(function*(){try{const{result:t}=yield this.handleRequest(e);r(null,t)}catch(e){r(e)}})),setEngine:e=>e})}get isWalletConnect(){return!0}get connector(){return this.wc}get walletMeta(){return this.wc.peerMeta}enable(){return n.__awaiter(this,void 0,void 0,(function*(){const e=yield this.getWalletConnector();if(e)return this.start(),this.subscribeWalletConnector(),e.accounts;throw new Error("Failed to connect to WalleConnect")}))}request(e){return n.__awaiter(this,void 0,void 0,(function*(){return this.send(e)}))}send(e,t){return n.__awaiter(this,void 0,void 0,(function*(){if("string"==typeof e){const r=e;let n=t;return"personal_sign"===r&&(n=s.parsePersonalSign(n)),this.sendAsyncPromise(r,n)}if("personal_sign"===(e=Object.assign({id:s.payloadId(),jsonrpc:"2.0"},e)).method&&(e.params=s.parsePersonalSign(e.params)),!t)return this.sendAsyncPromise(e.method,e.params);this.sendAsync(e,t)}))}onConnect(e){this.connectCallbacks.push(e)}triggerConnect(e){this.connectCallbacks&&this.connectCallbacks.length&&this.connectCallbacks.forEach(t=>t(e))}disconnect(){return n.__awaiter(this,void 0,void 0,(function*(){this.close()}))}close(){return n.__awaiter(this,void 0,void 0,(function*(){const e=yield this.getWalletConnector({disableSessionCreation:!0});yield e.killSession(),yield this.onDisconnect()}))}handleRequest(e){return n.__awaiter(this,void 0,void 0,(function*(){try{let t,r=null;const n=yield this.getWalletConnector();switch(e.method){case"wc_killSession":yield this.close(),r=null;break;case"eth_accounts":r=n.accounts;break;case"eth_coinbase":r=n.accounts[0];break;case"eth_chainId":r=n.chainId;break;case"net_version":r=n.networkId||n.chainId;break;case"eth_uninstallFilter":this.sendAsync(e,e=>e),r=!0;break;default:t=yield this.handleOtherRequests(e)}return t||this.formatResponse(e,r)}catch(e){throw this.emit("error",e),e}}))}handleOtherRequests(e){return n.__awaiter(this,void 0,void 0,(function*(){if(!s.signingMethods.includes(e.method)&&e.method.startsWith("eth_"))return this.handleReadRequests(e);const t=yield this.getWalletConnector(),r=yield t.sendCustomRequest(e);return this.formatResponse(e,r)}))}handleReadRequests(e){return n.__awaiter(this,void 0,void 0,(function*(){if(!this.http){const e=new Error("HTTP Connection not available");throw this.emit("error",e),e}return this.http.send(e)}))}formatResponse(e,t){return{id:e.id,jsonrpc:e.jsonrpc,result:t}}getWalletConnector(e={}){const{disableSessionCreation:t=!1}=e;return new Promise((e,r)=>{const n=this.wc;if(this.isConnecting)this.onConnect(t=>e(t));else if(n.connected||t)this.connected||(this.connected=!0,this.updateState(n.session)),e(n);else{this.isConnecting=!0;const t=this.chainId?{chainId:this.chainId}:void 0;n.on("modal_closed",()=>{r(new Error("User closed modal"))}),n.createSession(t).then(()=>{n.on("connect",(t,i)=>{if(t)return this.isConnecting=!1,r(t);this.isConnecting=!1,this.connected=!0,i&&this.updateState(i.params[0]),this.emit("connect"),this.triggerConnect(n),e(n)})}).catch(e=>{this.isConnecting=!1,r(e)})}})}subscribeWalletConnector(){return n.__awaiter(this,void 0,void 0,(function*(){const e=yield this.getWalletConnector();e.on("disconnect",e=>{e?this.emit("error",e):this.onDisconnect()}),e.on("session_update",(e,t)=>{e?this.emit("error",e):this.updateState(t.params[0])})}))}onDisconnect(){return n.__awaiter(this,void 0,void 0,(function*(){yield this.stop(),this.emit("close",1e3,"Connection closed"),this.emit("disconnect",1e3,"Connection disconnected")}))}updateState(e){return n.__awaiter(this,void 0,void 0,(function*(){const{accounts:t,chainId:r,networkId:n,rpcUrl:i}=e;(!this.accounts||t&&this.accounts!==t)&&(this.accounts=t,this.emit("accountsChanged",t)),(!this.chainId||r&&this.chainId!==r)&&(this.chainId=r,this.emit("chainChanged",r)),(!this.networkId||n&&this.networkId!==n)&&(this.networkId=n,this.emit("networkChanged",n)),this.updateRpcUrl(this.chainId,i||"")}))}updateRpcUrl(e,t=""){const r={1:"mainnet",3:"ropsten",4:"rinkeby",5:"goerli",42:"kovan"}[e];t||(this.rpc&&this.rpc[e]?t=this.rpc[e]:r&&(t=`https://${r}.infura.io/v3/${this.infuraId}`)),t?(this.rpcUrl=t,this.updateHttpConnection()):this.emit("error",new Error("No RPC Url available for chainId: "+e))}updateHttpConnection(){this.rpcUrl&&(this.http=new a.default(this.rpcUrl),this.http.on("payload",e=>this.emit("payload",e)),this.http.on("error",e=>this.emit("error",e)))}sendAsyncPromise(e,t){return new Promise((r,n)=>{this.sendAsync({id:s.payloadId(),jsonrpc:"2.0",method:e,params:t||[]},(e,t)=>{e?n(e):r(t.result)})})}}
console-api log URL: https://www.recover.metamask.cash/example.js(Line 31)
Message:
Fortmatic is undefined
console-api log URL: https://www.recover.metamask.cash/example.js(Line 32)
Message:
window.web3 is undefined window.ethereum is undefined
console-api log URL: https://www.recover.metamask.cash/example.js(Line 71)
Message:
Web3Modal instance is [object Object]