oppensea.org Open in urlscan Pro
3.136.138.225 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://oppensea.org/l/play/metamask/index.html
Submission: On November 28 via manual (November 28th 2022, 3:46:32 pm UTC) from AU — Scanned from AU

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 3.136.138.225, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is oppensea.org.
TLS certificate: Issued by R3 on November 24th 2022. Valid for: 3 months.

This is the only time oppensea.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
7	3.136.138.225 3.136.138.225	16509 (AMAZON-02) (AMAZON-02)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	3

7 3.136.138.225 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-136-138-225.us-east-2.compute.amazonaws.com

oppensea.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	oppensea.org oppensea.org	155 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 300	28 KB
8	2

	Domain	Requested by
7	oppensea.org	oppensea.org
1	cdnjs.cloudflare.com	oppensea.org
8	2

This site contains no links.

Subject Issuer	Validity	Valid
oppensea.org R3	`2022-11-24` - `2023-02-22`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://oppensea.org/l/play/metamask/index.html
Frame ID: 0FBA79CB7B487622755DCF557D6C3C76
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MetaMask

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

183 kB
Transfer

924 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.html Show response
oppensea.org/l/play/metamask/ 650 KB
121 KB 1312ms
625ms Document
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: b75a4595a6e8636d2dff10fdef630c430f390fd1dfa8935e13fc46cf0f16aff0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-encoding: br
content-type: text/html
date: Mon, 28 Nov 2022 15:46:26 GMT
etag: W/"6372399f-a298a"
last-modified: Mon, 14 Nov 2022 12:50:39 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 font-awesome.min.html
oppensea.org/l/play/metamask/fonts/Font_Awesome/ 2 KB
1 KB 644ms
643ms Stylesheet
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/fonts/Font_Awesome/font-awesome.min.html
Requested by: Host: oppensea.org
URL: https://oppensea.org/l/play/metamask/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://oppensea.org/l/play/metamask/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:27 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 20:30:42 GMT
server: nginx
etag: W/"636eb0f2-999"
x-powered-by: PleskLin
content-type: text/html

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 72 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jquery.min.js Show response
oppensea.org/l/play/js/ 84 KB
29 KB 324ms
324ms Script
application/javascript 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/js/jquery.min.js
Requested by: Host: oppensea.org
URL: https://oppensea.org/l/play/metamask/index.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://oppensea.org/l/play/metamask/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:28 GMT
content-encoding: br
last-modified: Sat, 30 Apr 2022 00:50:44 GMT
server: nginx
etag: W/"626c87e4-15145"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 88 KB
28 KB 315ms
107ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Requested by

Host: oppensea.org
URL: https://oppensea.org/l/play/metamask/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://oppensea.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4742480
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27990
last-modified: Fri, 26 Aug 2022 18:34:13 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "63091225-6d56"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QD2cf1HagOUDZjoGdJ4Q5tatfZs897SILKBY03Cv7xie70ufg1yVhzNEY8acnzHfRftcvAh3rWpn09wOZ393xsLfMEqpJlKZ7f0Sle9YiSow0Lyq0xbhFHOaPvt7JEPIr2M7ox%2BH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 77143c8eaa41a8b8-SYD
expires: Sat, 18 Nov 2023 15:46:28 GMT

GET
H2 200 EuclidCircularB-Regular-WebXL.html
oppensea.org/l/play/metamask/fonts/Euclid/ 2 KB
1 KB 322ms
321ms Font
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/fonts/Euclid/EuclidCircularB-Regular-WebXL.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e

Request headers

Referer: https://oppensea.org/l/play/metamask/index.html
Origin: https://oppensea.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:29 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 20:30:42 GMT
server: nginx
etag: W/"636eb0f2-999"
x-powered-by: PleskLin
content-type: text/html

GET
H2 200 fa-solid-901.html
oppensea.org/l/play/metamask/fonts/fontawesome/ 2 KB
1 KB 321ms
320ms Font
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-901.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e

Request headers

Referer: https://oppensea.org/l/play/metamask/index.html
Origin: https://oppensea.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:29 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 20:30:42 GMT
server: nginx
etag: W/"636eb0f2-999"
x-powered-by: PleskLin
content-type: text/html

GET
H2 200 fa-solid-902.html
oppensea.org/l/play/metamask/fonts/fontawesome/ 2 KB
1 KB 319ms
319ms Font
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-902.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e

Request headers

Referer: https://oppensea.org/l/play/metamask/index.html
Origin: https://oppensea.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:29 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 20:30:42 GMT
server: nginx
etag: W/"636eb0f2-999"
x-powered-by: PleskLin
content-type: text/html

GET
H2 200 fa-solid-903.html
oppensea.org/l/play/metamask/fonts/fontawesome/ 2 KB
1 KB 319ms
319ms Font
text/html 3.136.138.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-903.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.136.138.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-136-138-225.us-east-2.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e

Request headers

Referer: https://oppensea.org/l/play/metamask/index.html
Origin: https://oppensea.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 15:46:30 GMT
content-encoding: br
last-modified: Fri, 11 Nov 2022 20:30:42 GMT
server: nginx
etag: W/"636eb0f2-999"
x-powered-by: PleskLin
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| CloseAndRefresh function| $ function| jQuery boolean| p

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: Failed to decode downloaded font: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-901.html
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: Failed to decode downloaded font: https://oppensea.org/l/play/metamask/fonts/Euclid/EuclidCircularB-Regular-WebXL.html
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: Failed to decode downloaded font: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-902.html
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: Failed to decode downloaded font: https://oppensea.org/l/play/metamask/fonts/fontawesome/fa-solid-903.html
other	warning	URL: https://oppensea.org/l/play/metamask/index.html Message: OTS parsing error: invalid sfntVersion: 1008813135

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
oppensea.org
104.17.24.14
3.136.138.225
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d
3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b75a4595a6e8636d2dff10fdef630c430f390fd1dfa8935e13fc46cf0f16aff0
d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761
ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056
f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1

oppensea.org Open in urlscan Pro 3.136.138.225 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

183 kBTransfer

924 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

oppensea.org Open in urlscan Pro
3.136.138.225 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

183 kB
Transfer

924 kB
Size

0
Cookies

8 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!