restoremetamask.io Open in urlscan Pro
104.21.81.37 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://restoremetamask.io/
Submission: On October 28 via automatic, source certstream-suspicious (October 28th 2021, 8:52:21 pm UTC) — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 104.21.81.37, located in United States and belongs to CLOUDFLARENET, US. The main domain is restoremetamask.io.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 28th 2021. Valid for: a year.

This is the only time restoremetamask.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address		AS Autonomous System
13	104.21.81.37 104.21.81.37		13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	1

13 104.21.81.37 (United States)

ASN13335 (CLOUDFLARENET, US)

restoremetamask.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	restoremetamask.io restoremetamask.io	611 KB
13	1

	Domain	Requested by
13	restoremetamask.io	restoremetamask.io
13	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-10-28` - `2022-10-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://restoremetamask.io/
Frame ID: BECD2ADD39C82BB1AB22F0C7E164EB2B
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MetaMask Restore

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

611 kB
Transfer

727 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
restoremetamask.io/ 4 KB
2 KB 728ms
661ms Document
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8c441b689c6973d880dfca4eb8821a1d444b83ad6a978e1dd630cc04486a824

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 28 Oct 2021 20:52:16 GMT
content-type: text/html
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
vary: Accept-Encoding
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9k9bu52eO57A4%2BcO5WC66vOHn%2FDBlcdLdrFgO9j6ZGD56vPS1NXjp89N0CQk4WkknL5rJmrXO3QQAjHwEuiDB%2FSKC%2BDkCd1A58zcA0UzpNW1KJ412r6vKXbpyi7z%2FLgvF3Tw5zc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a570c006cc6331c-CDG
content-encoding: br

GET
H2 200 normalize.css
restoremetamask.io/css/ 8 KB
3 KB 452ms
450ms Stylesheet
text/css 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/css/normalize.css

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37743dc1ed092a174e95bd76c66f1a2e332d491882f1091627388cb7e490ca1e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
etag: W/"1e5b-617b0371-e63dfd1524f22197;gz"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sauiCoAE03rFTdbBc9VdfxLEPR7mam1z1lu0KdSJ3j0CXcsScHHt2PBSCEERK7rS8REBZxN886nAcfh9Ku4raiI1g%2BeLdXp4bXZTAhS%2F7CQXNEEV88UxFiQOsVN%2BEYEvtr15Tsk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab8d331c-CDG
expires: Thu, 04 Nov 2021 20:52:14 GMT

GET
H2 200 webflow.css
restoremetamask.io/css/ 38 KB
10 KB 471ms
470ms Stylesheet
text/css 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/css/webflow.css

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69b69addbb8631e7a4b9e0c7a140841691812ed7a9378f3eed9d3c1fe31c1803

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
etag: W/"988e-617b0371-55f9ccc9fe1e9b2d;gz"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BIRMQRd2l1CQdyPi7UTTp1SQBKu9aSXthavN5mEPuhz1uDnEwAAviRic%2FoC6MTUaDgWUbGjDTJjv8ZSzm%2F9tAE5avB6BosaicS6W5XudZwSoXeMuC9flwqydi5hOqe0JjqlaWGU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab8e331c-CDG
expires: Thu, 04 Nov 2021 20:52:14 GMT

GET
H2 200 metamask-staging.webflow.css
restoremetamask.io/css/ 96 KB
14 KB 436ms
434ms Stylesheet
text/css 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/css/metamask-staging.webflow.css

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3919ced26a2338960ece8443693f8d117c4044c149dc9eb3c101febdcd84f9ff

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
etag: W/"17e4a-617b0371-e4c575145eb4c78d;gz"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktYkZekb0w5BxoPBQx3%2FdyWC2CCpMCU%2B%2FUanJwBfQn9sJBC7RDjMy4kW1SdoedXxEAAnR%2F2B9yTWcO8In7C0gKBoIVjRfbW9f%2BKT2X55X7MmA7%2B4Fm5kdQI0ht%2BjwkI0h7S4O7I%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab8f331c-CDG
expires: Thu, 04 Nov 2021 20:52:14 GMT

GET
H2 404 webfont.js
restoremetamask.io/ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 0
0 481ms
481ms Script
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 08:33:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1S2eCPPPo1zF3qu9IS4qhHxalH5gKv1yhWZTCOIZr%2FcVzPSAGvd3xaUdmPwKw1JITVDHwdql4ujxkTzEQotYmKFRvcc0E0yrCtNqZ5w5J5%2BnDYH9Y6aPVms2ChyNiWz%2BlOKATN0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab90331c-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 404 jquery-3.5.1.min.dc5e7f18c8828d.js
restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/ 0
0 450ms
449ms Script
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8828d.js?site=5fd1a30a78e29a0936f57bd9

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 08:33:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JtdnLB7KulNwVyqSl4QkMMnfcnC0AYXQDFA6ITTzI0Nql39eNa%2BkJFgAA%2Bkp87ujBA3xVGQO9TavpDWLKwUqfL3I3seQE3FG0l39o%2BtmkyAhNUP5iLSQBwuwDa9%2BSMZUdfDbkko%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab91331c-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 webflow.html Show response
restoremetamask.io/js/ 1 KB
909 B 169ms
168ms Script
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/js/webflow.html

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Oct 2021 20:09:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9byEaoMlqyF3Z%2FINeVFBXnsca5qwEypEY%2FQKqLDeo%2Bgh93yw4WHCKTG85Z109AckC0NjpijuVmCgCPH3aZbTWnOQd6LTFBb3Uo43bZvVyIqF1L5jnKx7UMc2DTQDrtpwlwnlLx0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c04ab92331c-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 404 jquery-3.5.1.min.dc5e7f18c8828d.js
restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/ 0
0 24ms
24ms Script
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8828d.js?site=5fd1a30a78e29a0936f57bd9

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 22 Oct 2021 08:33:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ebervxrJ1%2FQfTQEBtqiu3lNgRwVR6ugzYP2bsjhDiB2VwcJfHrHKNHRbFXiCpaWGVumrtEGO4tGwvNwAolnmQJM8JlnAcbc3ahFquwvEAqBDo8fqoOHNExm5awCI55X2mCzZyJM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c07ba6b3ab7-CDG

GET
H3 200 hero2.2.png
restoremetamask.io/images/ 576 KB
577 KB 857ms
857ms Image
image/png 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://restoremetamask.io/images/hero2.2.png

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/css/metamask-staging.webflow.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f4bfc7c6cc471e9d95936dc109852c4f6a4bf1163b63eeabfe840565d5ad8d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://restoremetamask.io/css/metamask-staging.webflow.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 589568
last-modified: Thu, 28 Oct 2021 20:09:24 GMT
server: cloudflare
etag: "8ff00-617b0374-4c6b251bb1bba94d;;;"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eusDzylB8V3ghEVODQufUC0E9v495CbqEVG5ui%2FUHeL%2FKcw0GmpEQRcgD0xAKuTluKlKwBaxoKnSQ5iqIXrNdE6paUZzAWMyGWrjm8JXhTYhynfIm7qWPfgEPRhqrrqBRYRWScQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
accept-ranges: bytes
cf-ray: 6a570c07ba6e3ab7-CDG
expires: Thu, 04 Nov 2021 20:52:15 GMT

GET
H3 200 EuclidCircularB-Regular-WebXL.html
restoremetamask.io/fonts/ 1 KB
1 KB 438ms
438ms Font
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/fonts/EuclidCircularB-Regular-WebXL.html

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/css/metamask-staging.webflow.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/css/metamask-staging.webflow.css
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WV%2FIQt6t2YAtrStioBSb%2FBbHRZUr6WAE8mOfr6Vtj3mBVDKTW0E66x5g4WfjvzSNs%2ByBw%2B3SYlhW6u9nxUcc2TbUO7L0tlkDtuRiwiN%2FtZy4YxU0R3j5oOWRYJp3%2B6cRH4DLUBI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c07ba703ab7-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 EuclidCircularB-Bold-WebXL.html
restoremetamask.io/fonts/ 1 KB
1 KB 448ms
448ms Font
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/fonts/EuclidCircularB-Bold-WebXL.html

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/css/metamask-staging.webflow.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/css/metamask-staging.webflow.css
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lerpDh0s6ysGl6plJ5BQxSICg9pOjbAxHUIXgqDhDgrMcof5l6knmd%2F7C%2FQD40JKEu7VwPnzRwXNUvmiIfAUv5QEBPkvZP56P7EuI61dzWs8OTtrkVvhYs5RzFwuTemInfbGbd4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c07ba723ab7-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 EuclidCircularB-Regular-WebXL-2.html
restoremetamask.io/fonts/ 1 KB
1 KB 158ms
157ms Font
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/fonts/EuclidCircularB-Regular-WebXL-2.html

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/css/metamask-staging.webflow.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/css/metamask-staging.webflow.css
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HuAiDoQoGUw42%2FumzYIPBUKPfCO9p08VAZOzGl9LXwPjvBCWd9HA51gABxB9wgjvvGFQXdTJsXCFoN%2FqZEbcAxnF6B7OlqR9De43Yolf9awNuvWS%2B4t9IqO93DDwioIZC05SDF8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c0a7dc13ab7-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 EuclidCircularB-Bold-WebXL-2.html
restoremetamask.io/fonts/ 1 KB
1 KB 165ms
165ms Font
text/html 104.21.81.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://restoremetamask.io/fonts/EuclidCircularB-Bold-WebXL-2.html

Requested by

Host: restoremetamask.io
URL: https://restoremetamask.io/css/metamask-staging.webflow.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.81.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://restoremetamask.io/css/metamask-staging.webflow.css
Origin: https://restoremetamask.io
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 20:52:17 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Oct 2021 20:09:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qg1Y7eUNpC4e8cmAqGxz48KQ0xuuTKMbODssFg4Jt4Yn1GOcktCBYUgrZnMyUcqfd2Pg5kWEGFK6maAJeHvz1IAZ4JKa16qUOfCDaHHF6N7bzKce70wb%2FSHDU3tu0b3LUo4rLXY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-turbo-charged-by: LiteSpeed
content-security-policy: upgrade-insecure-requests
cf-ray: 6a570c0a8ddc3ab7-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8828d.js?site=5fd1a30a78e29a0936f57bd9 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://restoremetamask.io/ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://restoremetamask.io/d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8828d.js?site=5fd1a30a78e29a0936f57bd9 Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://restoremetamask.io/ Message: Failed to decode downloaded font: https://restoremetamask.io/fonts/EuclidCircularB-Regular-WebXL.html
other	warning	URL: https://restoremetamask.io/ Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://restoremetamask.io/ Message: Failed to decode downloaded font: https://restoremetamask.io/fonts/EuclidCircularB-Bold-WebXL.html
other	warning	URL: https://restoremetamask.io/ Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://restoremetamask.io/ Message: Failed to decode downloaded font: https://restoremetamask.io/fonts/EuclidCircularB-Regular-WebXL-2.html
other	warning	URL: https://restoremetamask.io/ Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://restoremetamask.io/ Message: Failed to decode downloaded font: https://restoremetamask.io/fonts/EuclidCircularB-Bold-WebXL-2.html
other	warning	URL: https://restoremetamask.io/ Message: OTS parsing error: invalid sfntVersion: 1008813135

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

restoremetamask.io
104.21.81.37
37743dc1ed092a174e95bd76c66f1a2e332d491882f1091627388cb7e490ca1e
3919ced26a2338960ece8443693f8d117c4044c149dc9eb3c101febdcd84f9ff
3f4bfc7c6cc471e9d95936dc109852c4f6a4bf1163b63eeabfe840565d5ad8d1
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
69b69addbb8631e7a4b9e0c7a140841691812ed7a9378f3eed9d3c1fe31c1803
b8c441b689c6973d880dfca4eb8821a1d444b83ad6a978e1dd630cc04486a824

restoremetamask.io Open in urlscan Pro 104.21.81.37 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

611 kBTransfer

727 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

11 Console Messages

Security Headers

Indicators

restoremetamask.io Open in urlscan Pro
104.21.81.37 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

611 kB
Transfer

727 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!