metamask.com-im.com Open in urlscan Pro
2606:4700:3035::ac43:90c9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://metamask.com-im.com/
Effective URL:
https://metamask.com-im.com/
Submission: On April 05 via automatic, source openphish (April 5th 2024, 1:08:33 pm UTC) — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::ac43:90c9, located in United States and belongs to CLOUDFLARENET, US. The main domain is metamask.com-im.com.
TLS certificate: Issued by GTS CA 1P5 on April 5th 2024. Valid for: 3 months.

This is the only time metamask.com-im.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
12	2606:4700:303... 2606:4700:3035::ac43:90c9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:212... 2600:9000:2127:8c00:12:94b3:c380:93a1	16509 (AMAZON-02) (AMAZON-02)
13	2

12 2606:4700:3035::ac43:90c9 (United States)

ASN13335 (CLOUDFLARENET, US)

metamask.com-im.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:8c00:12:94b3:c380:93a1 (United States)

ASN16509 (AMAZON-02, US)

images.ctfassets.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	com-im.com metamask.com-im.com	445 KB
1	ctfassets.net images.ctfassets.net — Cisco Umbrella Rank: 3656	1 KB
13	2

	Domain	Requested by
12	metamask.com-im.com	metamask.com-im.com
1	images.ctfassets.net	metamask.com-im.com
13	2

This site contains no links.

Subject Issuer	Validity	Valid
com-im.com GTS CA 1P5	`2024-04-05` - `2024-07-04`	3 months	crt.sh
images.ctfassets.net Amazon RSA 2048 M02	`2023-12-19` - `2025-01-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://metamask.com-im.com/
Frame ID: FA45AABE7EDF8186249329FF6D01B5B7
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MetaMask

Page URL History Show full URLs

http://metamask.com-im.com/ HTTP 307
https://metamask.com-im.com/ Page URL

Detected technologies

Contentful (CMS) Expand

Overall confidence: 100%
Detected patterns

<[^>]+(?:https?:)?//(?:assets|downloads|images|videos)\.(?:ct?fassets\.net|contentful\.com)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

446 kB
Transfer

1129 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://metamask.com-im.com/ HTTP 307
https://metamask.com-im.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
metamask.com-im.com/
Redirect Chain

http://metamask.com-im.com/
https://metamask.com-im.com/

8 KB
3 KB

698ms
636ms

Document
text/html

2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d0bb0ff1983c226ee76cc1028989f5553cc604c557cfe28be39f9f32061b7e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86f9c45da8041c20-FRA
content-encoding: br
content-type: text/html
date: Fri, 05 Apr 2024 13:08:29 GMT
last-modified: Fri, 05 Apr 2024 07:59:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0EMYl40KFFmexHDEN7kqlq1ydgusnhqXFmYa6kMMNqvUMMfrduRXfif%2B6AtFij6vTkP3%2BXG0q11uipgWYds3hlt4uVsrFLCXdxk0thp%2BBPf6vPXitYqAR3vfIxzfIBQUnIGDHVBqv0ZuDMymyM0D5TAR"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

Location: https://metamask.com-im.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 normalize.css
metamask.com-im.com/css/ 8 KB
3 KB 87ms
87ms Stylesheet
text/css 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/css/normalize.css

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d183922bcde868eac542471b9f6718979729d93c91173670a5b7530eafaed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27751
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: W/"65fc1160-1e5e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2sPx%2B5AfhXdneq0lTBcVTQlFs9xTV%2BJ3K8AxKwhLm1kYV4uWqh2pwzyehSntvwv9Ro4ej0EFq138GMiQcSIhfzjqZDkGmMRlfD81XiYhdjvNOIntHlSwYcMpCZhtAvFSnZog%2Fg223klk65RcuGt%2FPrG"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 86f9c461acc400bb-CDG
expires: Fri, 05 Apr 2024 17:25:58 GMT

GET
H3 200 webflow.css
metamask.com-im.com/css/ 36 KB
9 KB 88ms
87ms Stylesheet
text/css 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/css/webflow.css

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a53e61ff37774f7da481d6b3066d64c6efc799012dd13e9e78959cd086b128e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27751
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: W/"65fc1160-91be"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OTBazz3mEDQIIrV5sIk8IpcWB1nZ5JW9fV3G%2FHoWVfka5wVVQrDxaKj6R3QTdj0lgwiCKeVauUUw%2FbKYfKIr7FgAXd7U%2FqGcB4K0EP3Z9aQWGLyysZ%2BZzRZQx3rjgfAGXnrBmpdv8WLNAdiHvOV%2BzAk5"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 86f9c461bcc600bb-CDG
expires: Fri, 05 Apr 2024 17:25:58 GMT

GET
H3 200 metamask-staging-2.webflow.css
metamask.com-im.com/css/ 138 KB
20 KB 88ms
88ms Stylesheet
text/css 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/css/metamask-staging-2.webflow.css

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38bf9a28cafa5891d0ce9f9dff95cdcf8723f7faf3940f2b7cd895006f3170a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27751
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: W/"65fc1160-226b7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XRUS07E1Ok5nMBEW%2Fb3Gg0xJdvM5ejUNiK3V2pvQI5XZJ1uw%2B2bIcoZzBhxRKnQi7ExT1SZVBcLxc480rPFsKhXBMEplAHttjh6kR97EC2G1Gcu7F8Ghbb5LRw1r%2Bb9UrSpITr2zDaPlycaHH4ufIbUx"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 86f9c461bcc800bb-CDG
expires: Fri, 05 Apr 2024 17:25:58 GMT

GET
H3 200 mm-logo.svg
metamask.com-im.com/img/ 12 KB
4 KB 127ms
127ms Image
image/svg+xml 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metamask.com-im.com/img/mm-logo.svg

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4153
etag: W/"65fc1160-2ef3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RDnTkf3Q0xt2y9Rpm24V66Yw4mvAQvLDoHfsFYsJYzw2qcUqFSgR3%2FHxjS5nWW1tt8%2FlGuwrllaNB8Oy3TIn1Rz0HEFPv8g31N2zJIe%2FnhPEPm7ZKhzrPU0F7KPURNPtfLnDYy%2FIFG3Tr%2BTb3JEzjU32"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 86f9c461bcca00bb-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 home-hero.webp
metamask.com-im.com/img/ 30 KB
31 KB 48ms
48ms Image
image/webp 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metamask.com-im.com/img/home-hero.webp

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4859eadd0825cf4fbc2060497489eed4a7f0bd6af0b95ed0e341f13c7b974e13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3339
alt-svc: h3=":443"; ma=86400
content-length: 31204
last-modified: Tue, 02 Apr 2024 06:45:36 GMT
server: cloudflare
etag: "660ba990-79e4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F9zDhRQVLxovhUqgm6GkdAZ3QK7uyi40OU2x3NTfNCMkz6ZCBpqg6W%2F6gDl4g%2FF30cLqlPwmviXuFncfSvO63uZRMkJIbdmoFdb0QbHyiMxTzs1eqGY8hTaV8nUXBX8xocRC33VNyA362dU2CE%2FgmQDg"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86f9c461bccb00bb-CDG

GET
H3 200 Portfolio2x.webp
metamask.com-im.com/img/ 184 KB
185 KB 114ms
114ms Image
image/webp 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metamask.com-im.com/img/Portfolio2x.webp

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9562e09ea4cb98e5b5a61b8249d013ae671da347c90ea86e652357e3cbc16405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3339
alt-svc: h3=":443"; ma=86400
content-length: 188788
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: "65fc1160-2e174"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l60LKd2C7CBBS3JZWedrp15SlDvECL4tGxpHZuX62GC9TN28Xicqhv%2BhsFzSS3CRaawzelccLqIeMudp%2FGrz8Za0IOxqTDJ4xmiT4PHVNf56m8NoX8ps679lQw217e95gYkiZYKhCp3n2i8yQb4rEdRD"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86f9c461cce100bb-CDG

GET
H3 200 Explore-illo.svg
metamask.com-im.com/img/ 36 KB
13 KB 192ms
192ms Image
image/svg+xml 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metamask.com-im.com/img/Explore-illo.svg

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3055
etag: W/"65fc1160-8fe3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VyR%2BTTz4JYFN22drBDBUnCE0SRO%2By8nUjCyaDJW0ZO2AsPM%2FJ5PvZKF0Fxlfi%2Blt1RtpSQrSDprl%2BjfEajLuGTrLJ9osh9OcwZFTeG28h56uDud%2FaaoJQJqPMEESqtzK%2FiUX9OZcokSIKk9GuEnVtJsK"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 86f9c461cce200bb-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
metamask.com-im.com/js/ 87 KB
32 KB 193ms
193ms Script
application/javascript 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/js/jquery-3.5.1.min.dc5e7f18c8.js

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09e81f39f8633d993573f4c9a0d6524c3ef7ce4fb2f944ee128cd2df2609c9d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27751
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: W/"65fc1160-15d86"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4zD6UeyISwz12RZvRt6UICxmDul0%2F7TY1A7MH0MbgCkF5UMvvY7MK%2Bb3hXRcnDBRuLahz3WCfQOyvBHFyooY01%2FOHfd3Jo%2FL%2BNmjDetgffSmmfSyozu0KX9vSR9ObOJInaVwA2eypWyz0RzOrnz8ogK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 86f9c461cce300bb-CDG
expires: Fri, 05 Apr 2024 17:25:58 GMT

GET
H3 200 webflow.js Show response
metamask.com-im.com/js/ 587 KB
144 KB 195ms
194ms Script
application/javascript 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metamask.com-im.com/js/webflow.js

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5643a8b61eea5d7e6268faf715e821f859e9d37d29dac71a2d5118e72b172e9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27751
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
server: cloudflare
etag: W/"65fc1160-92c12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2BKbsQCQlq5%2BENmPErUhMsE8mkVj46gKKVvqP2EXFNlkeLDHiiTQ3t64MWtdWnuPN1znvL1PERuLiYEDNktbMoyWrCFN8VJBhFZAyyvDgWx%2Bg7BTUuhtcC3LhnL1dPwl1ziTWXCuh0tKyQ1wKtutqOTF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 86f9c461cce400bb-CDG
expires: Fri, 05 Apr 2024 17:25:58 GMT

GET
H3 200 Google_Play_Icon.svg
metamask.com-im.com/img/ 802 B
865 B 110ms
109ms Image
image/svg+xml 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metamask.com-im.com/img/Google_Play_Icon.svg

Requested by

Host: metamask.com-im.com
URL: https://metamask.com-im.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e6c77e2f5f29ea4d48e8ddae2430b14ca55c9842ad4318a93ae3dea95abba50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Mar 2024 10:52:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3338
etag: W/"65fc1160-322"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ER6lPzRVtPZLQRnn5EgwHdi3gWoNDke8JpUQdCJQXw92yGr8RhZpqbzdkehOel8cxtk8GyQbNdDr8dg63i17NS1dSPzItQ4MFbFc6xwjg10x4Gc%2B%2FhJeYmlE0S5j8iZs6IA02nFzHSngTLf7Yyg2NQBg"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 86f9c4628d9e00bb-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 Apple_logo.svg
images.ctfassets.net/9sy2a0egs6zh/4PZXha3etCmNOpkqq8ug0Q/47b13e10186274e403d5906007ae06a1/ 1 KB
1 KB 94ms
28ms Image
image/svg+xml 2600:9000:2127:8c00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/9sy2a0egs6zh/4PZXha3etCmNOpkqq8ug0Q/47b13e10186274e403d5906007ae06a1/Apple_logo.svg
Requested by: Host: metamask.com-im.com
URL: https://metamask.com-im.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:8c00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: 9667fb8170bb18a0940265dce0beebdc3476d6a63988b6d40aa3e0b0f3493996

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 04:15:02 GMT
content-encoding: gzip
via: 1.1 d33f640b9793fb0553cc6dbe55988068.cloudfront.net (CloudFront)
last-modified: Thu, 02 Jun 2022 07:54:18 GMT
server: Contentful Images API
x-amz-cf-pop: PRG50-C1
age: 32008
etag: W/"cbed55ec25a077930c077e5b8b385269"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-id: KGW83GE-vEGCWIVMUiUYoEA_NkwM_5evQlUs-B6J_gxCBXoX_Onbxw==

GET
H3 404 favicon.ico
metamask.com-im.com/ 548 B
580 B 434ms
434ms Other
text/html 2606:4700:3035::ac43:90c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metamask.com-im.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:90c9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://metamask.com-im.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 13:08:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=et9JiMj01%2BOOzUdSHL%2BkP932Wjq5dH6BWVoSXOlPzlF%2BTuFviUJaMZQ%2BJLP9fHFeEk32jIh85qWsLYSVIS%2B%2B1jMa7T2GZYr6FLxs7wb4qpFXq3WBd%2BuISsQqmO%2FMhJHxXfNRSdrvwIpE4nI8pDaZMZXw"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 86f9c4637e7f00bb-CDG
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://metamask.com-im.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images.ctfassets.net
metamask.com-im.com
2600:9000:2127:8c00:12:94b3:c380:93a1
2606:4700:3035::ac43:90c9
09e81f39f8633d993573f4c9a0d6524c3ef7ce4fb2f944ee128cd2df2609c9d9
2e6c77e2f5f29ea4d48e8ddae2430b14ca55c9842ad4318a93ae3dea95abba50
38bf9a28cafa5891d0ce9f9dff95cdcf8723f7faf3940f2b7cd895006f3170a4
4859eadd0825cf4fbc2060497489eed4a7f0bd6af0b95ed0e341f13c7b974e13
5643a8b61eea5d7e6268faf715e821f859e9d37d29dac71a2d5118e72b172e9d
5d0bb0ff1983c226ee76cc1028989f5553cc604c557cfe28be39f9f32061b7e7
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
65d183922bcde868eac542471b9f6718979729d93c91173670a5b7530eafaed9
8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5
9562e09ea4cb98e5b5a61b8249d013ae671da347c90ea86e652357e3cbc16405
9667fb8170bb18a0940265dce0beebdc3476d6a63988b6d40aa3e0b0f3493996
a53e61ff37774f7da481d6b3066d64c6efc799012dd13e9e78959cd086b128e9
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

metamask.com-im.com Open in urlscan Pro 2606:4700:3035::ac43:90c9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

446 kBTransfer

1129 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

metamask.com-im.com Open in urlscan Pro
2606:4700:3035::ac43:90c9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

446 kB
Transfer

1129 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!