2fa-myetherwallet.com
Open in
urlscan Pro
198.54.115.228
Malicious Activity!
Public Scan
Effective URL: https://2fa-myetherwallet.com/
Submission: On January 07 via api from US
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on January 4th 2019. Valid for: a year.
This is the only time 2fa-myetherwallet.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: MyEtherWallet (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 198.54.115.228 198.54.115.228 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
7 | 1 |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server221-3.web-hosting.com
2fa-myetherwallet.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
2fa-myetherwallet.com
1 redirects
2fa-myetherwallet.com |
3 MB |
7 | 1 |
Domain | Requested by | |
---|---|---|
8 | 2fa-myetherwallet.com |
1 redirects
2fa-myetherwallet.com
|
7 | 1 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
2fa-myetherwallet.com COMODO RSA Domain Validation Secure Server CA |
2019-01-04 - 2020-01-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://2fa-myetherwallet.com/
Frame ID: 174F8F038CD188697B260D2D90D33475
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://2fa-myetherwallet.com/
HTTP 301
https://2fa-myetherwallet.com/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- env /^angular$/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
28 Outgoing links
These are links going to different origins than the main page.
Title: Knowledge Base
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Swap ETH/BTC/EUR/CHF via Bity.com
Search URL Search Domain Scan URL
Title: Buy ETH with credit card via Simplex
Search URL Search Domain Scan URL
Title: Ledger Wallet
Search URL Search Domain Scan URL
Title: TREZOR
Search URL Search Domain Scan URL
Title: BitBox
Search URL Search Domain Scan URL
Title: ether.card
Search URL Search Domain Scan URL
Title: HODL Wallet
Search URL Search Domain Scan URL
Title: Billfodl
Search URL Search Domain Scan URL
Title: 0xDECAF9CD2367cdbb726E904cD6397eDFcAe6068D
Search URL Search Domain Scan URL
Title: 1DECAF2uSpFTP4L1fAHR8GCLrPqdwdLse9
Search URL Search Domain Scan URL
Title: MyEtherWallet.com
Search URL Search Domain Scan URL
Title: MyEtherWallet Team
Search URL Search Domain Scan URL
Title: Unit Converters & ENS Debugging
Search URL Search Domain Scan URL
Title: Sign Message
Search URL Search Domain Scan URL
Title: kvhnuke.github.io/etherwallet
Search URL Search Domain Scan URL
Title: Github: Current Site & CX
Search URL Search Domain Scan URL
Title: Github: Latest Release
Search URL Search Domain Scan URL
Title: MyEtherWallet Chrome Extension
Search URL Search Domain Scan URL
Title: EAL "Don't Get Phish'd" Chrome Extension
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://2fa-myetherwallet.com/
HTTP 301
https://2fa-myetherwallet.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
2fa-myetherwallet.com/ Redirect Chain
|
20 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
etherwallet-master.min.css
2fa-myetherwallet.com/css/ |
133 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
etherwallet-static.min.js
2fa-myetherwallet.com/js/ |
26 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
etherwallet-master.js
2fa-myetherwallet.com/js/ |
9 MB 2 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-myetherwallet.svg
2fa-myetherwallet.com/images/ |
6 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Lato-Light.woff
2fa-myetherwallet.com/fonts/ |
304 KB 304 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Lato-Regular.woff
2fa-myetherwallet.com/fonts/ |
302 KB 302 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: MyEtherWallet (Crypto Exchange)48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| QRCode object| blockies function| Modal object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| angular object| xssFilters object| hd function| BigNumber function| marked object| ethUtil function| format object| browser function| Wallet function| Web3Wallet function| Token function| globalFuncs function| uiFuncs function| etherUnits function| ajaxReq function| nodes function| ethFuncs function| Validator function| bity function| kyber function| ens function| domainsale function| Ledger3 function| ledgerEth function| TrezorConnect function| DigitalBitboxUsb function| DigitalBitboxEth function| SecalotUsb function| SecalotEth function| MewConnectEth function| MewConnect object| CustomGasMessages0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2fa-myetherwallet.com
198.54.115.228
26a6ff34ce41f9fed07af3ca773a4a817aa8679fbe39a2e166d69263a99efbc9
4a6293651750085922986a1391e10b2140d8a79914f989d3c2cd1a5ae0db502b
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
e70b729220ecc690e854c94df3c95506b2a8fde23999e95dd216c48af60a8da3
e74cf550f9ba8f374e026115e0f4298c242e0d79d214f4e27ba765251139bdb8
fbdf018eb65935a807fff8250797d6fae53a59bdf701b2c7280964eeb574be7d
fe36915d3a9f4876f42d2c51242d603a4e6da3e086ae10fcd88e3c19ae0d0621