www.metamasak.com
Open in
urlscan Pro
2606:4700:3033::ac43:d2b9
Malicious Activity!
Public Scan
Submission: On February 22 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 17th 2021. Valid for: a year.
This is the only time www.metamasak.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 2606:4700:303... 2606:4700:3033::ac43:d2b9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 35.157.83.47 35.157.83.47 | 16509 (AMAZON-02) (AMAZON-02) | |
15 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-83-47.eu-central-1.compute.amazonaws.com
api.ipdata.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
metamasak.com
www.metamasak.com |
446 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 401 |
47 KB |
1 |
ipdata.co
api.ipdata.co — Cisco Umbrella Rank: 31724 |
883 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 546 |
30 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2202 |
7 KB |
15 | 5 |
Domain | Requested by | |
---|---|---|
10 | www.metamasak.com |
www.metamasak.com
|
2 | cdn.jsdelivr.net |
www.metamasak.com
|
1 | api.ipdata.co |
www.metamasak.com
|
1 | code.jquery.com |
www.metamasak.com
|
1 | stackpath.bootstrapcdn.com |
www.metamasak.com
|
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-12-17 - 2022-12-16 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
api.ipdata.co Amazon |
2021-11-20 - 2022-12-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.metamasak.com/import-with-seed-phrase/
Frame ID: B5A88E0408A8ED61343FF11141ADE021
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
MetamaskDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.metamasak.com/import-with-seed-phrase/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
www.metamasak.com/import-with-seed-phrase/assets/ |
761 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-rtl.css
www.metamasak.com/import-with-seed-phrase/assets/ |
760 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.metamasak.com/import-with-seed-phrase/assets/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.0/dist/js/ |
78 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.04b17ac7.chunk.css
www.metamasak.com/import-with-seed-phrase/static/css/ |
1 KB 873 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.b7b07ee9.chunk.js
www.metamasak.com/import-with-seed-phrase/static/js/ |
1 MB 302 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.5e64371b.chunk.js
www.metamasak.com/import-with-seed-phrase/static/js/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipdata.co/ |
1 KB 883 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
metamask-logo-horizontal.svg
www.metamasak.com/import-with-seed-phrase/assets/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webclip.png
www.metamasak.com/import-with-seed-phrase/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
EuclidCircularB-Regular-WebXL.ttf
www.metamasak.com/fonts/Euclid/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone function| $ function| jQuery number| uidEvent object| bootstrap object| webpackJsonpgenerator object| regeneratorRuntime function| setImmediate function| clearImmediate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipdata.co
cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
www.metamasak.com
2001:4de0:ac18::1:a:3a
2606:4700:3033::ac43:d2b9
2606:4700::6810:5814
2606:4700::6812:acf
35.157.83.47
1e01e88329767a0518c5ec7f778de44d764deba674608022613c5caff8ecacec
27712ebee35bae5474f124f7cbf6cb2ca60d5121e561d284c9f11a4e69efd663
325d19f9a1f62ad82f9f382a877f42bf447c8cbb293dd7cd2c03cf3bcf2f146a
3ac57940f2faba2996711fd3d90dcce0d4066cd79a4f2539dd55583008c3094b
4871084616e04718198b20c76e9371cb980064794347aaab24ebb980cdce1b88
500a92dd3320de97b9be56f865fc8015a7841a8eaa06f7d8819241f3130e6d4c
62f9855fd6cded97e4b42988cb12e66998cea53b044b2b506a20070b8d9e89a2
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
98d3906cce6aab8c9025c56eb563ae52f168c2ad675931dce0da883b74d65c02
99bcd1665acb58ad305f529ebfcbff2f6303e80c12ae398606615dff936c06a7
a2779239ae69999a04e2e98ee5be8a282a21b41b7b4c6ce00c881ecc82fcaa50
c4e55edaeacbc9109cdb802f4abb0e4eb075ea697efbf6a58b7aa0c71a175a2b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e