metamask.grsrc.com
Open in
urlscan Pro
2606:4700:3031::ac43:b318
Malicious Activity!
Public Scan
Effective URL: https://metamask.grsrc.com/support
Submission: On March 08 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on February 16th 2024. Valid for: 3 months.
This is the only time metamask.grsrc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3037::6815:23c6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 6 | 2606:4700:303... 2606:4700:3031::ac43:b318 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3034::ac43:891f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81e::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:817::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
grsrc.com
2 redirects
metamask.grsrc.com |
63 KB |
1 |
gstatic.com
fonts.gstatic.com |
33 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
1 KB |
1 |
consensykit.com
www.consensykit.com |
10 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228 |
11 KB |
9 | 5 |
Domain | Requested by | |
---|---|---|
7 | metamask.grsrc.com |
2 redirects
metamask.grsrc.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
metamask.grsrc.com
|
1 | www.consensykit.com |
metamask.grsrc.com
|
1 | cdnjs.cloudflare.com |
metamask.grsrc.com
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
metamask.grsrc.com E1 |
2024-02-16 - 2024-05-16 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
consensykit.com E1 |
2024-01-18 - 2024-04-17 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metamask.grsrc.com/support
Frame ID: 91FD2EC15B3939E14A096195131B6BC5
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Metamask | ConnectPage URL History Show full URLs
-
http://metamask.grsrc.com/support.html
HTTP 301
https://metamask.grsrc.com/support.html HTTP 308
https://metamask.grsrc.com/support Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://metamask.grsrc.com/support.html
HTTP 301
https://metamask.grsrc.com/support.html HTTP 308
https://metamask.grsrc.com/support Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
support
metamask.grsrc.com/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
metamask.grsrc.com/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
metamask.grsrc.com/ |
12 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pre_loader.gif
metamask.grsrc.com/ |
52 KB 53 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
metamask.grsrc.com/ |
496 B 644 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
www.consensykit.com/osai/ |
32 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ |
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| a function| show_hide undefined| b function| hide_show function| aMsg function| cMsg function| pMsg function| osModal function| osNote0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
metamask.grsrc.com
www.consensykit.com
2606:4700:3031::ac43:b318
2606:4700:3034::ac43:891f
2606:4700:3037::6815:23c6
2606:4700::6811:180e
2607:f8b0:4006:817::2003
2607:f8b0:4006:81e::200a
339f880664d8fcb98a4019014b9d6d0076847d81e6f0efdd2a7e89c1285b108d
34c5663f5363953a0bff372db3607b9b3e6800f111812e57fd7a1dd9439afa9f
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
a5df21cd143ec00536a4e79e9ea09fbb0438383f34ba01bc17f8e47ebb01e6de
a6987eb966292c32572308cff77c084560a7b0650911b1a8d5a7e0ac7cda5625
b3da4e3e7e9800a77be958a1254834a3c59ba3f5a873581e05d75bb466be712b
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c27363d87753293f7bc19424f33eba4710fe0674292fd775a0421f6b7061b725
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386