urlscan.io logo urlscan.io
SecurityTrails logo

omb.finance Open in urlscan Pro
185.66.88.220  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://omb.finance/metamask/index.html
Submission: On February 14 via manual from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 185.66.88.220, located in Ukraine and belongs to YURTEH-AS, UA. The main domain is omb.finance.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 8th 2021. Valid for: 3 months.
This is the only time omb.finance was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
8 185.66.88.220 30860 (YURTEH-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
9 2
Apex Domain
Subdomains		 Transfer
8 omb.finance
omb.finance
798 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 197
28 KB
9 2
Domain Requested by
8 omb.finance omb.finance
1 cdnjs.cloudflare.com omb.finance
9 2

This site contains no links.

Subject Issuer Validity Valid
omb.finance
cPanel, Inc. Certification Authority		 2021-12-08 -
2022-03-09		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://omb.finance/metamask/index.html
Frame ID: 75586571BBEE6373837A3C31A8D10949
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

MetaMask

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

826 kB
Transfer

881 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.html
omb.finance/metamask/ 		444 KB
444 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
71888af2a1e1bbac2b12a4a9806bcc32177ae562edb43838e902f9cd8d4c71b7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
nginx
Date
Mon, 14 Feb 2022 19:46:23 GMT
Content-Type
text/html
Content-Length
454470
Connection
keep-alive
Last-Modified
Wed, 01 Dec 2021 03:30:34 GMT
Accept-Ranges
bytes
font-awesome.min.css
omb.finance/metamask/fonts/Font_Awesome/ 		26 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://omb.finance/metamask/fonts/Font_Awesome/font-awesome.min.css
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/metamask/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:23 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
26711
Content-Type
text/css
metamask-fox.svg
omb.finance/metamask/image/logo/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://omb.finance/metamask/image/logo/metamask-fox.svg
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/metamask/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:24 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8786
Content-Type
image/svg+xml
spinner.gif
omb.finance/metamask/image/ 		72 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://omb.finance/metamask/image/spinner.gif
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/metamask/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:24 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73625
Content-Type
image/gif
metamask-logo-horizontal.svg
omb.finance/metamask/images/logo/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://omb.finance/metamask/images/logo/metamask-logo-horizontal.svg
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/metamask/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:24 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9538
Content-Type
image/svg+xml
metamask-fox.svg
omb.finance/metamask/images/logo/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://omb.finance/metamask/images/logo/metamask-fox.svg
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/metamask/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:24 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8786
Content-Type
image/svg+xml
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ 		85 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: omb.finance
URL: https://omb.finance/metamask/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://omb.finance/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 19:46:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
130728
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27433
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-1538f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MKVJtXq81lCQUWmv6pPxMH66LTOElwlQJQ9WH%2BqfYHuE6l5NBHlv564JkryObQJLVVTX9PEF2Q6o7v9Fbo45rGsrKzveaflKZxwWrdrsZyANC57jrEBsqC51ce007ZY1uGrYb0QW3Xn4M7IYgnyONl3K"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6dd8cd640aa17139-YUL
expires
Sat, 04 Feb 2023 19:46:24 GMT
EuclidCircularB-Regular-WebXL.ttf
omb.finance/metamask/fonts/Euclid/ 		151 KB
151 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://omb.finance/metamask/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c

Request headers

Referer
https://omb.finance/metamask/index.html
Origin
https://omb.finance
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:25 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
154192
Content-Type
font/ttf
fa-solid-900.woff2
omb.finance/metamask/fonts/fontawesome/ 		78 KB
78 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://omb.finance/metamask/fonts/fontawesome/fa-solid-900.woff2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.66.88.220 , Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
dedicated.vsys.host
Software
nginx /
Resource Hash
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Referer
https://omb.finance/metamask/index.html
Origin
https://omb.finance
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 14 Feb 2022 19:46:25 GMT
Last-Modified
Fri, 23 Apr 2021 09:06:18 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
79444
Content-Type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| $ function| jQuery function| googleanalytics boolean| p

0 Cookies