urlscan.io logo urlscan.io
SecurityTrails logo

metamask-extension.shjworks.dk Open in urlscan Pro
2a02:2350:5:106:80c5:c5b7:b5a8:7571  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.re.adri.al/mzainea
Effective URL: https://metamask-extension.shjworks.dk/crypto/meta/finance/
Submission: On October 29 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 4 countries across 5 domains to perform 4 HTTP transactions. The main IP is 2a02:2350:5:106:80c5:c5b7:b5a8:7571, located in Denmark and belongs to ONECOM, DK. The main domain is metamask-extension.shjworks.dk.
TLS certificate: Issued by R3 on September 13th 2022. Valid for: 3 months.
This is the only time metamask-extension.shjworks.dk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
1 1 2a04:27c0:fff... 197706 (KEMINET k...)
1 1 213.159.63.54 21211 (PENKI-AS ...)
2 2 2001:41d0:1:1... 16276 (OVH)
4 2a02:2350:5:1... 51468 (ONECOM)
4 2
Apex Domain
Subdomains		 Transfer
4 shjworks.dk
metamask-extension.shjworks.dk
221 KB
2 diam-net.fr
www.diam-net.fr
254 B
1 gyvunugloba.lt
www.gyvunugloba.lt
276 B
1 adri.al
www.re.adri.al
305 B
0 Failed
function sub() { [native code] }. Failed
4 5
Domain Requested by
4 metamask-extension.shjworks.dk metamask-extension.shjworks.dk
2 www.diam-net.fr 2 redirects
1 www.gyvunugloba.lt 1 redirects
1 www.re.adri.al 1 redirects
0 truncated Failed metamask-extension.shjworks.dk
4 5

This site contains no links.

Subject Issuer Validity Valid
*.shjworks.dk
R3		 2022-09-13 -
2022-12-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://metamask-extension.shjworks.dk/crypto/meta/finance/
Frame ID: 3BF4CE2494AC86F0E01866276354D98F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

A crypto wallet &gateway to blockchain apps | MetaMask

Page URL History Show full URLs

  1. https://www.re.adri.al/mzainea HTTP 301
    https://www.gyvunugloba.lt/url.php?url=https://www.diam-net.fr/wp-includes/ID3/ID HTTP 302
    https://www.diam-net.fr/wp-includes/ID3/ID HTTP 301
    https://www.diam-net.fr/wp-includes/ID3/ID/ HTTP 302
    https://metamask-extension.shjworks.dk/crypto/meta/finance/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+(?:https?:)?//(?:assets|downloads|images|videos)\.(?:ct?fassets\.net|contentful\.com)
Overall confidence: 100%
Detected patterns
  • <[^>]+data-react
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

2
IPs

4
Countries

221 kB
Transfer

323 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.re.adri.al/mzainea HTTP 301
    https://www.gyvunugloba.lt/url.php?url=https://www.diam-net.fr/wp-includes/ID3/ID HTTP 302
    https://www.diam-net.fr/wp-includes/ID3/ID HTTP 301
    https://www.diam-net.fr/wp-includes/ID3/ID/ HTTP 302
    https://metamask-extension.shjworks.dk/crypto/meta/finance/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
metamask-extension.shjworks.dk/crypto/meta/finance/
Redirect Chain
  • https://www.re.adri.al/mzainea
  • https://www.gyvunugloba.lt/url.php?url=https://www.diam-net.fr/wp-includes/ID3/ID
  • https://www.diam-net.fr/wp-includes/ID3/ID
  • https://www.diam-net.fr/wp-includes/ID3/ID/
  • https://metamask-extension.shjworks.dk/crypto/meta/finance/
45 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://metamask-extension.shjworks.dk/crypto/meta/finance/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:2350:5:106:80c5:c5b7:b5a8:7571 , Denmark, ASN51468 (ONECOM, DK),
Reverse DNS
Software
Apache / PHP/8.0.25
Resource Hash
d591250cdaa04901c420c028edef49c1dc4332447f8373910bee806854463ca2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
content-encoding
gzip
content-length
8784
content-type
text/html; charset=UTF-8
date
Sat, 29 Oct 2022 18:08:43 GMT
server
Apache
vary
Accept-Encoding,User-Agent
via
1.1 webcache2 (Varnish/trunk)
x-powered-by
PHP/8.0.25
x-varnish
820872045

Redirect headers

content-type
text/html
date
Sat, 29 Oct 2022 18:08:43 GMT
location
https://metamask-extension.shjworks.dk/crypto/meta/finance/
server
Apache
x-powered-by
PHP/5.4
jquery.min.js
metamask-extension.shjworks.dk/crypto/meta/finance/asset/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://metamask-extension.shjworks.dk/crypto/meta/finance/asset/jquery.min.js
Requested by
Host: metamask-extension.shjworks.dk
URL: https://metamask-extension.shjworks.dk/crypto/meta/finance/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:2350:5:106:80c5:c5b7:b5a8:7571 , Denmark, ASN51468 (ONECOM, DK),
Reverse DNS
Software
Apache /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask-extension.shjworks.dk/crypto/meta/finance/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 18:08:45 GMT
content-encoding
gzip
via
1.1 webcache2 (Varnish/trunk)
last-modified
Fri, 28 Oct 2022 15:25:15 GMT
server
Apache
age
0
etag
"15d84-5ec19dd52e7bd-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
x-varnish
820872046
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
30910
mm-logo.svg
metamask-extension.shjworks.dk/crypto/meta/finance/asset/ 		12 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metamask-extension.shjworks.dk/crypto/meta/finance/asset/mm-logo.svg
Requested by
Host: metamask-extension.shjworks.dk
URL: https://metamask-extension.shjworks.dk/crypto/meta/finance/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:2350:5:106:80c5:c5b7:b5a8:7571 , Denmark, ASN51468 (ONECOM, DK),
Reverse DNS
Software
Apache /
Resource Hash
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask-extension.shjworks.dk/crypto/meta/finance/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 18:08:45 GMT
content-encoding
gzip
via
1.1 webcache2 (Varnish/trunk)
last-modified
Fri, 28 Oct 2022 15:25:22 GMT
server
Apache
age
0
etag
"2ef3-5ec19ddc04aaf-gzip"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
x-varnish
820872047
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
3369
hero2.2.png
metamask-extension.shjworks.dk/crypto/meta/finance/asset/ 		178 KB
179 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metamask-extension.shjworks.dk/crypto/meta/finance/asset/hero2.2.png
Requested by
Host: metamask-extension.shjworks.dk
URL: https://metamask-extension.shjworks.dk/crypto/meta/finance/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:2350:5:106:80c5:c5b7:b5a8:7571 , Denmark, ASN51468 (ONECOM, DK),
Reverse DNS
Software
Apache /
Resource Hash
8219d614dac0bfcd872cc52b1c919351b4bc1fa8d5850fbb3b9d5f751411e459

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://metamask-extension.shjworks.dk/crypto/meta/finance/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 18:08:45 GMT
via
1.1 webcache2 (Varnish/trunk)
last-modified
Fri, 28 Oct 2022 15:25:13 GMT
server
Apache
age
0
etag
"2c942-5ec19dd357c9f"
vary
User-Agent
content-type
image/png
x-varnish
820872048
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
182594
truncated
/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
truncated
URL
data:truncated

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: data:application/x-font-ttf;charset=utf-8;
Message:
Failed to load resource: net::ERR_INVALID_URL