metamask-loginf.webflow.io Open in urlscan Pro
172.64.151.8  Malicious Activity! Public Scan

URL: https://metamask-loginf.webflow.io/
Submission: On December 08 via automatic, source phishtank — Scanned from FI

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 172.64.151.8, located in San Francisco, United States and belongs to CLOUDFLARENET, US. The main domain is metamask-loginf.webflow.io.
TLS certificate: Issued by WE1 on October 13th 2024. Valid for: 3 months.
This is the only time metamask-loginf.webflow.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
1 172.64.151.8 13335 (CLOUDFLAR...)
4 172.64.153.109 13335 (CLOUDFLAR...)
2 18.244.20.134 16509 (AMAZON-02)
1 2600:9000:225... 16509 (AMAZON-02)
8 4
Domain Requested by
4 uploads-ssl.webflow.com metamask-loginf.webflow.io
2 d3e54v103j8qbb.cloudfront.net metamask-loginf.webflow.io
1 d1otoma47x30pg.cloudfront.net
1 metamask-loginf.webflow.io
8 4

This site contains links to these domains. Also see Links.

Domain
lancensegentions.com
webflow.com
Subject Issuer Validity Valid
webflow.io
WE1
2024-10-13 -
2025-01-11
3 months crt.sh
uploads-ssl.webflow.com
WE1
2024-11-23 -
2025-02-21
3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2024-07-30 -
2025-07-03
a year crt.sh

This page contains 1 frames:

Primary Page: https://metamask-loginf.webflow.io/
Frame ID: 67F746A84DE17A52E56910324DA64AE8
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

MetaMask Login - A Crypto Wallet & Gateway To Blockchain Apps

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

90 kB
Transfer

198 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
metamask-loginf.webflow.io/
3 KB
2 KB
Document
General
Full URL
https://metamask-loginf.webflow.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.151.8 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af9d2b6863eb7922c6e8384292fcb42811228c669fab305acaf414089505816
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
HIT
cf-ray
8eef471928f395f6-ARN
content-encoding
gzip
content-security-policy
frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com
content-type
text/html
date
Sun, 08 Dec 2024 19:49:16 GMT
last-modified
Sun, 08 Dec 2024 17:36:52 GMT
priority
u=0,i
server
cloudflare
server-timing
cfExtPri
surrogate-control
43200
surrogate-key
metamask-loginf.webflow.io 61b967d6979a8b613298caf1 pageId:61b967d6979a8b0dcb98caf2
vary
Accept-Encoding
metamask-loginf.webflow.6cbb76675.css
uploads-ssl.webflow.com/61b967d6979a8b613298caf1/css/
32 KB
9 KB
Stylesheet
General
Full URL
https://uploads-ssl.webflow.com/61b967d6979a8b613298caf1/css/metamask-loginf.webflow.6cbb76675.css
Requested by
Host: metamask-loginf.webflow.io
URL: https://metamask-loginf.webflow.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.153.109 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc4d218136062c70c271de8a9233fdad552415b12ec1760898d6f701f21b7368

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
"7db5435d3621e8e5f4e7f3e31ba5711b"
x-amz-version-id
KmAkXTomCnXpVsP_674mkSO2XGbBF.Lw
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 08 Dec 2024 19:49:16 GMT
content-type
text/css
last-modified
Wed, 15 Dec 2021 04:05:20 GMT
vary
Accept-Encoding
priority
u=0,i=?0
x-amz-id-2
GU9wWIcaa7CA3IyMAqQkCBabxYaeJ0o+bR25U/i9oLfoAwhJN8BaBPzeImT/Yg08znWwwiB+UBo=
cache-control
max-age=84600, must-revalidate
x-amz-request-id
KYS8EZVFVFEDMZ9P
cf-ray
8eef471a9cdb82ca-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
8433
server
cloudflare
x-amz-server-side-encryption
AES256
jquery-3.5.1.min.dc5e7f18c8.js
d3e54v103j8qbb.cloudfront.net/js/
87 KB
31 KB
Script
General
Full URL
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=61b967d6979a8b613298caf1
Requested by
Host: metamask-loginf.webflow.io
URL: https://metamask-loginf.webflow.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.244.20.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-244-20-134.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://metamask-loginf.webflow.io
Referer
https://metamask-loginf.webflow.io/

Response headers

access-control-max-age
3000
content-encoding
gzip
etag
W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
age
83146
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
uzW65zUBmGBzen5wSfpvIcAD9wKBl2GR_L45yfz1FyYaoCStmwg1Kw==
date
Sat, 07 Dec 2024 20:43:34 GMT
content-type
application/javascript
last-modified
Mon, 20 Jul 2020 17:53:02 GMT
vary
accept-encoding
cache-control
max-age=84600, must-revalidate
via
1.1 1332d04637e8e8783a277613082f94d8.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P11
server
AmazonS3
webflow.f0a5689e5.js
uploads-ssl.webflow.com/61b967d6979a8b613298caf1/js/
36 KB
13 KB
Script
General
Full URL
https://uploads-ssl.webflow.com/61b967d6979a8b613298caf1/js/webflow.f0a5689e5.js
Requested by
Host: metamask-loginf.webflow.io
URL: https://metamask-loginf.webflow.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.153.109 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a776f6f4d8a6332ceed686dcc14076dfc856daf6467a0d611b61c98951d77c0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
"9f9e09bb5e990760480e628458109b86"
x-amz-version-id
ujZV_TZdniPAkTmsseHEuWCdmVUeJZYU
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 08 Dec 2024 19:49:16 GMT
content-type
text/javascript
last-modified
Wed, 15 Dec 2021 04:05:20 GMT
vary
Accept-Encoding
priority
u=1,i=?0
x-amz-id-2
j8ERGZzH0UOsbxMNubtg0hu8xqjC5xdXxkvV58pl95Gb46uPQ+impWJm0dOL93dMNRuIkPBb60d8lIUJn19q1VSjn4ex0lRvYCXjY7y1V+I=
cache-control
max-age=84600, must-revalidate
x-amz-request-id
KYS7D498SRJD7TKM
cf-ray
8eef471aacdc82ca-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
12825
server
cloudflare
x-amz-server-side-encryption
AES256
61b967fcd178ba8fed2012bd_Metamask-p-1600.jpeg
uploads-ssl.webflow.com/61b967d6979a8b613298caf1/
27 KB
28 KB
Image
General
Full URL
https://uploads-ssl.webflow.com/61b967d6979a8b613298caf1/61b967fcd178ba8fed2012bd_Metamask-p-1600.jpeg
Requested by
Host: metamask-loginf.webflow.io
URL: https://metamask-loginf.webflow.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.153.109 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2fb4a0dda6752ca1e957926508fe6a2bb3ed03c8fe1cf7877f225762205c2e5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

cf-bgj
h2pri
etag
"1b68c71d2a3e576390933c3a33056698"
x-amz-version-id
Fk0UMShgRcqLDBqAhpHyZ8ErnkoK93c8
cf-cache-status
HIT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 08 Dec 2024 19:49:16 GMT
content-type
image/jpeg
last-modified
Wed, 15 Dec 2021 03:59:10 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
X15iqmKQY6HR2EhkDpKwXFJFAFu9+c1dRN39kSD0KZHe3uarcox1OXwH2UtA5oHlOGrbtQJqCtw=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
KYS1Y8EER45QZB2E
cf-ray
8eef471c1e4782ca-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
28057
server
cloudflare
x-amz-server-side-encryption
AES256
webflow-badge-icon.f67cd735e3.svg
d3e54v103j8qbb.cloudfront.net/img/
754 B
1 KB
Image
General
Full URL
https://d3e54v103j8qbb.cloudfront.net/img/webflow-badge-icon.f67cd735e3.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.244.20.134 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-244-20-134.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

etag
"170ca9cdf8ca5789f23e395671b34510"
age
3745
x-cache
Hit from cloudfront
x-amz-cf-id
OpMXQiRFuRMzDytJB7SqiJt9pBCqP7uw4ESfu1zA4drOacLwJk7B2A==
date
Sun, 08 Dec 2024 18:46:52 GMT
content-type
image/svg+xml
vary
accept-encoding
last-modified
Thu, 05 Oct 2023 18:14:51 GMT
cache-control
max-age=84600, must-revalidate
via
1.1 9a614f9e49eb2bcefba1d54afaaf7f80.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
754
x-amz-cf-pop
FRA56-P11
server
AmazonS3
x-amz-server-side-encryption
AES256
webflow-badge-text.6faa6a38cd.svg
d1otoma47x30pg.cloudfront.net/img/
10 KB
5 KB
Image
General
Full URL
https://d1otoma47x30pg.cloudfront.net/img/webflow-badge-text.6faa6a38cd.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:9800:0:3ec8:d500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

content-encoding
gzip
x-amz-version-id
KT_UF1eUTsEnnNcDOhY89.FgfnmSfWJf
etag
W/"b85cbfc40992d61b945dca92cdf7c0ba"
age
8624
x-cache
Hit from cloudfront
x-amz-cf-id
IVbr50gLa5IoCPpieFmM_NedYduRD54S2MRiKMeibnQBZvd5Bc34Uw==
date
Sun, 08 Dec 2024 17:25:34 GMT
content-type
image/svg+xml
vary
accept-encoding
last-modified
Thu, 05 Oct 2023 18:14:55 GMT
cache-control
max-age=84600, must-revalidate
via
1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA60-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
61b968f9e616e08481e239da_rsz_download_1%20(1).png
uploads-ssl.webflow.com/61b967d6979a8b613298caf1/
2 KB
2 KB
Other
General
Full URL
https://uploads-ssl.webflow.com/61b967d6979a8b613298caf1/61b968f9e616e08481e239da_rsz_download_1%20(1).png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.153.109 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3522c66612729e8cb2057ba68a1dffb2e5899daddff4193855b7e347b945d9f2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://metamask-loginf.webflow.io/

Response headers

cf-cache-status
HIT
etag
"575e01153f43305930ff1f0c7369799a"
x-amz-version-id
K.1pINFwJPR8aSUfng76E5DKZWmTfNc5
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sun, 08 Dec 2024 19:49:16 GMT
content-type
image/png
last-modified
Wed, 15 Dec 2021 04:03:07 GMT
vary
Accept-Encoding
priority
u=1,i
x-amz-id-2
2hiGBNKOdaVncR40b4fPgXwtox9PcdfdNU2HehrPDKd/xTt05sQKXp/5gxiZQv2zIdo5RbG0cCWbgMO1m9Es/2HwDdjSWsbsTpYdN0b9dSU=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
KYSBTJSH4EHZTDMY
cf-ray
8eef471c1e4b82ca-ARN
accept-ranges
bytes
access-control-allow-origin
*
content-length
1703
server
cloudflare
x-amz-server-side-encryption
AES256

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| tram object| Webflow

1 Cookies

Domain/Path Name / Value
.uploads-ssl.webflow.com/ Name: __cf_bm
Value: bZgAJqhInxveynzs5niPGNC35K7YnBJgOv7h_TN1C2M-1733687356-1.0.1.1-PsxFXijAdJ5ML3RXI6QJl.brVdxCrfJtVtliwZp1K7axVtgzGDnqWdRYQwDVIrBOtmIk909iDsN6c11VZeIrug

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com