support-walletrestoration.pages.dev Open in urlscan Pro
172.66.47.117 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://support-walletrestoration.pages.dev/24form.html
Effective URL:
https://support-walletrestoration.pages.dev/24form
Submission: On April 04 via api (April 4th 2024, 10:09:39 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 172.66.47.117, located in United States and belongs to CLOUDFLARENET, US. The main domain is support-walletrestoration.pages.dev.
TLS certificate: Issued by E1 on April 3rd 2024. Valid for: 3 months.

This is the only time support-walletrestoration.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
1 6	172.66.47.117 172.66.47.117	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	13.225.63.120 13.225.63.120	16509 (AMAZON-02) (AMAZON-02)
1	13.225.210.117 13.225.210.117	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21e... 2600:9000:21ea:4200:0:3ec8:d500:93a1	16509 (AMAZON-02) (AMAZON-02)
13	5

6 172.66.47.117 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

support-walletrestoration.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.225.63.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-120.ewr53.r.cloudfront.net

uploads-ssl.webflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.210.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-210-117.ewr50.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21ea:4200:0:3ec8:d500:93a1 (United States)

ASN16509 (AMAZON-02, US)

d1otoma47x30pg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	webflow.com uploads-ssl.webflow.com — Cisco Umbrella Rank: 14743	18 KB
6	pages.dev 1 redirects support-walletrestoration.pages.dev	75 KB
2	cloudfront.net d3e54v103j8qbb.cloudfront.net d1otoma47x30pg.cloudfront.net	6 KB
13	3

	Domain	Requested by
6	uploads-ssl.webflow.com	support-walletrestoration.pages.dev uploads-ssl.webflow.com
6	support-walletrestoration.pages.dev	1 redirects support-walletrestoration.pages.dev
1	d1otoma47x30pg.cloudfront.net
1	d3e54v103j8qbb.cloudfront.net
13	4

This site contains no links.

Subject Issuer	Validity	Valid
support-walletrestoration.pages.dev E1	`2024-04-03` - `2024-07-02`	3 months	crt.sh
uploads-ssl.webflow.com Amazon RSA 2048 M02	`2023-07-29` - `2024-08-26`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://support-walletrestoration.pages.dev/24form
Frame ID: DEA2118119490514B7F9892E3EA97BB1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Protected page | Connect to server

Page URL History Show full URLs

http://support-walletrestoration.pages.dev/24form.html HTTP 307
https://support-walletrestoration.pages.dev/24form.html HTTP 308
https://support-walletrestoration.pages.dev/24form Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

5
IPs

1
Countries

101 kB
Transfer

370 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://support-walletrestoration.pages.dev/24form.html HTTP 307
https://support-walletrestoration.pages.dev/24form.html HTTP 308
https://support-walletrestoration.pages.dev/24form Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request 24form Show response
support-walletrestoration.pages.dev/
Redirect Chain

http://support-walletrestoration.pages.dev/24form.html
https://support-walletrestoration.pages.dev/24form.html
https://support-walletrestoration.pages.dev/24form

12 KB
3 KB

47ms
47ms

Document
text/html

172.66.47.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://support-walletrestoration.pages.dev/24form

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.117 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

422befb4edf4c74196fd86dc75f619f5b3f2e777f40aae4db9026997e33308d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 86f49f8d7c114bc9-BUF
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 Apr 2024 22:09:31 GMT
etag: W/"1d5dbbd31d700552ee5945309900308a"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uzCzULjWQu9%2BWIBbqzr3b3ZBT4CycdBMkdG1dS6ET94xklEHw6g83jKiy9lhMMm2lyBBCc6RM3%2F2dIbY9IMR2E4r5VhIYaQqlh0IRv8nb5wWcF3%2B4%2B4NvzlutTFK9Q86okppLT2hbH5vIT6YOpi33NH5VjGJA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-ray: 86f49f8d1b434bc9-BUF
content-length: 0
date: Thu, 04 Apr 2024 22:09:31 GMT
location: /24form
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gWb1UzcO9yffVsC%2BuhGkPGPH4gVPrRvsfz8Sy2KtpDCXBK3gkFYAotggy3BpU2Uwp7u7ubkxTS5hh4hUU9FnZcm2h%2FhP18UbL8Pow3jTTUvyyjwLoPwn%2FGqYedMajGtnGqJPce57bQcIY%2FWuN1b7rGvIDrAqw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 styles.css
support-walletrestoration.pages.dev/ 284 B
666 B 56ms
53ms Stylesheet
text/css 172.66.47.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://support-walletrestoration.pages.dev/styles.css

Requested by

Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.117 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9038ee26082bdf30ec9e6cd1936a3f32ace1fbc0b1c8753615c145dc7e2f90d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/24form
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 22:09:31 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"ff1349fe45e03565e7aabc5a54503c3f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X9SqZrWnPRuZu5h99YUfs%2FvWH0YW2kbAJb3qC3jDTjq07B%2F5HZ4VEIfhmMWuImzKFbKMoIa%2BXsKVpWu7ZOXMrf5PjGhxDtb7Ihs7FeWKmTf04obI6UPfomVsm5Hj4yRdQ%2Ful9SAlIp%2BA%2Fayv8deDd5LaezkQIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 86f49f8ddc444bc9-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 app-restorer.webflow.dcd86dd48.css
uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/css/ 47 KB
10 KB 176ms
44ms Stylesheet
text/css 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/css/app-restorer.webflow.dcd86dd48.css
Requested by: Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0bd420ca79f86dfd2b5440866a3a950b68129cf6210b7b3df6ca24135ff8dcf8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 05:43:04 GMT
content-encoding: gzip
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
x-amz-version-id: uE4Mq_C5u4FMQNEF0IlAAe8ONYxUJtD5
age: 59188
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 10002
last-modified: Tue, 03 Oct 2023 11:43:09 GMT
server: AmazonS3
etag: "e7a76dd1d844a7a2e4bc8c3d6b8f0b3a"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: zgLS2xhBH0UEG3LTZpBkv2oQraNelYQjUr9DQmmao6WW-chNogn69A==

GET
H3 200 jquery.min.js Show response
support-walletrestoration.pages.dev/ 169 KB
42 KB 55ms
53ms Script
application/javascript 172.66.47.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://support-walletrestoration.pages.dev/jquery.min.js

Requested by

Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.117 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1651f174ab56691298ad3a9a91fc20e070e3f181125d283668f5e6adaef210fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/24form
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 22:09:31 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b86f2290612a5c82c9b8f0f68990668d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iOUx4d139vrudLO6NpOHGcnapptAqtxvFpACbkf019FPZghnKajcLmT%2BAfQy2eKYvCJTRKtjWIXCDLJ5AyQpgJ9M2zHKfccvuw87I4MYuxIezRU%2F5UaloZhfmUYq3ilFfq%2BibpF1%2F0%2BPbubZxpIfuQonmGhbag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 86f49f8ddc464bc9-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 webflow.js Show response
support-walletrestoration.pages.dev/ 111 KB
27 KB 44ms
42ms Script
application/javascript 172.66.47.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://support-walletrestoration.pages.dev/webflow.js

Requested by

Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.117 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6d5461935b4f760429e7e8dc7c010259b5a622994838b4b3a23df0f06299bdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/24form
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 22:09:31 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"d28ae1207b61fe1448e80e3911dd517d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tEPjmV9VuLlEUH9e3%2BbxCrF%2FRqzh5ESZ0Vf5wcvHhZbAK5xJ4HabViO6sFP1TceQBBRrPvXtn2vBT%2BcVQv%2FYpWEiVaVe8sBUtmLke3%2FDqKNau03Ef6dajCVBOU9Z3bCrJMkCKR6OmYkC2flB9U5O3ayLdsnBbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 86f49f8ddc474bc9-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 62434fa732124a29b112aac4_ic%20Arrow%20Go.svg
uploads-ssl.webflow.com/62434fa732124a0fb112aab4/ 331 B
789 B 43ms
43ms Image
image/svg+xml 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/62434fa732124a0fb112aab4/62434fa732124a29b112aac4_ic%20Arrow%20Go.svg
Requested by: Host: uploads-ssl.webflow.com
URL: https://uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/css/app-restorer.webflow.dcd86dd48.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3ae2b0d058074ccc525277727677a22d1cad20a0b26a7598edbcd281e4c90c8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/css/app-restorer.webflow.dcd86dd48.css
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 Nov 2023 12:07:12 GMT
x-amz-version-id: GeuYt6XA_JU44iAKjx4LB7AWtnwsLNLr
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
age: 12909741
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 331
last-modified: Tue, 29 Mar 2022 18:27:52 GMT
server: AmazonS3
etag: "c834b1a860d16d36dd051dc72107a559"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: T_A8ssQHFg5dp2aZQusxeiPxZzRjvIPnfWvWOWKGrpN087_T-Lj4Zg==

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-ttf

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a50821b46158c264ae8c3bac28c40e317f9ab2b7c5c45b00c7574c7724665c4

Request headers

Referer
Origin: https://support-walletrestoration.pages.dev
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-font-ttf;charset=utf-8

GET
H2 200 651befcfb7970eb8776dfe9e_logo.svg
uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/ 12 KB
4 KB 46ms
45ms Image
image/svg+xml 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/651bef3e5d1d847ed1a24f0e/651befcfb7970eb8776dfe9e_logo.svg
Requested by: Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 05:43:04 GMT
x-amz-version-id: W.J8Hsod6sC9Rzbdm7q4QhLSY1woCA98
content-encoding: br
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
age: 59189
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 03 Oct 2023 10:41:21 GMT
server: AmazonS3
etag: W/"51bcea2625eb2c6e9268a7377a792c86"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: dq6eQk0tVR8YJq8Q8k5zPv1Mrgp8_BtUmFRzJ6Wi2Kg0Nw5QVHM39A==

GET
H2 200 62434fa732124ac76f12aaec_product%20icon-2.svg
uploads-ssl.webflow.com/62434fa732124a0fb112aab4/ 897 B
1 KB 43ms
42ms Image
image/svg+xml 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/62434fa732124a0fb112aab4/62434fa732124ac76f12aaec_product%20icon-2.svg
Requested by: Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c650e448f5d80f982c63996c9d45c42da25af8e1c7ab54c507ef836015de369

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 17 Oct 2023 08:44:03 GMT
x-amz-version-id: pmGgtytMKk_b.G5ofNn8bE27T2k1BdiK
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
age: 14736330
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 897
last-modified: Tue, 29 Mar 2022 18:27:52 GMT
server: AmazonS3
etag: "f15ee6eb63ec87f8ddc2b1b83ba7420c"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 8PwRCeW4XhIt8_3SRupdCsYCwTn59bXY26KcGAFEXxjwYRUXCdFN3A==

GET
H2 200 62434fa732124a4a9512aae0_product%20icon-1.svg
uploads-ssl.webflow.com/62434fa732124a0fb112aab4/ 565 B
1023 B 44ms
43ms Image
image/svg+xml 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/62434fa732124a0fb112aab4/62434fa732124a4a9512aae0_product%20icon-1.svg
Requested by: Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c53ac798882e89a73e52275f50279d3b36955dd4bdbe44cd6bcd1accbc651878

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 12 Mar 2024 10:40:44 GMT
x-amz-version-id: asZRP5DF3BzuFSGTbYHAjyDKW65.k64h
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
age: 2028529
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 565
last-modified: Tue, 29 Mar 2022 18:27:52 GMT
server: AmazonS3
etag: "41e390081fabf760cd45f0b3df471104"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: -MRPpG5LYl5YBPTdrmWruTPZ_O1bC0rsiOpjzSHXB6DrePsqblIKhA==

GET
H2 200 62434fa732124a853712aad7_product%20icon.svg
uploads-ssl.webflow.com/62434fa732124a0fb112aab4/ 2 KB
1 KB 44ms
44ms Image
image/svg+xml 13.225.63.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/62434fa732124a0fb112aab4/62434fa732124a853712aad7_product%20icon.svg
Requested by: Host: support-walletrestoration.pages.dev
URL: https://support-walletrestoration.pages.dev/24form
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-120.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d603b41230141c47ea03da6a6c129b70e805417776efe8d2f8ce01732072eb0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 17 Oct 2023 09:07:16 GMT
x-amz-version-id: AwvlH3mw8AmGpxPY8lQn0Zn03lS2atUN
content-encoding: gzip
via: 1.1 b8508a82603ebd452aecb2900fb8eef0.cloudfront.net (CloudFront)
age: 14734937
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Mar 2022 18:27:52 GMT
server: AmazonS3
etag: W/"e2d237407bd80f434392745bbbc16023"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: -A2oMXsBMDHxlAhlxgMGobKRD63pZa8B5v4crLrxRBVdDJ2m1tXI7w==

GET
H2 200 webflow-badge-icon.f67cd735e3.svg
d3e54v103j8qbb.cloudfront.net/img/ 754 B
1 KB 152ms
26ms Image
image/svg+xml 13.225.210.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e54v103j8qbb.cloudfront.net/img/webflow-badge-icon.f67cd735e3.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.210.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-210-117.ewr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 05:49:55 GMT
via: 1.1 90a990c5327e86ade86681120dc4a236.cloudfront.net (CloudFront)
age: 58778
x-amz-cf-pop: EWR50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 754
last-modified: Thu, 05 Oct 2023 18:14:51 GMT
server: AmazonS3
etag: "170ca9cdf8ca5789f23e395671b34510"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: -qdUAOZ1rcZz5IIPod2piYgFIxazCQFDOCj0Y1ll1ENoJj9eSPDv5Q==

GET
H2 200 webflow-badge-text.6faa6a38cd.svg
d1otoma47x30pg.cloudfront.net/img/ 10 KB
5 KB 154ms
27ms Image
image/svg+xml 2600:9000:21ea:4200:0:3ec8:d500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1otoma47x30pg.cloudfront.net/img/webflow-badge-text.6faa6a38cd.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21ea:4200:0:3ec8:d500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: KT_UF1eUTsEnnNcDOhY89.FgfnmSfWJf
content-encoding: gzip
via: 1.1 b6217766ccd41d69658fea04297b7c24.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 09:56:22 GMT
age: 43991
x-amz-cf-pop: EWR50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 05 Oct 2023 18:14:55 GMT
server: AmazonS3
etag: W/"b85cbfc40992d61b945dca92cdf7c0ba"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
x-amz-cf-id: hJjkqqRFtEmmZL-MyjrWm4DOA0YIcJew8lREHECQYeH1wwFwQpVYfw==

GET
H3 200 favicon-32x32.png
support-walletrestoration.pages.dev/ 2 KB
2 KB 44ms
43ms Other
image/png 172.66.47.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://support-walletrestoration.pages.dev/favicon-32x32.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.117 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f095dda6bad933d0da404460be572ea44d12191e6c8fdc9e6a28dc742661f9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://support-walletrestoration.pages.dev/24form
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 22:09:32 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "10a9e100cb42a1bbad1b38e7c23e03ec"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RVAirw25lumn5mEurPhbf%2FBp1ZjTM0JR6A73t%2BGMbctMtOHUeOpxkG5afg6%2FJ3UyVM%2Fp6ArYwQGweY%2FNQSzumYokFOc%2BVhqFRa8beodfWyTBz7xq395jZl8t8PawyElaWROcKOVckPWEcj59%2BtHtSY2F7iUa4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 86f49f8fde0f4bc9-BUF
alt-svc: h3=":443"; ma=86400
content-length: 1536

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| tram object| Webflow

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1otoma47x30pg.cloudfront.net
d3e54v103j8qbb.cloudfront.net
support-walletrestoration.pages.dev
uploads-ssl.webflow.com
13.225.210.117
13.225.63.120
172.66.47.117
2600:9000:21ea:4200:0:3ec8:d500:93a1
0bd420ca79f86dfd2b5440866a3a950b68129cf6210b7b3df6ca24135ff8dcf8
0f095dda6bad933d0da404460be572ea44d12191e6c8fdc9e6a28dc742661f9e
1651f174ab56691298ad3a9a91fc20e070e3f181125d283668f5e6adaef210fb
21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09
3c650e448f5d80f982c63996c9d45c42da25af8e1c7ab54c507ef836015de369
422befb4edf4c74196fd86dc75f619f5b3f2e777f40aae4db9026997e33308d0
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
6d603b41230141c47ea03da6a6c129b70e805417776efe8d2f8ce01732072eb0
6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8
9038ee26082bdf30ec9e6cd1936a3f32ace1fbc0b1c8753615c145dc7e2f90d2
9a50821b46158c264ae8c3bac28c40e317f9ab2b7c5c45b00c7574c7724665c4
c53ac798882e89a73e52275f50279d3b36955dd4bdbe44cd6bcd1accbc651878
c6d5461935b4f760429e7e8dc7c010259b5a622994838b4b3a23df0f06299bdd
e3ae2b0d058074ccc525277727677a22d1cad20a0b26a7598edbcd281e4c90c8

support-walletrestoration.pages.dev Open in urlscan Pro 172.66.47.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

25 %IPv6

3 Domains

4 Subdomains

5 IPs

1 Countries

101 kBTransfer

370 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

support-walletrestoration.pages.dev Open in urlscan Pro
172.66.47.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

5
IPs

1
Countries

101 kB
Transfer

370 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!