metamask-login.nicepage.io Open in urlscan Pro
151.101.194.132  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response metamask-login.nicepage.io/	7 KB 3 KB	868ms 308ms	Document text/html	151.101.194.132 FASTLY
General Check archive.org Show headers Download Go to Full URL https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.132 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.19.2 / Resource Hash 351b5a184673ba60bddcafc1136b5eb0d80b57e3ac5236ebdd7e1808e77dbc3f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes access-control-allow-credentials true access-control-allow-headers Content-Type access-control-allow-methods POST, GET, PUT, DELETE, OPTIONS access-control-allow-origin * age 0 content-encoding gzip content-length 2485 content-type text/html date Tue, 02 Apr 2024 15:20:14 GMT etag W/"cb84c06ab42d97ddf8e8c6e0fd8c92b3" last-modified Fri, 29 Apr 2022 17:39:52 GMT server nginx/1.19.2 vary Accept-Encoding via 1.1 varnish x-amz-id-2 c4PPflorEoB5i+eJVvX29KSn7k/BoWY9yepZdemuSq85RBEBZYffzb/yycdHI3gtx9Q3B0RY9Qc= x-amz-request-id ZZJDSNAS66QVNE99 x-amz-version-id null x-cache MISS x-cache-hits 0 x-served-by cache-mia-kmia1760068-MIA x-timer S1712071214.328206,VS0,VE276
GET H2	200	nicepage.css metamask-login.nicepage.io/	1 MB 108 KB	693ms 691ms	Stylesheet text/css	151.101.194.132 FASTLY
General Check archive.org Show headers Download Go to Full URL https://metamask-login.nicepage.io/nicepage.css?version=43c2c0e2-dc90-4bfb-8c43-661a799ec035 Requested by Host: metamask-login.nicepage.io URL: https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.132 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.19.2 / Resource Hash 377b9466bf5255f34230389b94b16cc4dbbd7ce30e22136d7f08d28a6145bd2f Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id null content-encoding gzip via 1.1 varnish date Tue, 02 Apr 2024 15:20:15 GMT x-amz-request-id ZZJ8GX54EPQSJMPM age 0 x-cache MISS content-length 110085 x-amz-id-2 L0asCl4hYA2OLp+l82XxEtUWgf1q/bmYJLWTuMmltCyYKyngNLRNb8LiiVdGiuM9Qy1opcYs/f4= x-served-by cache-mia-kmia1760068-MIA last-modified Fri, 29 Apr 2022 17:39:51 GMT server nginx/1.19.2 x-timer S1712071215.643170,VS0,VE658 etag W/"127415395cd3c9ef395a46c7c7862b4d" vary Accept-Encoding access-control-allow-methods POST, GET, PUT, DELETE, OPTIONS content-type text/css access-control-allow-origin * access-control-allow-credentials true accept-ranges bytes access-control-allow-headers Content-Type x-cache-hits 0
GET H2	200	jquery-1.9.1.min.js Show response capp.nicepage.com/assets/	90 KB 33 KB	307ms 131ms	Script application/javascript	2a02:6ea0:c400::11 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://capp.nicepage.com/assets/jquery-1.9.1.min.js Requested by Host: metamask-login.nicepage.io URL: https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c400::11 New York, United States, ASN60068 (CDN77 _, GB), Reverse DNS Software CDN77-Turbo / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-77-pop newyorkUSNY date Tue, 02 Apr 2024 15:20:14 GMT x-amz-version-id lj0muQf5mGonEnYG_0_cVsS_rYcdtjHr content-encoding gzip x-amz-request-id 357KX3GM4AAN6WDJ x-77-cache HIT x-cache HIT x-age 1898679 x-accel-date 1710172535 x-amz-id-2 iZMUm775xVnPxufZF5fbJUrgMHNA4oIGS0c3FaP0JB/Nx5Me6hMjnRwUj96LH8GPH8gAJBRYE5g= x-77-nzt EgwBnJIkFgHXt/gcAAwBnJI74gH3GiASAA x-accel-expires @1712756010 x-77-age 3086545 last-modified Thu, 07 Dec 2023 15:48:10 GMT server CDN77-Turbo etag W/"397754ba49e9e0cf4e7c190da78dda05" x-77-nzt-ray 1e192d0800032b012e220c66361bd031 vary Accept-Encoding content-type application/javascript cache-control max-age=2592000
GET H2	200	nicepage.js Show response capp.nicepage.com/1eb2dcd2714488c0ef25b6236e5b3262eff266b3/	232 KB 71 KB	358ms 198ms	Script application/javascript	2a02:6ea0:c400::11 CDN77 _
General Check archive.org Show headers Download Go to Full URL https://capp.nicepage.com/1eb2dcd2714488c0ef25b6236e5b3262eff266b3/nicepage.js Requested by Host: metamask-login.nicepage.io URL: https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c400::11 New York, United States, ASN60068 (CDN77 _, GB), Reverse DNS Software CDN77-Turbo / Resource Hash f21b38bfdaa5a588e5249659ea8d9587c6932990a98fca96840daf3023d5c8ae Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-77-pop newyorkUSNY date Tue, 02 Apr 2024 15:20:14 GMT x-amz-version-id zjlo9kuxv3eUgCyupiTnXHq3TmKPswMC content-encoding gzip x-amz-request-id RZBXG96TJD2ZG2XT x-77-cache HIT x-cache MISS x-accel-date 1710088918 x-amz-id-2 QFRsZJN100zb69vdpXR8ENVDf+11bxNqBa+nPoe5Tiujw/JhLxq/455ZKW8DNvE4cJFfTnq6GCE= x-77-nzt EggBnJIkFgFBDAGckjvoAfdYPx4A x-accel-expires @1712680918 x-77-age 1982296 last-modified Thu, 07 Dec 2023 14:06:53 GMT server CDN77-Turbo etag W/"b762e248752ae0498368525482d41e31" x-77-nzt-ray 1e192d0800032b012e220c669e4ae631 vary Accept-Encoding content-type application/javascript cache-control max-age=2592000
GET H2	200	css fonts.googleapis.com/	91 KB 3 KB	232ms 82ms	Stylesheet text/css	2607:f8b0:4006:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i Requested by Host: metamask-login.nicepage.io URL: https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4a8c1c691c92f0e7c4dc03a2d796ecc23aa880b085666a335bdf7870efdc7b03 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Tue, 02 Apr 2024 15:20:14 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 02 Apr 2024 15:14:43 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 02 Apr 2024 15:20:14 GMT
GET H2	200	meta-mask-Banner.png images02.nicepage.com/2d06dbf396fadeffa0901cf3/0bcbf1d1b7035fadb1b46c5e/	86 KB 87 KB	309ms 134ms	Image image/png	2a02:6ea0:c400::12 CDN77 _
General Check archive.org Show headers Download Go to Show image Full URL https://images02.nicepage.com/2d06dbf396fadeffa0901cf3/0bcbf1d1b7035fadb1b46c5e/meta-mask-Banner.png Requested by Host: metamask-login.nicepage.io URL: https://metamask-login.nicepage.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c400::12 New York, United States, ASN60068 (CDN77 _, GB), Reverse DNS Software CDN77-Turbo / Resource Hash effe76e2990dd76ae6e2ed1ed654d2dc463f22935c32ff9e8fdcf663e95fb366 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-77-pop newyorkUSNY date Tue, 02 Apr 2024 15:20:15 GMT x-amz-version-id null x-amz-request-id XY538764K6MZHRME x-77-cache HIT x-cache MISS x-accel-date 1712070339 content-length 88357 x-amz-id-2 YxBJ8zI5Hw4vLNYamjPS8yTI6trukQey7u8Wt1O2QzcY6V1Aa65KJ2CFHPOo1HxFQxOgml+gxH0= x-77-nzt EggBWbuxDwFBDAGckjvoAfdsAwAA x-accel-expires @1743606339 x-77-age 876 last-modified Fri, 29 Apr 2022 17:09:16 GMT server CDN77-Turbo etag "af5a24fa1c0edc7ee244615941d7e09a" x-77-nzt-ray 49be14088184dfcd2f220c668f7cfb24 content-type image/png cache-control max-age=31536000 accept-ranges bytes
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 15 KB	279ms 138ms	Font font/woff2	2607:f8b0:4006:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fonts.googleapis.com/ Origin https://metamask-login.nicepage.io accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 27 Mar 2024 08:56:32 GMT x-content-type-options nosniff age 541423 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 27 Mar 2025 08:56:32 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v40/	47 KB 48 KB	203ms 63ms	Font font/woff2	2607:f8b0:4006:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fonts.googleapis.com/ Origin https://metamask-login.nicepage.io accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 27 Mar 2024 06:27:15 GMT x-content-type-options nosniff age 550380 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48236 x-xss-protection 0 last-modified Thu, 14 Dec 2023 02:08:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 27 Mar 2025 06:27:15 GMT
GET H2	200	favicon.png metamask-login.nicepage.io/	27 KB 27 KB	457ms 456ms	Other image/png	151.101.194.132 FASTLY
General Check archive.org Show headers Download Go to Full URL https://metamask-login.nicepage.io/favicon.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.132 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.19.2 / Resource Hash 40c8feb7fb84d0e5f2edc5fd060a8a8f3af21712e05ec678b8b62746681d0ee3 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://metamask-login.nicepage.io/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id null date Tue, 02 Apr 2024 15:20:16 GMT via 1.1 varnish x-amz-request-id 2NDYPEM9HP9167W3 age 0 x-cache MISS content-length 27463 x-amz-id-2 9YGm0p3ibZAxHKzq7A7vIaX5kQtvvSuYAbYL35o2WSTH1cHsP3LrGSAdhSFX29k/Sk6T9555gms= x-served-by cache-mia-kmia1760068-MIA last-modified Fri, 29 Apr 2022 17:30:57 GMT server nginx/1.19.2 x-timer S1712071216.902270,VS0,VE384 etag "06c88c121cf3b4926f726b5241b3c8bf" access-control-allow-methods POST, GET, PUT, DELETE, OPTIONS content-type image/png access-control-allow-origin * access-control-allow-credentials true accept-ranges bytes access-control-allow-headers Content-Type x-cache-hits 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| $ function| jQuery object| cssBgParser function| ResponsiveMenu function| MailChimpForm object| jQuery19105640320612103722 object| bootstrap function| loadMapsContent function| mapIframeApiReady object| MapsLoader function| Lightbox object| Utility object| skrollr function| Waypoint function| WaypointAdapter function| _npStickyStack function| _npInitMenuLink function| AnimationInfo function| CountUp function| CounterAnimation function| AnimateCssAnimation object| AnimationFactory object| AnimationEventScroll function| AnimationEventSlider object| WillChangeHint undefined| uAnimation object| _npScrollAnchor function| _npScrollSpyInit function| ImageZoom function| _npHorizontalLayoutSlider function| TabsControl function| _npTabsInit object| lazySizes object| _npLazyImages object| lazySizesConfig function| _npDialogsInit function| _npAccordionInit function| setImmediate function| clearImmediate function| _npAuthInit object| _responsive

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capp.nicepage.com
fonts.googleapis.com
fonts.gstatic.com
images02.nicepage.com
metamask-login.nicepage.io
151.101.194.132
2607:f8b0:4006:80d::2003
2607:f8b0:4006:820::200a
2a02:6ea0:c400::11
2a02:6ea0:c400::12
351b5a184673ba60bddcafc1136b5eb0d80b57e3ac5236ebdd7e1808e77dbc3f
377b9466bf5255f34230389b94b16cc4dbbd7ce30e22136d7f08d28a6145bd2f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
40c8feb7fb84d0e5f2edc5fd060a8a8f3af21712e05ec678b8b62746681d0ee3
4a8c1c691c92f0e7c4dc03a2d796ecc23aa880b085666a335bdf7870efdc7b03
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
effe76e2990dd76ae6e2ed1ed654d2dc463f22935c32ff9e8fdcf663e95fb366
f21b38bfdaa5a588e5249659ea8d9587c6932990a98fca96840daf3023d5c8ae
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615