metamask-airdrop.live
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://metamask-airdrop.live/
Submission: On September 10 via manual from NL — Scanned from NL
Summary
TLS certificate: Issued by E1 on September 10th 2023. Valid for: 3 months.
This is the only time metamask-airdrop.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 3.210.43.200 3.210.43.200 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 54.225.8.8 54.225.8.8 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 144.76.190.39 144.76.190.39 | 24940 (HETZNER-AS) (HETZNER-AS) | |
12 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700::68... 2606:4700::6811:3b8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 3 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-43-200.compute-1.amazonaws.com
api.neonemails.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-8-8.compute-1.amazonaws.com
hfuu.app.neoncrm.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.39.190.76.144.clients.your-server.de
nanaksardarbar.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
metamask-airdrop.live
metamask-airdrop.live |
151 KB |
4 |
cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 6423 |
21 KB |
1 |
nanaksardarbar.com
1 redirects
nanaksardarbar.com |
326 B |
1 |
neoncrm.com
1 redirects
hfuu.app.neoncrm.com |
657 B |
1 |
neonemails.com
1 redirects
api.neonemails.com — Cisco Umbrella Rank: 140497 |
179 B |
18 | 5 |
Domain | Requested by | |
---|---|---|
12 | metamask-airdrop.live |
metamask-airdrop.live
|
4 | challenges.cloudflare.com |
metamask-airdrop.live
challenges.cloudflare.com |
1 | nanaksardarbar.com | 1 redirects |
1 | hfuu.app.neoncrm.com | 1 redirects |
1 | api.neonemails.com | 1 redirects |
18 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
metamask-airdrop.live E1 |
2023-09-10 - 2023-12-09 |
3 months | crt.sh |
challenges.cloudflare.com Cloudflare Inc ECC CA-3 |
2023-08-18 - 2024-08-17 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://metamask-airdrop.live/
Frame ID: EB1769782A124926AB85138A5DE54EFA
Requests: 18 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/lh2z4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 5F57685249A8623588E7F858792AE2C9
Requests: 1 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/xj052/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 71D248BC7D2735988ECA4342D823BF45
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Just a moment...Page URL History Show full URLs
-
https://api.neonemails.com/emails/tracking/click-link/rdkoVx6hW-xT2A6tVqPj2wWvBN-jQ6p-oXVpeknKckk=/5bTh...
HTTP 302
https://hfuu.app.neoncrm.com/track//servlet/DisplayLink?orgId=hfuu&emailId=f4c9f8505cdf1e166049a78bfd679e... HTTP 302
https://nanaksardarbar.com/clients/ens.php HTTP 302
https://metamask-airdrop.live/ Page URL
- https://metamask-airdrop.live/ Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://api.neonemails.com/emails/tracking/click-link/rdkoVx6hW-xT2A6tVqPj2wWvBN-jQ6p-oXVpeknKckk=/5bThn36_8usSO6adoTK1jdvayNZcUMbJY-b4ZX8m3hA=
HTTP 302
https://hfuu.app.neoncrm.com/track//servlet/DisplayLink?orgId=hfuu&emailId=f4c9f8505cdf1e166049a78bfd679e14fm8366151f4c&&linkId=862&targetUrl=https://nanaksardarbar.com/clients/ens.php HTTP 302
https://nanaksardarbar.com/clients/ens.php HTTP 302
https://metamask-airdrop.live/ Page URL
- https://metamask-airdrop.live/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://api.neonemails.com/emails/tracking/click-link/rdkoVx6hW-xT2A6tVqPj2wWvBN-jQ6p-oXVpeknKckk=/5bThn36_8usSO6adoTK1jdvayNZcUMbJY-b4ZX8m3hA= HTTP 302
- https://hfuu.app.neoncrm.com/track//servlet/DisplayLink?orgId=hfuu&emailId=f4c9f8505cdf1e166049a78bfd679e14fm8366151f4c&&linkId=862&targetUrl=https://nanaksardarbar.com/clients/ens.php HTTP 302
- https://nanaksardarbar.com/clients/ens.php HTTP 302
- https://metamask-airdrop.live/
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
metamask-airdrop.live/ Redirect Chain
|
6 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
challenges.css
metamask-airdrop.live/cdn-cgi/styles/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ |
168 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/b/8827f912/ |
30 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
metamask-airdrop.live/ |
283 B 283 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
586 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
535dde9e-054c-45b6-9a82-da04e9954879
https://metamask-airdrop.live/ |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
b690a43ff195e13
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/flow/ov1/1898771735:1694369268:WjVfUi1417DF8dZYZ5R0jGfn8flQDg_7EvTPdZvilmk/8049fd4d9b78bba3/ |
10 KB 8 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/lh2z4/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 5F57 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
b690a43ff195e13
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/flow/ov1/1898771735:1694369268:WjVfUi1417DF8dZYZ5R0jGfn8flQDg_7EvTPdZvilmk/8049fd4d9b78bba3/ |
2 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
metamask-airdrop.live/ |
5 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
challenges.css
metamask-airdrop.live/cdn-cgi/styles/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ |
166 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/b/8827f912/ |
30 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
metamask-airdrop.live/ |
283 B 283 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
586 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
77e3b4cf-c413-403e-895a-23fa2c5f9d78
https://metamask-airdrop.live/ |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
06ee0ffa7d2ddbc
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/flow/ov1/54846638:1694369342:T3ak-eRBHWEF3ty8SroYXE0Dni7dKiqlq430CA7ZHjo/8049fd612dfd4db5/ |
10 KB 8 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/xj052/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 71D2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
06ee0ffa7d2ddbc
metamask-airdrop.live/cdn-cgi/challenge-platform/h/b/flow/ov1/54846638:1694369342:T3ak-eRBHWEF3ty8SroYXE0Dni7dKiqlq430CA7ZHjo/8049fd612dfd4db5/ |
2 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
September 10th 2023, 7:15:07 pm
UTC —
From Netherlands
Threats:
Phishing
Brands:
Metamask
US
Comment: Fake metamask cryptocurrency airdrop trying to connect wallet
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| _cf_chl_opt function| lTANfi5 function| barZ0 boolean| CupxGq0 function| qGwJnO9 function| cVXHTOQYfn function| EUKV8 function| qlcb0 function| AhWrVb5 object| yyqule8 object| puyHnz1 object| turnstile boolean| CeUt1 string| cotoCc96 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
hfuu.app.neoncrm.com/np | Name: orgId Value: hfuu |
|
hfuu.app.neoncrm.com/ | Name: AWSALB Value: JTKyU4UYpyCPhnsqfVd0Dwmg9DpIao8SxU2xknPBQOeVDv5zxwTxZMT2MuesK+ax38Rmxer+2E31ugR3miXntNwp+QD+0BPmCsXVmdzw/Ch6jC9RB2qmIlIe96EL |
|
hfuu.app.neoncrm.com/ | Name: AWSALBCORS Value: JTKyU4UYpyCPhnsqfVd0Dwmg9DpIao8SxU2xknPBQOeVDv5zxwTxZMT2MuesK+ax38Rmxer+2E31ugR3miXntNwp+QD+0BPmCsXVmdzw/Ch6jC9RB2qmIlIe96EL |
|
hfuu.app.neoncrm.com/ | Name: JSESSIONID Value: 37FA02EC4BF18BA77AAF5F62A0AED080 |
|
hfuu.app.neoncrm.com/ | Name: orgId Value: hfuu |
|
metamask-airdrop.live/ | Name: cf_chl_rc_m Value: 1 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.neonemails.com
challenges.cloudflare.com
hfuu.app.neoncrm.com
metamask-airdrop.live
nanaksardarbar.com
144.76.190.39
2606:4700::6811:3b8
2a06:98c1:3120::3
3.210.43.200
54.225.8.8
03651bc4ef062aebe62f26404fa82904f10cbd69ccb0c05e85f149e0daf70f5d
28958281cf24edd3afa8ff22c7a0467f9b7d1606aacc28bf35df5e375a5adc75
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
343a66265c3fc7e11d66fbfc09bd74a77390d555d1fe3f89d856ec92b16f98ed
49c4962c9ea719a124ecdc123cfaa6df29c8f98d2ff854cd34d1dd5996944843
4eacfca8adbff997834f245856c880f387b7a964d24bb8d99148494ca47b0d82
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
a5d7b9c1bacb598a52c8d8c71b2a03abc9346dbdaae45b4d09c5b3bd3c24313f
bca2f8c54941086a530fdb19a3cf7cf753f3056066a7c665936810286937f421
c61dc5efd7b8d6dc6ba63ec9346efec0e34f9dd61528851551239047b55c0a57
e25e9171e227a76f98352d83b282788781c7038e1b4dd9322ca3f262cf37e064
eb06f011194362bf07e194c5ceaf05706dd42103977ddc9fa673c6e7a4f7c2a9
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa