meytherwalet.com Open in urlscan Pro
2606:4700:30::6812:37c3 Malicious Activity! Public Scan

URL:
http://meytherwalet.com/
Submission: On January 21 via manual (January 21st 2019, 9:54:25 am UTC) from IL

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 2606:4700:30::6812:37c3, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is meytherwalet.com.

This is the only time meytherwalet.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: MyEtherWallet (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:30:... 2606:4700:30::6812:37c3	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2606:4700:30:... 2606:4700:30::6812:36c3	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
15	3

2 2606:4700:30::6812:37c3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

meytherwalet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:30::6812:36c3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

meytherwalet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	meytherwalet.com meytherwalet.com	69 KB
15	1

	Domain	Requested by
4	meytherwalet.com	meytherwalet.com
15	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://meytherwalet.com/
Frame ID: 2A7EFCF69BE668E40DB9F9BC96C2CDAD
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

15
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

69 kB
Transfer

361 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response meytherwalet.com/	329 KB 57 KB	12250ms 12240ms	Document text/html	2606:4700:30::6812:37c3 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://meytherwalet.com/ Protocol HTTP/1.1 Server 2606:4700:30::6812:37c3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `0bbcf018404fb588aa7e54f3fb0b38ce15ca145ab6eeaa16df9f8639e5de4cbe` Request headers Host meytherwalet.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 21 Jan 2019 09:53:59 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d68681f057c1ccbc1bcc68256449ed0311548064427; expires=Tue, 21-Jan-20 09:53:47 GMT; path=/; domain=.meytherwalet.com; HttpOnly Cache-Control max-age=43200 Server cloudflare CF-RAY 49c8e55107bfc297-FRA Content-Encoding gzip
GET		etherwallet-master.min.css meytherwalet.com/css/	0 0

GET H/1.1	200 OK	etherwallet-static.min.js Show response meytherwalet.com/js/	26 KB 9 KB	20ms 14ms	Script application/javascript	2606:4700:30::6812:36c3 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://meytherwalet.com/js/etherwallet-static.min.js Requested by Host: meytherwalet.com URL: http://meytherwalet.com/ Protocol HTTP/1.1 Server 2606:4700:30::6812:36c3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `26a6ff34ce41f9fed07af3ca773a4a817aa8679fbe39a2e166d69263a99efbc9` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host meytherwalet.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://meytherwalet.com/ Cookie __cfduid=d68681f057c1ccbc1bcc68256449ed0311548064427 Connection keep-alive Cache-Control no-cache Referer http://meytherwalet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 21 Jan 2019 09:53:59 GMT Content-Encoding gzip CF-Cache-Status HIT Server cloudflare Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=43200 Transfer-Encoding chunked Connection keep-alive CF-RAY 49c8e59da357c2ba-FRA Expires Mon, 21 Jan 2019 21:53:59 GMT
GET		etherwallet-master.js meytherwalet.com/js/	0 0

GET H/1.1	200 OK	logo-myetherwallet.svg meytherwalet.com/images/	6 KB 3 KB	22ms 16ms	Image image/svg+xml	2606:4700:30::6812:36c3 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://meytherwalet.com/images/logo-myetherwallet.svg Requested by Host: meytherwalet.com URL: http://meytherwalet.com/ Protocol HTTP/1.1 Server 2606:4700:30::6812:36c3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `fbdf018eb65935a807fff8250797d6fae53a59bdf701b2c7280964eeb574be7d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host meytherwalet.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://meytherwalet.com/ Cookie __cfduid=d68681f057c1ccbc1bcc68256449ed0311548064427 Connection keep-alive Cache-Control no-cache Referer http://meytherwalet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 21 Jan 2019 09:53:59 GMT Content-Encoding gzip CF-Cache-Status HIT Server cloudflare Vary Accept-Encoding Content-Type image/svg+xml Cache-Control public, max-age=43200 Transfer-Encoding chunked Connection keep-alive CF-RAY 49c8e59da072c26f-FRA Expires Mon, 21 Jan 2019 21:53:59 GMT
GET H/1.1	200 OK	icon-remove.svg meytherwalet.com/images/	484 B 619 B	18ms 12ms	Image image/svg+xml	2606:4700:30::6812:37c3 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://meytherwalet.com/images/icon-remove.svg Requested by Host: meytherwalet.com URL: http://meytherwalet.com/ Protocol HTTP/1.1 Server 2606:4700:30::6812:37c3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `6cb52e49c11965693c0489cc5f5575176b05d4278ffa34bd0bbd86d34c27504b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host meytherwalet.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://meytherwalet.com/ Cookie __cfduid=d68681f057c1ccbc1bcc68256449ed0311548064427 Connection keep-alive Cache-Control no-cache Referer http://meytherwalet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 21 Jan 2019 09:53:59 GMT Content-Encoding gzip CF-Cache-Status HIT Server cloudflare Vary Accept-Encoding Content-Type image/svg+xml Cache-Control public, max-age=43200 Transfer-Encoding chunked Connection keep-alive CF-RAY 49c8e59da30ac288-FRA Expires Mon, 21 Jan 2019 21:53:59 GMT
GET		MEWconnectLogo.svg meytherwalet.com/images/	0 0

GET		icon-help.svg meytherwalet.com/images/	0 0

GET		logo-bity-white.svg meytherwalet.com/images/	0 0

GET		Kyber-Network-Main-Logo-Inverted.svg meytherwalet.com/images/	0 0

GET		visa-master.png meytherwalet.com/images/	0 0

GET		logo-bity.svg meytherwalet.com/images/	0 0

GET		Kyber-Network-Main-Logo.svg meytherwalet.com/images/	0 0

GET		icon-check-green.svg meytherwalet.com/images/	0 0

GET		icon-x.svg meytherwalet.com/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: meytherwalet.com
URL: http://meytherwalet.com/css/etherwallet-master.min.css

Domain: meytherwalet.com
URL: http://meytherwalet.com/js/etherwallet-master.js

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/MEWconnectLogo.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/icon-help.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/logo-bity-white.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/Kyber-Network-Main-Logo-Inverted.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/visa-master.png

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/logo-bity.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/Kyber-Network-Main-Logo.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/icon-check-green.svg

Domain: meytherwalet.com
URL: http://meytherwalet.com/images/icon-x.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: MyEtherWallet (Crypto Exchange)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

meytherwalet.com
meytherwalet.com
2606:4700:30::6812:36c3
2606:4700:30::6812:37c3
0bbcf018404fb588aa7e54f3fb0b38ce15ca145ab6eeaa16df9f8639e5de4cbe
26a6ff34ce41f9fed07af3ca773a4a817aa8679fbe39a2e166d69263a99efbc9
6cb52e49c11965693c0489cc5f5575176b05d4278ffa34bd0bbd86d34c27504b
fbdf018eb65935a807fff8250797d6fae53a59bdf701b2c7280964eeb574be7d

meytherwalet.com Open in urlscan Pro 2606:4700:30::6812:37c3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

3 IPs

1 Countries

69 kBTransfer

361 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

meytherwalet.com Open in urlscan Pro
2606:4700:30::6812:37c3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

69 kB
Transfer

361 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!