www.xn--mtamask-rya.com Open in urlscan Pro Puny
www.mëtamask.com IDN
81.19.136.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.xn--mtamask-rya.com/
Effective URL:
https://www.xn--mtamask-rya.com/
Submission: On November 19 via api (November 19th 2022, 12:02:03 pm UTC) from JP — Scanned from JP

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 15 HTTP transactions. The main IP is 81.19.136.231, located in Nizhniy Novgorod, Russian Federation and belongs to AS-ALVIVA, NL. The main domain is www.xn--mtamask-rya.com.
TLS certificate: Issued by R3 on November 16th 2022. Valid for: 3 months.

This is the only time www.xn--mtamask-rya.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
1 11	81.19.136.231 81.19.136.231	209272 (AS-ALVIVA) (AS-ALVIVA)
1 2	2606:4700:20:... 2606:4700:20::ac43:4ad5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2404:6800:400... 2404:6800:4004:821::200a	15169 (GOOGLE) (GOOGLE)
15	5

11 81.19.136.231 (Nizhniy Novgorod, Russian Federation) 1 redirects

ASN209272 (AS-ALVIVA, NL)

www.xn--mtamask-rya.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4ad5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn.tailwindcss.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:821::200a (Australia)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	xn--mtamask-rya.com 1 redirects www.xn--mtamask-rya.com	608 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 201	6 KB
2	tailwindcss.com 1 redirects cdn.tailwindcss.com — Cisco Umbrella Rank: 77688	103 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 304	31 KB
0	cdnfonts.com Failed fonts.cdnfonts.com Failed
15	5

	Domain	Requested by
11	www.xn--mtamask-rya.com	1 redirects www.xn--mtamask-rya.com
2	cdnjs.cloudflare.com	www.xn--mtamask-rya.com
2	cdn.tailwindcss.com	1 redirects www.xn--mtamask-rya.com
1	ajax.googleapis.com	www.xn--mtamask-rya.com
0	fonts.cdnfonts.com Failed	www.xn--mtamask-rya.com
15	5

This site contains no links.

Subject Issuer	Validity	Valid
www.xn--mtamask-rya.com R3	`2022-11-16` - `2023-02-14`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.xn--mtamask-rya.com/
Frame ID: 0237311CEA7D706EDE76767A22CB7306
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The crypto wallet for Defi, Web3 Dapps and NFTs | MetaMask

Page URL History Show full URLs

http://www.xn--mtamask-rya.com/ HTTP 301
https://www.xn--mtamask-rya.com/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

87 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

747 kB
Transfer

1287 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.xn--mtamask-rya.com/ HTTP 301
https://www.xn--mtamask-rya.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://cdn.tailwindcss.com/ HTTP 302
https://cdn.tailwindcss.com/3.2.4

15 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.xn--mtamask-rya.com/
Redirect Chain

http://www.xn--mtamask-rya.com/
https://www.xn--mtamask-rya.com/

30 KB
6 KB

184ms
62ms

Document
text/html

81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 / PHP/7.4.29
Resource Hash: ab3acb2874fb70c41fac331b73d46bcb6ba9922fef7e7cab8bf4f45838317647

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sat, 19 Nov 2022 12:01:50 GMT
Server: nginx/1.20.2
Transfer-Encoding: chunked
X-Powered-By: PHP/7.4.29

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Sat, 19 Nov 2022 12:01:50 GMT
Location: https://www.xn--mtamask-rya.com:443/
Server: nginx/1.20.2
Transfer-Encoding: chunked

GET
H2

200

3.2.4 Show response
cdn.tailwindcss.com/
Redirect Chain

https://cdn.tailwindcss.com/
https://cdn.tailwindcss.com/3.2.4

335 KB
102 KB

19ms
18ms

Script
text/javascript

2606:4700:20::ac43:4ad5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.tailwindcss.com/3.2.4

Requested by

Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/

Protocol

Server

2606:4700:20::ac43:4ad5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a01735039e4a6522fc7dcf18ca47dcea2c2e4b50c07d8e898190eee8f3111056

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 12:01:50 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 11 Nov 2022 17:46:48 GMT
x-vercel-id: syd1::iad1::k976q-1668188807415-4e95c057a5a8
server: cloudflare
age: 670341
x-vercel-cache: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UxSim0vLIuaDzWsnFSrgU8i1UXOmX17hc8eIjDumpoHnLB%2FExl7%2BdH3kzZiHqJFCCWmUo0HJsdM1YC9K8dCzl9zEatek28TP3aiRxT9LZ17AdjWjTfG4hrvCOYMO51Mn%2B6NkyPR1LgTckeAiCMFplZ0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=31536000
cf-ray: 76c8cb22186df5e5-NRT

Redirect headers

date: Sat, 19 Nov 2022 12:01:50 GMT
strict-transport-security: max-age=63072000
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-vercel-id: syd1::iad1::5h9fk-1668858469599-8e408e35674a
server: cloudflare
age: 543
x-vercel-cache: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YAxUmA2T7dBTy3c%2FZ%2F%2B4rHRXQKb%2F34BeqRIqTOKzKnQRTUZwsP%2BCEM2sNVor8Uf%2BP%2FEkvveAKMwRByCeCL55iqjpuQZPlvnt8qTxqCNZB0SjgFYItpxZLOLZTkI5Ft%2FNuvSzWqXXMGXVGx1wsziwKlU%3D"}],"group":"cf-nel","max_age":604800}
location: /3.2.4
cache-control: max-age=14400
cf-ray: 76c8cb21e849f5e5-NRT
content-length: 0

GET
H2 200 aos.css
cdnjs.cloudflare.com/ajax/libs/aos/2.3.4/ 25 KB
2 KB 23ms
9ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/aos/2.3.4/aos.css

Requested by

Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.xn--mtamask-rya.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 12:01:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2035224
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1438
last-modified: Mon, 04 May 2020 16:05:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d5d-65c5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2CZRLCPhpRRng3c1w75ZValJ0KVysnlZau7%2Bhbz%2BlumquTY7yrzqm%2B2yQHw41QNFRRF69k0nZl2qjNGR%2F1M9SEhy4P9K%2FJZvMe%2Fh0iHo4%2BwOt6nY5TMvaKVYFA8ncEud4Ap%2FvXqLfOotROz9Tp5B5Xhe"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76c8cb21de9ee0b0-NRT
expires: Thu, 09 Nov 2023 12:01:50 GMT

GET
H/1.1 200
OK 1.png
www.xn--mtamask-rya.com/frontend/img/ 67 KB
68 KB 125ms
114ms Image
image/png 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/1.png
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 41f591ae1fa570b8454fd866e73ab631c50171433cf295e46ee0a22d795deb41

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Thu, 13 Oct 2022 21:23:30 GMT
Server: nginx/1.20.2
ETag: "634881d2-10dcc"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 69068
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 2.svg
www.xn--mtamask-rya.com/frontend/img/ 36 KB
36 KB 272ms
161ms Image
image/svg+xml 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/2.svg
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 596228062de19a21cfda4d3129b3a5d397c5a71509e096b8f67fb8c4f22aa56d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Thu, 13 Oct 2022 21:31:46 GMT
Server: nginx/1.20.2
ETag: "634883c2-8e55"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36437
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 3.svg
www.xn--mtamask-rya.com/frontend/img/ 36 KB
36 KB 346ms
235ms Image
image/svg+xml 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/3.svg
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Thu, 13 Oct 2022 21:33:14 GMT
Server: nginx/1.20.2
ETag: "6348841a-8fe3"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36835
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 4.svg
www.xn--mtamask-rya.com/frontend/img/ 28 KB
28 KB 390ms
278ms Image
image/svg+xml 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/4.svg
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 517c0c6b44ede59070fb138aab7e875b9c230a227295f9612c32dabb9b0bdb13

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Thu, 13 Oct 2022 21:36:22 GMT
Server: nginx/1.20.2
ETag: "634884d6-6e04"
Content-Type: image/svg+xml
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28164
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 5.png
www.xn--mtamask-rya.com/frontend/img/ 130 KB
130 KB 227ms
116ms Image
image/png 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/5.png
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 33feead08bcb1fc8aabf8caf2e8ba4992763c4c116919da044620b05a8dc94b1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Thu, 13 Oct 2022 22:23:08 GMT
Server: nginx/1.20.2
ETag: "63488fcc-2082e"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 133166
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 6.png
www.xn--mtamask-rya.com/frontend/img/ 66 KB
66 KB 296ms
194ms Image
image/png 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/6.png
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: c0ec28185aaa9fe9bc018e3a0212a348bf82e5dab7e4431c4a7a321ce368ef82

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Fri, 14 Oct 2022 01:31:50 GMT
Server: nginx/1.20.2
ETag: "6348bc06-10651"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 67153
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H/1.1 200
OK 7.png
www.xn--mtamask-rya.com/frontend/img/ 238 KB
238 KB 190ms
190ms Image
image/png 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xn--mtamask-rya.com/frontend/img/7.png
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: db57c55a136cf6ba0e57493d217878ad55def2f0fef82b376801aef2e21a4d26

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Fri, 14 Oct 2022 02:10:12 GMT
Server: nginx/1.20.2
ETag: "6348c504-3b61e"
Content-Type: image/png
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 243230
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 49ms
3ms Script
text/javascript 2404:6800:4004:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:821::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 05:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22860
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 19 Nov 2023 05:40:50 GMT

GET
H2 200 aos.js Show response
cdnjs.cloudflare.com/ajax/libs/aos/2.3.4/ 14 KB
4 KB 8ms
6ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/aos/2.3.4/aos.js

Requested by

Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5005b2e414770fd5ccb40bc221a12771966d02b5c1f9c89da48bd8e3811d377

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.xn--mtamask-rya.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sat, 19 Nov 2022 12:01:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3249549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4109
last-modified: Mon, 04 May 2020 16:05:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d5d-3962"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8VkJYsg9LtiI9GLe2aiK9%2BZQZSonLWHyQmRUYauiQt%2BI4QZgjS6i8Jw0p2CF4R74PF9h7p%2F6GYRdUPjG%2F3jinHeZ5tH7AWj84C2xKAxuzcSUx%2BYn6oDzVqH3YiHgj%2F0u4vO9xGKPpqgoMnsDublcPyFV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76c8cb227f4ae0b0-NRT
expires: Thu, 09 Nov 2023 12:01:50 GMT

GET
H/1.1 200
OK build.js Show response
www.xn--mtamask-rya.com/frontend/js/ 1 KB
562 B 56ms
56ms Script
application/javascript 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xn--mtamask-rya.com/frontend/js/build.js
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: 90fe489ec56d3f4738b031927743b230c4e03396a8b4bdf8f207067769c600ea

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.xn--mtamask-rya.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Oct 2022 03:09:12 GMT
Server: nginx/1.20.2
ETag: W/"6348d2d8-4f3"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Expires: Sun, 20 Nov 2022 12:01:50 GMT

GET euclid-circular-b
fonts.cdnfonts.com/css/ 0
0

GET
H/1.1 206
Partial Content video.mp4
www.xn--mtamask-rya.com/frontend/video/ 192 KB
0 138ms
138ms Media
video/mp4 81.19.136.231
AS-ALVIVA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xn--mtamask-rya.com/frontend/video/video.mp4
Requested by: Host: www.xn--mtamask-rya.com
URL: https://www.xn--mtamask-rya.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.136.231 Nizhniy Novgorod, Russian Federation, ASN209272 (AS-ALVIVA, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash

Request headers

Referer: https://www.xn--mtamask-rya.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Range: bytes=0-

Response headers

Date: Sat, 19 Nov 2022 12:01:50 GMT
Last-Modified: Sat, 15 Oct 2022 01:00:42 GMT
Server: nginx/1.20.2
ETag: "52e8fe-5eb0845828280"
Content-Type: video/mp4
Content-Range: bytes 0-5433597/5433598
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5433598

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 351 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.cdnfonts.com
URL: http://fonts.cdnfonts.com/css/euclid-circular-b

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.xn--mtamask-rya.com/(Line 9) Message: Mixed Content: The page at 'https://www.xn--mtamask-rya.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.cdnfonts.com/css/euclid-circular-b'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.tailwindcss.com
cdnjs.cloudflare.com
fonts.cdnfonts.com
www.xn--mtamask-rya.com
fonts.cdnfonts.com
2404:6800:4004:821::200a
2606:4700:20::ac43:4ad5
2606:4700::6811:180e
81.19.136.231
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
33feead08bcb1fc8aabf8caf2e8ba4992763c4c116919da044620b05a8dc94b1
41f591ae1fa570b8454fd866e73ab631c50171433cf295e46ee0a22d795deb41
517c0c6b44ede59070fb138aab7e875b9c230a227295f9612c32dabb9b0bdb13
596228062de19a21cfda4d3129b3a5d397c5a71509e096b8f67fb8c4f22aa56d
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5
90fe489ec56d3f4738b031927743b230c4e03396a8b4bdf8f207067769c600ea
a01735039e4a6522fc7dcf18ca47dcea2c2e4b50c07d8e898190eee8f3111056
a5005b2e414770fd5ccb40bc221a12771966d02b5c1f9c89da48bd8e3811d377
ab3acb2874fb70c41fac331b73d46bcb6ba9922fef7e7cab8bf4f45838317647
c0ec28185aaa9fe9bc018e3a0212a348bf82e5dab7e4431c4a7a321ce368ef82
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
db57c55a136cf6ba0e57493d217878ad55def2f0fef82b376801aef2e21a4d26
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.xn--mtamask-rya.com Open in urlscan Pro Puny www.mëtamask.com IDN 81.19.136.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

75 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

747 kBTransfer

1287 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.xn--mtamask-rya.com Open in urlscan Pro Puny
www.mëtamask.com IDN
81.19.136.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

747 kB
Transfer

1287 kB
Size

0
Cookies

15 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!