metamask-io-logins.webflow.io Open in urlscan Pro
151.101.130.188  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response metamask-io-logins.webflow.io/	8 KB 4 KB	667ms 340ms	Document text/html	151.101.130.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 143cd0829444b8e0c392a3c165231a2c6d05b69942f3d8587a0eb1e445918f0e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers accept-ranges bytes age 0 content-encoding gzip content-length 3595 content-security-policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com content-type text/html date Tue, 12 Dec 2023 15:27:42 GMT vary x-wf-forwarded-proto, Accept-Encoding x-cache MISS x-cache-hits 0 x-served-by cache-bfi-krnt7300071-BFI x-timer S1702394862.371473,VS0,VE188
GET H2	200	metamask-io-logins.webflow.3f2b4d78a.css uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/css/	32 KB 9 KB	823ms 492ms	Stylesheet text/css	13.249.205.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/css/metamask-io-logins.webflow.3f2b4d78a.css Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.249.205.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-249-205-5.slc50.r.cloudfront.net Software AmazonS3 / Resource Hash fb13cf08ab9727e682b2ead803860486f203502114cf8b23f35f87fc4b933833 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers x-amz-version-id r98_xb3j8Kk2SOUhhpObz0h.TJhxPtRG content-encoding gzip via 1.1 d72365754a4b05b54ee38a34a03f4b62.cloudfront.net (CloudFront) date Tue, 12 Dec 2023 15:27:44 GMT x-amz-cf-pop SLC50-C1 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront content-length 8371 last-modified Thu, 23 Dec 2021 19:48:31 GMT server AmazonS3 etag "4a0044ec5566f6166d85908861aed5fc" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes x-amz-cf-id SYmLWDS0VxVuzwqwcfr_fJlwF-q4jUnQ-n2rWKs4vCs5e4kTSvnIVQ==
GET H2	200	js Show response www.googletagmanager.com/gtag/	174 KB 64 KB	231ms 130ms	Script application/javascript	172.217.24.40 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-215786068-1 Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.24.40 , United States, ASN15169 (GOOGLE, US), Reverse DNS hkg07s23-in-f8.1e100.net Software Google Tag Manager / Resource Hash 57905dbba28efc7cfcc78345eb9519073e2dc39bdaa54a169d3378be7b613624 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers date Tue, 12 Dec 2023 15:27:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 64945 x-xss-protection 0 last-modified Tue, 12 Dec 2023 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 12 Dec 2023 15:27:42 GMT
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 31 KB	15ms 4ms	Script application/javascript	13.35.148.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=61c4c7dea790bcf8cbff1ca3 Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.148.189 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-148-189.syd1.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers Referer https://metamask-io-logins.webflow.io/ Origin https://metamask-io-logins.webflow.io accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers date Mon, 11 Dec 2023 21:11:10 GMT content-encoding gzip via 1.1 1c65a9672d4009a4b2d2b0463141bfa6.cloudfront.net (CloudFront) age 65799 x-amz-cf-pop SYD1-C1 x-cache Hit from cloudfront last-modified Mon, 20 Jul 2020 17:53:02 GMT server AmazonS3 etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=84600, must-revalidate vary Accept-Encoding x-amz-cf-id IGFJTK0BkeTT51dxiQgdifwqTfkL5m6DmPiqdIBlRkurg7R1k7cSLQ==
GET H2	200	webflow.f0a5689e5.js Show response uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/js/	36 KB 13 KB	806ms 476ms	Script text/javascript	13.249.205.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/js/webflow.f0a5689e5.js Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.249.205.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-249-205-5.slc50.r.cloudfront.net Software AmazonS3 / Resource Hash 9a776f6f4d8a6332ceed686dcc14076dfc856daf6467a0d611b61c98951d77c0 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers x-amz-version-id HNJrHnA0ut6d7SF3KgpltNUOqv7JRxeF content-encoding gzip via 1.1 d72365754a4b05b54ee38a34a03f4b62.cloudfront.net (CloudFront) date Tue, 12 Dec 2023 15:27:44 GMT x-amz-cf-pop SLC50-C1 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront content-length 12825 last-modified Thu, 23 Dec 2021 19:48:31 GMT server AmazonS3 etag "9f9e09bb5e990760480e628458109b86" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes x-amz-cf-id F8wRYgymfu4gAXj4CowzflzCquIAZZ-LrKPeC1RmLoYTRgX4x2Zzfw==
GET H2	200	61c4ca8e88dbcfe6874579f4_metamask%20bg.png uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/	110 KB 110 KB	298ms 297ms	Image image/png	13.249.205.5 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/61c4ca8e88dbcfe6874579f4_metamask%20bg.png Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.249.205.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-249-205-5.slc50.r.cloudfront.net Software AmazonS3 / Resource Hash fef39f06e70da41c92a15c4622789070fd146ad710c8aa2a2b323eda54efee0d Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers date Mon, 11 Dec 2023 03:52:15 GMT x-amz-version-id WolOVlymL8iXe8js_xfWCjzTRazB5_.x via 1.1 d72365754a4b05b54ee38a34a03f4b62.cloudfront.net (CloudFront) age 128129 x-amz-cf-pop SLC50-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 112213 last-modified Thu, 23 Dec 2021 19:14:25 GMT server AmazonS3 etag "b8d5a58b788f678a12689bb665f77422" content-type image/png access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id MI9QDkYXX66rodG_wipi15PRajLniMRK68t_DuHvr0HJQataO0yRjg==
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	105ms 4ms	Script text/javascript	172.217.24.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-215786068-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.24.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS hkg07s23-in-f14.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 12 Dec 2023 13:52:35 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 5708 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Tue, 12 Dec 2023 15:52:35 GMT
GET H2	200	webflow-badge-icon.f67cd735e3.svg d3e54v103j8qbb.cloudfront.net/img/	754 B 1 KB	11ms 4ms	Image image/svg+xml	13.35.148.189 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d3e54v103j8qbb.cloudfront.net/img/webflow-badge-icon.f67cd735e3.svg Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.148.189 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-148-189.syd1.r.cloudfront.net Software AmazonS3 / Resource Hash 6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers date Mon, 11 Dec 2023 19:59:33 GMT via 1.1 e57fe70b9ed429fb51b4b2432cadc67a.cloudfront.net (CloudFront) age 70091 x-amz-cf-pop SYD1-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 754 last-modified Thu, 05 Oct 2023 18:14:51 GMT server AmazonS3 etag "170ca9cdf8ca5789f23e395671b34510" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes x-amz-cf-id _M_ULubzNuiBKkRXsvY7_ic_Q6Lgp5R0lK0XuhED8I_W2ulZk0g2LA==
GET H2	200	webflow-badge-text.6faa6a38cd.svg d1otoma47x30pg.cloudfront.net/img/	10 KB 5 KB	798ms 160ms	Image image/svg+xml	13.249.205.58 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1otoma47x30pg.cloudfront.net/img/webflow-badge-text.6faa6a38cd.svg Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.249.205.58 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-249-205-58.slc50.r.cloudfront.net Software AmazonS3 / Resource Hash 21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers x-amz-version-id KT_UF1eUTsEnnNcDOhY89.FgfnmSfWJf content-encoding gzip via 1.1 52271e90b57cafa189a2830b7c04a6f8.cloudfront.net (CloudFront) date Mon, 11 Dec 2023 22:36:21 GMT age 60772 x-amz-cf-pop SLC50-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 05 Oct 2023 18:14:55 GMT server AmazonS3 etag W/"b85cbfc40992d61b945dca92cdf7c0ba" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=84600, must-revalidate x-amz-cf-id 7Rri3yKVzGftAPcKTuoKw33z-N1XPs0lfSLH5ma8z8zPcy7ka8jy9g==
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 216 B	99ms 99ms	XHR text/plain	172.217.24.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=417717496&t=pageview&_s=1&dl=https%3A%2F%2Fmetamask-io-logins.webflow.io%2F&ul=en-us&de=UTF-8&dt=Metamask%20Wallet%20login%20Download%20and%20import%20a%20Crypto%20Wallet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1368776318&gjid=1393883188&cid=482664750.1702394864&tid=UA-215786068-1&_gid=2016069343.1702394864&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma=0&jsscut=1&z=131351583 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.24.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS hkg07s23-in-f14.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://metamask-io-logins.webflow.io/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 12 Dec 2023 15:27:43 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://metamask-io-logins.webflow.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| gtag object| dataLayer function| $ function| jQuery function| tram object| Webflow object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.webflow.io/	1970-01-21 02:29:14	Name: _ga Value: GA1.2.482664750.1702394864
			.webflow.io/	1970-01-20 16:54:41	Name: _gid Value: GA1.2.2016069343.1702394864
			.webflow.io/	1970-01-20 16:53:14	Name: _gat_gtag_UA_215786068_1 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1otoma47x30pg.cloudfront.net
d3e54v103j8qbb.cloudfront.net
metamask-io-logins.webflow.io
uploads-ssl.webflow.com
www.google-analytics.com
www.googletagmanager.com
13.249.205.5
13.249.205.58
13.35.148.189
151.101.130.188
172.217.24.40
172.217.24.46
143cd0829444b8e0c392a3c165231a2c6d05b69942f3d8587a0eb1e445918f0e
21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09
57905dbba28efc7cfcc78345eb9519073e2dc39bdaa54a169d3378be7b613624
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8
9a776f6f4d8a6332ceed686dcc14076dfc856daf6467a0d611b61c98951d77c0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb13cf08ab9727e682b2ead803860486f203502114cf8b23f35f87fc4b933833
fef39f06e70da41c92a15c4622789070fd146ad710c8aa2a2b323eda54efee0d