metamask-io-logins.webflow.io Open in urlscan Pro
151.101.2.188  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response metamask-io-logins.webflow.io/	8 KB 4 KB	1824ms 1403ms	Document text/html	151.101.2.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 143cd0829444b8e0c392a3c165231a2c6d05b69942f3d8587a0eb1e445918f0e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers accept-ranges bytes age 0 content-encoding gzip content-length 3595 content-security-policy frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com content-type text/html date Fri, 22 Dec 2023 15:31:03 GMT vary x-wf-forwarded-proto, Accept-Encoding x-cache MISS x-cache-hits 0 x-served-by cache-per12626-PER x-timer S1703259062.391235,VS0,VE1199
GET H2	200	metamask-io-logins.webflow.3f2b4d78a.css uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/css/	32 KB 9 KB	2248ms 1105ms	Stylesheet text/css	3.160.188.90 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/css/metamask-io-logins.webflow.3f2b4d78a.css Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.160.188.90 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-160-188-90.mrs52.r.cloudfront.net Software AmazonS3 / Resource Hash fb13cf08ab9727e682b2ead803860486f203502114cf8b23f35f87fc4b933833 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 22 Dec 2023 15:31:06 GMT content-encoding gzip via 1.1 6441aca3a2b5b58e29d8d3461ac1b20c.cloudfront.net (CloudFront) x-amz-version-id r98_xb3j8Kk2SOUhhpObz0h.TJhxPtRG x-amz-cf-pop MRS52-P5 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront content-length 8371 last-modified Thu, 23 Dec 2021 19:48:31 GMT server AmazonS3 etag "4a0044ec5566f6166d85908861aed5fc" content-type text/css access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes x-amz-cf-id sd83WqbvUKw2skKflGL-wpc88uUEsrUxPZ5ROmRm5BP44narlRXO_Q==
GET H2	200	js Show response www.googletagmanager.com/gtag/	174 KB 64 KB	990ms 337ms	Script application/javascript	142.251.175.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-215786068-1 Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.175.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS sh-in-f97.1e100.net Software Google Tag Manager / Resource Hash cd081dea7181caae821a68a51b43205f86255b2c8676637ac1148964bbaf11c1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 22 Dec 2023 15:31:04 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 64930 x-xss-protection 0 last-modified Fri, 22 Dec 2023 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 22 Dec 2023 15:31:04 GMT
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 30 KB	1349ms 503ms	Script application/javascript	13.35.153.172 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=61c4c7dea790bcf8cbff1ca3 Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.153.172 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-153-172.tpe50.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers Referer https://metamask-io-logins.webflow.io/ Origin https://metamask-io-logins.webflow.io accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 22 Dec 2023 06:18:35 GMT content-encoding br via 1.1 9f6f98693a92fb28f50ee1be22989de2.cloudfront.net (CloudFront) age 58332 x-amz-cf-pop TPE50-C1 x-cache Hit from cloudfront last-modified Mon, 20 Jul 2020 17:53:02 GMT server AmazonS3 etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=84600, must-revalidate vary Accept-Encoding x-amz-cf-id Qj9Ph47gCXpYLEVeafVEyQn6iYYDF2ZGXR7zq49lP5GQEfA2cu3EPw==
GET H2	200	webflow.f0a5689e5.js Show response uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/js/	36 KB 13 KB	2192ms 1049ms	Script text/javascript	3.160.188.90 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/js/webflow.f0a5689e5.js Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.160.188.90 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-160-188-90.mrs52.r.cloudfront.net Software AmazonS3 / Resource Hash 9a776f6f4d8a6332ceed686dcc14076dfc856daf6467a0d611b61c98951d77c0 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 22 Dec 2023 15:31:06 GMT content-encoding gzip via 1.1 6441aca3a2b5b58e29d8d3461ac1b20c.cloudfront.net (CloudFront) x-amz-version-id HNJrHnA0ut6d7SF3KgpltNUOqv7JRxeF x-amz-cf-pop MRS52-P5 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront content-length 12825 last-modified Thu, 23 Dec 2021 19:48:31 GMT server AmazonS3 etag "9f9e09bb5e990760480e628458109b86" content-type text/javascript access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes x-amz-cf-id djVO-v764lqVdk9p7xWoLthfGFxTnuyFqYdyJiSiO-x9JTZ9Hrh7dg==
GET H2	200	61c4ca8e88dbcfe6874579f4_metamask%20bg.png uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/	110 KB 110 KB	639ms 639ms	Image image/png	3.160.188.90 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://uploads-ssl.webflow.com/61c4c7dea790bcf8cbff1ca3/61c4ca8e88dbcfe6874579f4_metamask%20bg.png Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.160.188.90 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-160-188-90.mrs52.r.cloudfront.net Software AmazonS3 / Resource Hash fef39f06e70da41c92a15c4622789070fd146ad710c8aa2a2b323eda54efee0d Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Thu, 21 Dec 2023 05:50:07 GMT x-amz-version-id WolOVlymL8iXe8js_xfWCjzTRazB5_.x via 1.1 6441aca3a2b5b58e29d8d3461ac1b20c.cloudfront.net (CloudFront) age 121260 x-amz-cf-pop MRS52-P5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 112213 last-modified Thu, 23 Dec 2021 19:14:25 GMT server AmazonS3 etag "b8d5a58b788f678a12689bb665f77422" content-type image/png access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id miXa3BJxByssbJkS9mxFSV85ZZ9NuHfijcSJqbn5lceOQm1eP-nilA==
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	994ms 327ms	Script text/javascript	142.251.175.101 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-215786068-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.175.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS sh-in-f101.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 22 Dec 2023 15:01:15 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 1791 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Fri, 22 Dec 2023 17:01:15 GMT
GET H2	200	webflow-badge-icon.f67cd735e3.svg d3e54v103j8qbb.cloudfront.net/img/	754 B 1 KB	1278ms 422ms	Image image/svg+xml	13.35.153.172 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d3e54v103j8qbb.cloudfront.net/img/webflow-badge-icon.f67cd735e3.svg Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.153.172 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-153-172.tpe50.r.cloudfront.net Software AmazonS3 / Resource Hash 6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 22 Dec 2023 06:32:29 GMT via 1.1 42c367fe651656ce4584288ecfc3bed0.cloudfront.net (CloudFront) last-modified Thu, 05 Oct 2023 18:14:51 GMT server AmazonS3 age 32319 x-amz-cf-pop TPE50-C1 etag "170ca9cdf8ca5789f23e395671b34510" x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-type image/svg+xml access-control-allow-origin * cache-control max-age=84600, must-revalidate accept-ranges bytes content-length 754 x-amz-cf-id quW5vh8DWNf32ue8BDw8fYwXAwfLxJETBtSHwzH6lWstTNGOv_hwrg==
GET H2	200	webflow-badge-text.6faa6a38cd.svg d1otoma47x30pg.cloudfront.net/img/	10 KB 4 KB	1669ms 557ms	Image image/svg+xml	3.160.196.85 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1otoma47x30pg.cloudfront.net/img/webflow-badge-text.6faa6a38cd.svg Requested by Host: metamask-io-logins.webflow.io URL: https://metamask-io-logins.webflow.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.160.196.85 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-160-196-85.mrs52.r.cloudfront.net Software AmazonS3 / Resource Hash 21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09 Request headers accept-language en-AU,en;q=0.9 Referer https://metamask-io-logins.webflow.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers x-amz-version-id KT_UF1eUTsEnnNcDOhY89.FgfnmSfWJf content-encoding br via 1.1 319d5f1e8660f76d5a2dceecbead5196.cloudfront.net (CloudFront) date Thu, 21 Dec 2023 18:09:42 GMT age 76903 x-amz-cf-pop MRS52-P6 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 05 Oct 2023 18:14:55 GMT server AmazonS3 etag W/"b85cbfc40992d61b945dca92cdf7c0ba" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=84600, must-revalidate x-amz-cf-id F3VWgOibe2JJuo_Iwe7MVF0ngszrSFMSKsEtmEe-0pVdTV8wfnPihg==
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 216 B	325ms 324ms	XHR text/plain	142.251.175.101 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=934763525&t=pageview&_s=1&dl=https%3A%2F%2Fmetamask-io-logins.webflow.io%2F&ul=en-us&de=UTF-8&dt=Metamask%20Wallet%20login%20Download%20and%20import%20a%20Crypto%20Wallet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=92393354&gjid=560651302&cid=1221904721.1703259067&tid=UA-215786068-1&_gid=2111989041.1703259067&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma=0&jsscut=1&z=2102168753 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.175.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS sh-in-f101.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://metamask-io-logins.webflow.io/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 22 Dec 2023 15:31:07 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://metamask-io-logins.webflow.io cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| gtag object| dataLayer function| $ function| jQuery object| google_tag_manager object| google_tag_data function| tram object| Webflow string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.webflow.io/	1970-01-21 02:43:39	Name: _ga Value: GA1.2.1221904721.1703259067
			.webflow.io/	1970-01-20 17:09:05	Name: _gid Value: GA1.2.2111989041.1703259067
			.webflow.io/	1970-01-20 17:07:39	Name: _gat_gtag_UA_215786068_1 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1otoma47x30pg.cloudfront.net
d3e54v103j8qbb.cloudfront.net
metamask-io-logins.webflow.io
uploads-ssl.webflow.com
www.google-analytics.com
www.googletagmanager.com
13.35.153.172
142.251.175.101
142.251.175.97
151.101.2.188
3.160.188.90
3.160.196.85
143cd0829444b8e0c392a3c165231a2c6d05b69942f3d8587a0eb1e445918f0e
21f41a9c7f0c905f45b5188178a33663fb134cd4ba6ea6ac30bdf47e1ab28f09
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eea680992702ce5c637cac0f53526854766fe2bd710d998535d7cdada236ea8
9a776f6f4d8a6332ceed686dcc14076dfc856daf6467a0d611b61c98951d77c0
cd081dea7181caae821a68a51b43205f86255b2c8676637ac1148964bbaf11c1
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb13cf08ab9727e682b2ead803860486f203502114cf8b23f35f87fc4b933833
fef39f06e70da41c92a15c4622789070fd146ad710c8aa2a2b323eda54efee0d