appsushuwiqbdsijdewf.com Open in urlscan Pro
2606:4700:3036::ac43:9a02  Malicious Activity! Public Scan

URL: https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Submission: On August 25 via manual from BR — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::ac43:9a02, located in United States and belongs to CLOUDFLARENET, US. The main domain is appsushuwiqbdsijdewf.com.
TLS certificate: Issued by E1 on August 25th 2022. Valid for: 3 months.
This is the only time appsushuwiqbdsijdewf.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

IP Address AS Autonomous System
7 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 3
Apex Domain
Subdomains
Transfer
7 appsushuwiqbdsijdewf.com
appsushuwiqbdsijdewf.com
298 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 219
28 KB
8 2
Domain Requested by
7 appsushuwiqbdsijdewf.com appsushuwiqbdsijdewf.com
1 cdnjs.cloudflare.com appsushuwiqbdsijdewf.com
8 2

This site contains no links.

Subject Issuer Validity Valid
*.appsushuwiqbdsijdewf.com
E1
2022-08-25 -
2022-11-23
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh

This page contains 2 frames:

Primary Page: https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Frame ID: 55B09F219BFA4E029E918A11BEE3843D
Requests: 8 HTTP requests in this frame

Frame: https://appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1661400000
Frame ID: 96ECBE0C5438CDAF564551B2C9E2D7B8
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

MetaMask

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

326 kB
Transfer

1050 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Import.php
appsushuwiqbdsijdewf.com/up/meta/
558 KB
133 KB
Document
General
Full URL
https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49d4ae41a2480aede19e24b4e342131dab9ac3791d83740f3a878e5f3542c835

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
74024919aabbbb2c-MXP
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 25 Aug 2022 06:31:34 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cLKrBesJ2cBVoF0YXLLOYi7dzdud6%2FUXNPZrmvDTSSUlO47TUNkeRkQKGZqnnLE241va3Pf9RMiW%2BJn5YTOGdZ%2FlgdtuJB24fvxOgX9yQ65TcfK1WbkZVxSyDNEiqk4vEC8H6fl6f0PHYGcNw%2FXZVI%2BsY6i6jDU%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
font-awesome.min.css
appsushuwiqbdsijdewf.com/up/meta/fonts/Font_Awesome/
26 KB
6 KB
Stylesheet
General
Full URL
https://appsushuwiqbdsijdewf.com/up/meta/fonts/Font_Awesome/font-awesome.min.css
Requested by
Host: appsushuwiqbdsijdewf.com
URL: https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://appsushuwiqbdsijdewf.com/up/meta/Import.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:34 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 08 Oct 2021 01:48:46 GMT
server
cloudflare
etag
W/"6857-5cdcd94715b80-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p2cNpSsDb%2FPyMLTqX6LI1smPPhNIjGYqtY09saf%2FeojVIVAGnzd%2FrtgbHA4z4tGY3S9T530jWJbkBGgA999h80SuqQ777I04FqgSZOSUTReekN8pQUcc2grzawO1WnfJqre9aOfNhVfdLJg5hq0H2u6CL%2FlV8os%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
7402491aac01bb2c-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/
9 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
72 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
9 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/
85 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: appsushuwiqbdsijdewf.com
URL: https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://appsushuwiqbdsijdewf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
633363
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27433
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-1538f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niETK2RP9IE1br8OC0c7QoK1MPyGziLzLFCfB2e85XbCWGaWF9gLSRj7egN0eJV%2BBItZLIg%2FQEFgvRNYdZyzgLRVMQ%2FzFkId5k98qDWkUYavdB%2B7YZhgWbysee7mJUhByL3W0K5IcDHJfrd6ofBv5eo8"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
7402491ba83a2325-ZRH
expires
Tue, 15 Aug 2023 06:31:34 GMT
invisible.js
appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 96EC
41 KB
15 KB
Script
General
Full URL
https://appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1661400000
Requested by
Host: appsushuwiqbdsijdewf.com
URL: https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ac1267790caf560ca13d556718982628fc049862b84b475548126a085cd8a10

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bHO9uqUtB0rODbcKTEmJZhgNJn7Oz6QjZDqdMZbpuCzfgg%2BHObUA3Hi2CHpngvVfGHX9%2BZjpwvv6h6T95BmvOfg%2BOnQGExIWIVTDDs5t2NtwErl%2B7uFN9vdvWRrSTr0VL%2BnvLVmmFGwmgQo3jaKyRoOkgpcLsU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7402491c0ca05a19-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 96EC
21 KB
8 KB
Other
General
Full URL
https://appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
016a5555f3d98d852b7ffdd22aecf54394803583c6d686952d2b9dd2e53ae545

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IEGWGd2NbDbHVz1NENvZFppRgFhUw%2BQwWYzUvEHNuqF2NSmXgPgZaWa9%2Bs0m8oif7PPvrHO2zh2rlXXr4bPO2I%2BDY5bKk4dMAKs9lFSUzOiqpHgOrkDxx1XyaSU0R10GFLkT1%2Fc4vnexxJO%2Btdacj1XRujwl2MQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7402491c7db05a19-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
74024919aabbbb2c
appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 96EC
2 B
745 B
XHR
General
Full URL
https://appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/cv/result/74024919aabbbb2c
Requested by
Host: appsushuwiqbdsijdewf.com
URL: https://appsushuwiqbdsijdewf.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1661400000
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 25 Aug 2022 06:31:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9CG6eNuu72%2B5p93f0GMjwV7JHu6oSxkNQL37q3%2FFrqGCGLMKd0TQhcrmikvOpkkmqrNhKGRZ1I1Tnvl5q%2F9Q17W0LWamblpoTlnJZFuVbuxLIkuRSD0%2BDTcKmvJ%2BZe7XszsPNXiNwB68z%2Bt%2FXsmVp4jp9iPEkY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
7402491e480b5a19-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
EuclidCircularB-Regular-WebXL.ttf
appsushuwiqbdsijdewf.com/up/meta/fonts/Euclid/
151 KB
57 KB
Font
General
Full URL
https://appsushuwiqbdsijdewf.com/up/meta/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c

Request headers

Referer
https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Origin
https://appsushuwiqbdsijdewf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 08 Oct 2021 01:48:46 GMT
server
cloudflare
etag
W/"25a50-5cdcd94715b80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tx9rd%2B2t0atVImRro4it%2FQc%2B2SKBqKVU9SbLkf2SP7mXDSp5RgGh9G%2BNw2eUCrd8ip0bqcgwpsNr4otzTgfk275n7zdrDMSs2GzwxvI%2FriYBgFDHS%2B8aT5NX6aGXCa5s5nBEWvFlycOLefizxaMYjCAWckrHW%2Fs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-sfnt
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
740249223d675a19-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fa-solid-900.woff2
appsushuwiqbdsijdewf.com/up/meta/fonts/fontawesome/
78 KB
78 KB
Font
General
Full URL
https://appsushuwiqbdsijdewf.com/up/meta/fonts/fontawesome/fa-solid-900.woff2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::ac43:9a02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Referer
https://appsushuwiqbdsijdewf.com/up/meta/Import.php
Origin
https://appsushuwiqbdsijdewf.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 06:31:36 GMT
cf-cache-status
MISS
last-modified
Fri, 08 Oct 2021 01:48:46 GMT
server
cloudflare
etag
"13654-5cdcd94715b80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gyHqSwpdZfDrPgB%2F%2Bd1v%2FYXbbo9tnFwiGApD%2FIkpaIbvHfaR2LwVKaXVowQi0CZFyVqsS3AbnUYJ47DheKdh8BQ9rh447fbo6QKs65hnr1zn9z85y1C1BKQwDTnq5Wil8%2FxK0x48S8LfQ7lhbpuLYBiZBn7YGf0%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
740249223d685a19-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
79444

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery boolean| p

1 Cookies

Domain/Path Name / Value
.appsushuwiqbdsijdewf.com/ Name: __cf_bm
Value: FoyP1bsOVzseH289rPk3F7ltpp8voGH3Le1zGyl0x8U-1661409095-0-AY1asvqAPF6p/FzQf4r7ybQRWmF0jzRLraIeAnqQ/nmkPwj3NA3ZDddkSeKWF6rtEYyMMMVXP6QrDfv65Ue14wG8+SiB+Ausu2R6AyE7oBhZXb/sTTVHOkUirva7CuzxkA==