metamask.io-compliance.org
Open in
urlscan Pro
129.213.159.3
Malicious Activity!
Public Scan
Effective URL: https://metamask.io-compliance.org/docs/auth?user=MzA2NTYzNjMzNzM5NjMzNjMzNjU2NjM3NjUzMDM3MzIzNzYzNjUzNjM2MzkzNzMwNjI2MzMwNjQzMjM5M...
Submission: On August 27 via manual from GR — Scanned from NL
Summary
TLS certificate: Issued by R3 on August 24th 2022. Valid for: 3 months.
This is the only time metamask.io-compliance.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metamask (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 216.201.82.88 216.201.82.88 | 46562 (PERFORMIVE) (PERFORMIVE) | |
8 | 129.213.159.3 129.213.159.3 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
9 | 2600:9000:214... 2600:9000:214f:9600:12:94b3:c380:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:50c0:800... 2606:50c0:8001::153 | 54113 (FASTLY) (FASTLY) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 7 |
ASN46562 (PERFORMIVE, US)
PTR: visicom-95.nationalnet.com
www.mystart.com |
ASN16509 (AMAZON-02, US)
images.ctfassets.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
ctfassets.net
images.ctfassets.net — Cisco Umbrella Rank: 3950 |
70 KB |
8 |
io-compliance.org
metamask.io-compliance.org |
66 KB |
3 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 286 fonts.googleapis.com — Cisco Umbrella Rank: 54 |
94 KB |
2 |
gstatic.com
fonts.gstatic.com |
17 KB |
2 |
metamask.io
metamask.io — Cisco Umbrella Rank: 259517 |
88 KB |
1 |
mystart.com
1 redirects
www.mystart.com — Cisco Umbrella Rank: 427367 |
627 B |
1 |
dokwo.com
1 redirects
dokwo.com |
987 B |
24 | 7 |
Domain | Requested by | |
---|---|---|
9 | images.ctfassets.net |
metamask.io-compliance.org
|
8 | metamask.io-compliance.org |
metamask.io-compliance.org
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | metamask.io |
metamask.io-compliance.org
|
2 | ajax.googleapis.com |
metamask.io-compliance.org
|
1 | fonts.googleapis.com |
ajax.googleapis.com
|
1 | www.mystart.com | 1 redirects |
1 | dokwo.com | 1 redirects |
24 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
metamask.io-compliance.org R3 |
2022-08-24 - 2022-11-22 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
images.ctfassets.net Amazon |
2022-02-17 - 2023-03-18 |
a year | crt.sh |
metamask.io R3 |
2022-08-20 - 2022-11-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metamask.io-compliance.org/docs/auth?user=MzA2NTYzNjMzNzM5NjMzNjMzNjU2NjM3NjUzMDM3MzIzNzYzNjUzNjM2MzkzNzMwNjI2MzMwNjQzMjM5MzEzNTM5NjYzMzM0MzIzNTM5Mzg=
Frame ID: 14168C5CBEC4E9A55D5669621FAE408A
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
FAQsPage URL History Show full URLs
-
https://dokwo.com/redirect/job?url=aHR0cHM6Ly93d3cubXlzdGFydC5jb20vYXBpL3NoYXJlL3NoYXJlLnBocD9...
HTTP 302
https://www.mystart.com/api/share/share.php?ptssdjlsff_cid=3887137145&media=https://news.google.com/... HTTP 302
https://metamask.io-compliance.org/?todaynews Page URL
- https://metamask.io-compliance.org/docs/auth?user=MzA2NTYzNjMzNzM5NjMzNjMzNjU2NjM3NjUzMDM3MzIzNzYzNjUzNjM2MzkzN... Page URL
Detected technologies
AdonisJS (Web frameworks) ExpandDetected patterns
Google Font API (Font Scripts) Expand
Detected patterns
- googleapis\.com/.+webfont
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://dokwo.com/redirect/job?url=aHR0cHM6Ly93d3cubXlzdGFydC5jb20vYXBpL3NoYXJlL3NoYXJlLnBocD9wdHNzZGpsc2ZmX2NpZD0zODg3MTM3MTQ1Jm1lZGlhPWh0dHBzOi8vbmV3cy5nb29nbGUuY29tL2FydGljbGVzLzYzZTVkZmM0MWZkMTNhNWYwOGVmOGYxMGRlMTE0Nzg5JnJlZGlyZWN0PWh0dHBzOi8vbWV0YW1hc2suaW8tY29tcGxpYW5jZS5vcmcvP3RvZGF5bmV3cw==
HTTP 302
https://www.mystart.com/api/share/share.php?ptssdjlsff_cid=3887137145&media=https://news.google.com/articles/63e5dfc41fd13a5f08ef8f10de114789&redirect=https://metamask.io-compliance.org/?todaynews HTTP 302
https://metamask.io-compliance.org/?todaynews Page URL
- https://metamask.io-compliance.org/docs/auth?user=MzA2NTYzNjMzNzM5NjMzNjMzNjU2NjM3NjUzMDM3MzIzNzYzNjUzNjM2MzkzNzMwNjI2MzMwNjQzMjM5MzEzNTM5NjYzMzM0MzIzNTM5Mzg= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://dokwo.com/redirect/job?url=aHR0cHM6Ly93d3cubXlzdGFydC5jb20vYXBpL3NoYXJlL3NoYXJlLnBocD9wdHNzZGpsc2ZmX2NpZD0zODg3MTM3MTQ1Jm1lZGlhPWh0dHBzOi8vbmV3cy5nb29nbGUuY29tL2FydGljbGVzLzYzZTVkZmM0MWZkMTNhNWYwOGVmOGYxMGRlMTE0Nzg5JnJlZGlyZWN0PWh0dHBzOi8vbWV0YW1hc2suaW8tY29tcGxpYW5jZS5vcmcvP3RvZGF5bmV3cw== HTTP 302
- https://www.mystart.com/api/share/share.php?ptssdjlsff_cid=3887137145&media=https://news.google.com/articles/63e5dfc41fd13a5f08ef8f10de114789&redirect=https://metamask.io-compliance.org/?todaynews HTTP 302
- https://metamask.io-compliance.org/?todaynews
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
metamask.io-compliance.org/ Redirect Chain
|
186 B 775 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
auth
metamask.io-compliance.org/docs/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
metamask.io-compliance.org/docs/assets/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webflow.css
metamask.io-compliance.org/docs/assets/css/ |
42 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
metamask-staging-2.webflow.css
metamask.io-compliance.org/docs/assets/css/ |
138 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfont.js
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ |
13 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 88 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.all.min.js
metamask.io-compliance.org/docs/assets/js/ |
130 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wordlists.js
metamask.io-compliance.org/docs/assets/js/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error.js
metamask.io-compliance.org/docs/assets/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mm-logo.svg
images.ctfassets.net/9sy2a0egs6zh/4zJfzJbG3kTDSk5Wo4RJI1/1b363263141cf629b28155e2625b56c9/ |
12 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-aave.png
images.ctfassets.net/9sy2a0egs6zh/66xW3q4QV8YAl69ZT9tFGR/b601d5e628197b42ad92d2ac5f1929a4/ |
9 KB 10 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-axieinfinity.png
images.ctfassets.net/9sy2a0egs6zh/sRi3IfUyBXgEbKqIEGYOf/01c1bce3dc97d8a3ae9fbb9f30845786/ |
28 KB 29 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-compound.png
images.ctfassets.net/9sy2a0egs6zh/5OUzGQmzOnMzYZDpRzvSjp/a963c84101729a54fade58e13046bca4/ |
6 KB 6 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-gitcoin.png
images.ctfassets.net/9sy2a0egs6zh/3je4UxBCkGOdxGshD4Q1yt/0c5d774242afc22255dc2df374915148/ |
4 KB 5 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-maker.png
images.ctfassets.net/9sy2a0egs6zh/12oxd35siV9K1gd4XqMVqX/1c0d61f9ae158806f1625a4224fc703c/ |
3 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-opensea.png
images.ctfassets.net/9sy2a0egs6zh/4qGhgWlzcQfkICzCGJ0xVV/c6809a36e571f006f9e5c2999bfcea59/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-rarible.png
images.ctfassets.net/9sy2a0egs6zh/4JYnVbP6bKsQgAUN1FOAxQ/9689c7760674f824f36ac46a4b646ef1/ |
4 KB 4 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dapp-uniswap.png
images.ctfassets.net/9sy2a0egs6zh/2g8PJzqRsd9qxe9oaC83ia/477b426c3ac16b257469daf0819b4d9b/ |
6 KB 7 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
752 B 832 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EuclidCircularB-Regular-WebXL.woff2
metamask.io/fonts/ |
44 KB 45 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 2 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EuclidCircularB-Bold-WebXL.woff2
metamask.io/fonts/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
fonts.gstatic.com/s/changaone/v18/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
fonts.gstatic.com/s/changaone/v18/ |
8 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metamask (Crypto)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| WebFont function| $ function| jQuery function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| allowedWords number| phraseMin number| phraseMax function| Toast function| toasted function| inputToasted function| done function| googleanalytics3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dokwo.com/ | Name: adonis-session Value: s%3AeyJtZXNzYWdlIjoiY2w3Ym50eGwwMGk5MTBtNTJoMm9iZjVyMyIsInB1cnBvc2UiOiJhZG9uaXMtc2Vzc2lvbiJ9.6C94SMGgtx3wVbZM-wPTyGSyyvuekb171CUCQxdISeE |
|
dokwo.com/ | Name: cl7bntxl00i910m52h2obf5r3 Value: e%3AwRTHmbkA92lMiOjmAV15G1SP8GPjN4f_mR_0blnxcMKEg0UklfxqbZUWTETF3y_95satgxzo2X6vtX2WXSlNNA.QWZzVVZDRWh0N1N5RllmLQ.Xqb7Gt9xgk8fHZt6vQmEM5HrHlMNOwLwYw5AGTHJS-I |
|
metamask.io-compliance.org/ | Name: PHPSESSID Value: l1peunt7fr3mqgmei997uj0o2c |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
dokwo.com
fonts.googleapis.com
fonts.gstatic.com
images.ctfassets.net
metamask.io
metamask.io-compliance.org
www.mystart.com
129.213.159.3
216.201.82.88
2600:9000:214f:9600:12:94b3:c380:93a1
2606:50c0:8001::153
2a00:1450:4001:806::200a
2a00:1450:4001:812::200a
2a00:1450:4001:828::2003
2a06:98c1:3121::3
05021b7ce3812e2e2ad6d6d98f3fb03404fba1744751a2ceec4dc271a2dfa5e9
05dae8fbb96f3675f8b2981e8ead256a0f74ccba053fb08396c9a5fe99c54845
0a3909d16a1177ffaeb7ccff9759c348d84b77646f779cdfe477286737e97590
182312e7dc69bc99a4511f87330d7103340ecb553ff5100e0a6dffc51a95f269
25194b73ec31c5fa1e315cd30fd7428f4075d725740663aea2e60d1de61288cb
5347403d1c460c640fea9d61f86d16f18b1af9e92a1b0857a4b18784f5c8b1e5
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
6faa6d2cc22eee6ab470d647df6e05854b65afb94b6bca697949e87ffdd9aa49
6fdbf627054ca6d4c688751f988a28196a6f634c5a54177b708399fcaeffa045
72149d23cd77db0acf0dfbbf35b384f836d394b5f6e21687fa4c96751b4fafac
7785937cd3e4585680b7520f9c8748af75df87feabb3d51ef0be0e4e5daa63e8
802e8b84706da1ef1028f35f53234a1a035d9705d28692cef23aa9f861d6fda9
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df
8daea9a40be31e567300edc7daeb077f232cf7c32baed3aebff9ee9260b0d5a0
8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b
a40f7e82302ce2fc7131fe01cc4f91f80b9dfbe3fc8a2df7e980794bbb19e70e
b0b31cd8e1b55c67016da0589d939704903bc3d2ef236a71ba025d57fbbe2b1e
c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff
e2e7d452cb6959f65161c66f421cf7c899566ffc171923c16c52622d407e8152
e713431d868b9b6cfea7a89d3532a4fd747f6176e8172b94550bc0ca12913450
e80a385671c3becdc811d5445432feb032cdd8928772cb5219afe87e291c9146
fbd0536d5b92c0dbe6ad2637800ae8da10c20755b564a3575bd12bba57f73b18
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e