klimasdao.finance Open in urlscan Pro
190.115.30.233  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response klimasdao.finance/metamask/	557 KB 132 KB	90ms 52ms	Document text/html	190.115.30.233 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://klimasdao.finance/metamask/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.30.233 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 01780e2d315cf7b42ddbb4653a537e213164843eed560b0fcb1cbbb8aef86027 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server ddos-guard content-security-policy upgrade-insecure-requests; date Mon, 15 Nov 2021 01:11:33 GMT last-modified Tue, 09 Nov 2021 11:00:36 GMT accept-ranges bytes content-type text/html content-encoding br vary Accept-Encoding
GET H2	200	font-awesome.min.css klimasdao.finance/metamask/fonts/Font_Awesome/	26 KB 6 KB	16ms 16ms	Stylesheet text/css	190.115.30.233 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://klimasdao.finance/metamask/fonts/Font_Awesome/font-awesome.min.css Requested by Host: klimasdao.finance URL: https://klimasdao.finance/metamask/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.30.233 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding br last-modified Tue, 09 Nov 2021 11:00:36 GMT server ddos-guard age 2406 date Mon, 15 Nov 2021 00:31:27 GMT vary Accept-Encoding content-type text/css accept-ranges bytes content-length 5767
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	72 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/	85 KB 28 KB	194ms 26ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: klimasdao.finance URL: https://klimasdao.finance/metamask/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://klimasdao.finance/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 15 Nov 2021 01:11:34 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 959973 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27433 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1538f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yjvHymN%2FlYspd0OE5nucC4v9KsVCFmgEE1OziGO1%2BcyxGXIl3C1XhDngJqns81llQ6JnFY2CezrEC2dIy5HpArpV%2Be5xlxgbuGhP%2B5pw6Xm%2FUXrxnNbDoKTFdmIBxZQ4kpCGyHF3r%2FyjXO23mtLHXQpR"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6ae49b3729885a01-MXP expires Sat, 05 Nov 2022 01:11:34 GMT
GET H2	200	EuclidCircularB-Regular-WebXL.ttf klimasdao.finance/metamask/fonts/Euclid/	151 KB 57 KB	18ms 16ms	Font font/ttf	190.115.30.233 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://klimasdao.finance/metamask/fonts/Euclid/EuclidCircularB-Regular-WebXL.ttf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.30.233 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://klimasdao.finance/metamask/index.html Origin https://klimasdao.finance Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding gzip last-modified Tue, 09 Nov 2021 11:00:36 GMT server ddos-guard age 2407 date Mon, 15 Nov 2021 00:31:28 GMT vary Accept-Encoding content-type font/ttf accept-ranges bytes content-length 58727
GET H2	200	fa-solid-900.woff2 klimasdao.finance/metamask/fonts/fontawesome/	78 KB 78 KB	74ms 73ms	Font font/woff2	190.115.30.233 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://klimasdao.finance/metamask/fonts/fontawesome/fa-solid-900.woff2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.30.233 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://klimasdao.finance/metamask/index.html Origin https://klimasdao.finance Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding gzip last-modified Tue, 09 Nov 2021 11:00:36 GMT server ddos-guard age 0 date Mon, 15 Nov 2021 01:11:35 GMT vary Accept-Encoding content-type font/woff2 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery boolean| p

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.klimasdao.finance/	1970-01-20 07:27:54	Name: __ddg1 Value: 3NBVSAk1ihgABkgcFZvz

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
klimasdao.finance
190.115.30.233
2606:4700::6810:125e
01780e2d315cf7b42ddbb4653a537e213164843eed560b0fcb1cbbb8aef86027
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
d40d3161e420b7dd64253af81204498485857f2364ff312aff19ddf457d67761
ec6509b3ba6fdcf3e3fdf7ef2f80582e5f4fa8f39f9d94a3da00bdc865563056
f279295f81cdfcf5bc2a01ed3ffbd6949713ba9ac40f3aec0a5075bc0ad1f5f1