meta-mask-app.webflow.io Open in urlscan Pro
151.101.130.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://meta-mask-app.webflow.io/
Submission: On September 24 via api (September 24th 2023, 7:33:12 pm UTC) from JP — Scanned from JP

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 5 domains to perform 12 HTTP transactions. The main IP is 151.101.130.188, located in United States and belongs to FASTLY, US. The main domain is meta-mask-app.webflow.io.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2023 Q1 on February 25th 2023. Valid for: a year.

This is the only time meta-mask-app.webflow.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.130.188 151.101.130.188	54113 (FASTLY) (FASTLY)
7	3.163.165.62 3.163.165.62	16509 (AMAZON-02) (AMAZON-02)
1	2404:6800:400... 2404:6800:4004:820::200a	15169 (GOOGLE) (GOOGLE)
1	13.35.51.120 13.35.51.120	16509 (AMAZON-02) (AMAZON-02)
1	2404:6800:400... 2404:6800:4004:823::200a	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:824::2003	15169 (GOOGLE) (GOOGLE)
12	7

1 151.101.130.188 (United States)

ASN54113 (FASTLY, US)

meta-mask-app.webflow.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 3.163.165.62 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-163-165-62.sea90.r.cloudfront.net

uploads-ssl.webflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:820::200a (Australia)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.51.120 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-51-120.nrt20.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:823::200a (Australia)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:824::2003 (Australia)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	webflow.com uploads-ssl.webflow.com — Cisco Umbrella Rank: 18588	90 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 720 fonts.googleapis.com — Cisco Umbrella Rank: 113	7 KB
1	gstatic.com fonts.gstatic.com	19 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	31 KB
1	webflow.io meta-mask-app.webflow.io	3 KB
12	5

	Domain	Requested by
7	uploads-ssl.webflow.com	meta-mask-app.webflow.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	ajax.googleapis.com
1	d3e54v103j8qbb.cloudfront.net	meta-mask-app.webflow.io
1	ajax.googleapis.com	meta-mask-app.webflow.io
1	meta-mask-app.webflow.io
12	6

This site contains no links.

Subject Issuer	Validity	Valid
*.webflow.io GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-25` - `2024-03-28`	a year	crt.sh
uploads-ssl.webflow.com Amazon RSA 2048 M02	`2023-07-29` - `2024-08-26`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://meta-mask-app.webflow.io/
Frame ID: 0C67DFCC7001A5B9B34A138B9DEBCA10
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

meta-mask-app

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
googleapis\.com/.+webfont

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

7
IPs

2
Countries

152 kB
Transfer

362 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
meta-mask-app.webflow.io/ 7 KB
3 KB 8ms
2ms Document
text/html 151.101.130.188
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://meta-mask-app.webflow.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.188 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

eb28a3fca32013d4e34054636a28f6bb92471101ba3f6e60d5b1491113b6b719

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
age: 66200
content-encoding: gzip
content-length: 2442
content-security-policy: frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com
content-type: text/html
date: Sun, 24 Sep 2023 19:33:07 GMT
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, HIT
x-cache-hits: 42, 1
x-lambda-id: 38d08d3f-20a2-4060-bca4-5e3e2120ae8d
x-served-by: cache-iad-kcgs7200042-IAD, cache-nrt-rjtf7700035-NRT
x-timer: S1695583988.825013,VS0,VE1

GET
H2 200 meta-mask-app.webflow.030b46431.css
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/css/ 46 KB
10 KB 299ms
103ms Stylesheet
text/css 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/css/meta-mask-app.webflow.030b46431.css
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ea5b95fba54927feb0aab0af0cf5149766ba7d11195bb21b5729b9264ebbf804

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:35:04 GMT
content-encoding: gzip
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
x-amz-version-id: bcHQG8pj4bC4_kQjQEaohqiWsF0IB0Ty
age: 3485
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 9997
last-modified: Tue, 19 Sep 2023 11:29:44 GMT
server: AmazonS3
etag: "a6969f6eb73011a635dbef53cf1dd733"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: YdCtVIZSWBoXJBmetPHStDkl_oQ0VIoLRzuMqaoSizQcDwG-92tXdQ==

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 13 KB
6 KB 44ms
3ms Script
text/javascript 2404:6800:4004:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:820::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 04:41:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 04:41:01 GMT

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
31 KB 14ms
4ms Script
application/javascript 13.35.51.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6508e54c2ee63b4e56b690bc
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.51.120 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-51-120.nrt20.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://meta-mask-app.webflow.io/
Origin: https://meta-mask-app.webflow.io
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 13:05:39 GMT
content-encoding: gzip
via: 1.1 3169a86fe70f3974b3b8377d728ccf44.cloudfront.net (CloudFront)
age: 23250
x-amz-cf-pop: NRT20-C1
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: Stydwtk5f5fyzKfy_fPaG39B_ki1oGk2xh0CG8MS_TqtNKEJLHcFQw==

GET
H2 200 webflow.2e9aaf1e4.js Show response
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/js/ 57 KB
21 KB 317ms
121ms Script
text/javascript 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/js/webflow.2e9aaf1e4.js
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4b017a688636031c9362b7cbfd8abd389c253ab44ddf30267b14c48958ce645b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: DPQOslIgF35XZJEovUzvTc0wb.cQkKdZ
content-encoding: gzip
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
date: Sun, 24 Sep 2023 18:35:04 GMT
age: 3485
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20685
last-modified: Tue, 19 Sep 2023 11:29:44 GMT
server: AmazonS3
etag: "9dfc96c33d38ad7e60af493c6d03a772"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: _CFHyesdL4TSYh2qzE_ot6vbMH8VRr2HI1WwIBAKDD19xONdLxcX7w==

GET
H2 200 css
fonts.googleapis.com/ 730 B
781 B 88ms
44ms Stylesheet
text/css 2404:6800:4004:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Varela:400

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e7f9186616a101e387b3fc471193a47bb188d95aca590bb09719cca30e064848

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 19:33:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 19:33:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 19:33:08 GMT

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-ttf

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05dae8fbb96f3675f8b2981e8ead256a0f74ccba053fb08396c9a5fe99c54845

Request headers

Referer
Origin: https://meta-mask-app.webflow.io
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: application/x-font-ttf;charset=utf-8

GET
H2 200 6508e7cbb9bc189afdbd64a7_logo.svg
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/ 12 KB
4 KB 100ms
99ms Image
image/svg+xml 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/6508e7cbb9bc189afdbd64a7_logo.svg
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:24:42 GMT
x-amz-version-id: uzNPD3ifQWm8gX4YKcbXUjnK.1fkj7yi
content-encoding: br
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
age: 133707
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 19 Sep 2023 00:14:06 GMT
server: AmazonS3
etag: W/"51bcea2625eb2c6e9268a7377a792c86"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: waej7mxzkLfY5B6ry6lagulqyvKlEFokmed5wJ1veKW48hMk9XgUXw==

GET
H2 200 6508e905c7c357978be5a240_metak-p-800.webp
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/ 19 KB
20 KB 117ms
116ms Image
image/webp 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/6508e905c7c357978be5a240_metak-p-800.webp
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4549a9bffa68a0d396b185fe2a24452027b61ac3a1a519f5559d9a93784d0a73

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:35:04 GMT
x-amz-version-id: M6uhJ3.urIimgwe8ONOW6d9LCY51OrSf
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
age: 3485
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19564
last-modified: Tue, 19 Sep 2023 00:19:26 GMT
server: AmazonS3
etag: "815d5aca71cceb4c7b20aed8781a89b1"
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 9ONLdYveVvJeSpSKHYVUeelefloToHhH-gQKlWpLUzDYDfBdZ6SNxA==

GET
H2 200 6508e883b73cd5f48ea078bc_wallet-illo.svg
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/ 36 KB
12 KB 133ms
133ms Image
image/svg+xml 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/6508e883b73cd5f48ea078bc_wallet-illo.svg
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 596228062de19a21cfda4d3129b3a5d397c5a71509e096b8f67fb8c4f22aa56d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:24:42 GMT
x-amz-version-id: qS689ROm29fTJRJsQ6nbRZHG7wveiSVm
content-encoding: br
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
age: 133707
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 19 Sep 2023 00:17:09 GMT
server: AmazonS3
etag: W/"63ad7f01f67accd6aafb47999640abe5"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: XQpDY_znZEcMAqET5UA9OnvI0YXp0bw43pkgrW4LmBOZvFLXAsJmag==

GET
H2 200 6508e8a256b1df28da37be98_Explore-illo.svg
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/ 36 KB
13 KB 145ms
145ms Image
image/svg+xml 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/6508e8a256b1df28da37be98_Explore-illo.svg
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:24:42 GMT
x-amz-version-id: 9FI1QEIDG4oi2pJpvSf3wpshZU9uWKf5
content-encoding: br
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
age: 133707
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 19 Sep 2023 00:17:40 GMT
server: AmazonS3
etag: W/"46fb450c5ecf6da758bca0975551f056"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: nfZa9SekNN2_05pLAMFA4sOcR_y_sr2PVWpQOds_HSUohfG5wdE6kg==

GET
H2 200 6508e8c4796514ff9766242b_Browse-illo.svg
uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/ 28 KB
11 KB 156ms
155ms Image
image/svg+xml 3.163.165.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/6508e54c2ee63b4e56b690bc/6508e8c4796514ff9766242b_Browse-illo.svg
Requested by: Host: meta-mask-app.webflow.io
URL: https://meta-mask-app.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.165.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-163-165-62.sea90.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 517c0c6b44ede59070fb138aab7e875b9c230a227295f9612c32dabb9b0bdb13

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://meta-mask-app.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:24:42 GMT
x-amz-version-id: 9YcBtcNTtX858LiFLQqbmykubBPAUeWK
content-encoding: br
via: 1.1 64e31a85c2af2cc10d070383c1f71288.cloudfront.net (CloudFront)
age: 133707
x-amz-cf-pop: SEA900-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 19 Sep 2023 00:18:14 GMT
server: AmazonS3
etag: W/"afeafb6a9f14bd7771c63015be5a05c9"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: Nrme2jwVvWNqgvzvRN_CSabzOevG6Bh_PUkSYSi5gcsev4F2zF6QZg==

GET
H2 200 DPEtYwqExx0AWHX5Ax4E.woff2
fonts.gstatic.com/s/varela/v16/ 18 KB
19 KB 43ms
3ms Font
font/woff2 2404:6800:4004:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/varela/v16/DPEtYwqExx0AWHX5Ax4E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Varela:400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:824::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b113dc88c313c4beefc0c00d42ffc7e8c4124154e55a00c2b3f9e9273dd1dba8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://meta-mask-app.webflow.io
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:34 GMT
x-content-type-options: nosniff
age: 104734
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18940
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:06:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 14:27:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
d3e54v103j8qbb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
meta-mask-app.webflow.io
uploads-ssl.webflow.com
13.35.51.120
151.101.130.188
2404:6800:4004:820::200a
2404:6800:4004:823::200a
2404:6800:4004:824::2003
3.163.165.62
05dae8fbb96f3675f8b2981e8ead256a0f74ccba053fb08396c9a5fe99c54845
4549a9bffa68a0d396b185fe2a24452027b61ac3a1a519f5559d9a93784d0a73
4b017a688636031c9362b7cbfd8abd389c253ab44ddf30267b14c48958ce645b
517c0c6b44ede59070fb138aab7e875b9c230a227295f9612c32dabb9b0bdb13
596228062de19a21cfda4d3129b3a5d397c5a71509e096b8f67fb8c4f22aa56d
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
8ba2b37fd4f2f3c19c10109bc6111d3d71692c78f9351f1eb2a8cab5231b77b5
b113dc88c313c4beefc0c00d42ffc7e8c4124154e55a00c2b3f9e9273dd1dba8
e7f9186616a101e387b3fc471193a47bb188d95aca590bb09719cca30e064848
ea5b95fba54927feb0aab0af0cf5149766ba7d11195bb21b5729b9264ebbf804
eb28a3fca32013d4e34054636a28f6bb92471101ba3f6e60d5b1491113b6b719
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

meta-mask-app.webflow.io Open in urlscan Pro 151.101.130.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

50 %IPv6

5 Domains

6 Subdomains

7 IPs

2 Countries

152 kBTransfer

362 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

meta-mask-app.webflow.io Open in urlscan Pro
151.101.130.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

7
IPs

2
Countries

152 kB
Transfer

362 kB
Size

0
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!