metamask.cirii.co Open in urlscan Pro
162.241.224.140 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://metamask.cirii.co/af645ea/Info.htm
Submission: On May 27 via manual (May 27th 2022, 1:13:52 pm UTC) from PL — Scanned from DE

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 162.241.224.140, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is metamask.cirii.co.

This is the only time metamask.cirii.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Metamask (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
11	162.241.224.140 162.241.224.140	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	162.241.148.128 162.241.148.128	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
12	2

11 162.241.224.140 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5189.bluehost.com

metamask.cirii.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.241.148.128 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-148-128.unifiedlayer.com

api.growfastorganic.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	cirii.co metamask.cirii.co	557 KB
1	growfastorganic.in api.growfastorganic.in	183 B
12	2

	Domain	Requested by
11	metamask.cirii.co	metamask.cirii.co
1	api.growfastorganic.in	metamask.cirii.co
12	2

This site contains links to these domains. Also see Links.

Domain
support.metamask.io

Subject Issuer	Validity	Valid
*.growfastorganic.in R3	`2022-05-06` - `2022-08-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://metamask.cirii.co/af645ea/Info.htm
Frame ID: 869546C0A736B9CB3B26A9A043D87D73
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MetaMask

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

557 kB
Transfer

1276 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://support.metamask.io/
Title: MetaMask Support

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Info.htm Show response metamask.cirii.co/af645ea/	13 KB 5 KB	278ms 153ms	Document text/html	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `e6b76ca9e44aeb121cbbe8f23bc6a95d41c42feab6df86d53a281a281510989c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Upgrade, Keep-Alive Content-Encoding gzip Content-Length 4857 Content-Type text/html Date Fri, 27 May 2022 13:13:48 GMT Keep-Alive timeout=5, max=75 Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Upgrade h2,h2c Vary Accept-Encoding host-header c2hhcmVkLmJsdWVob3N0LmNvbQ==
GET H/1.1	200 OK	index.css metamask.cirii.co/af645ea/style/	752 KB 168 KB	138ms 137ms	Stylesheet text/css	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/index.css Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `f1127ec0ab64a9b6b33538b684a6dabb76c16e209fdf0d5c5f7b723125d93c2f` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Content-Encoding gzip Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Keep-Alive timeout=5, max=74
GET H/1.1	200 OK	main.eba238ef.chunk.css metamask.cirii.co/af645ea/style/	898 B 843 B	283ms 158ms	Stylesheet text/css	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/main.eba238ef.chunk.css Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `6d3332575dbf8b576f8f1d6366861601d8a962f566179c21b8583ae08a13e831` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Content-Encoding gzip Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Vary Accept-Encoding Upgrade h2,h2c Connection Upgrade, Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type text/css Keep-Alive timeout=5, max=75 Content-Length 487
GET H/1.1	200 OK	bundle.js Show response metamask.cirii.co/af645ea/style/	52 KB 13 KB	290ms 161ms	Script application/javascript	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/bundle.js Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `c4ee94725b477419a3960fdfdd78914425c0665b0668755122ffeb5002df4bdc` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Content-Encoding gzip Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Vary Accept-Encoding Upgrade h2,h2c Connection Upgrade, Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type application/javascript Keep-Alive timeout=5, max=75 Content-Length 13001
GET H/1.1	200 OK	metamask-logo-horizontal.83aa0127.svg metamask.cirii.co/af645ea/style/	5 KB 5 KB	274ms 143ms	Image image/svg+xml	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://metamask.cirii.co/af645ea/style/metamask-logo-horizontal.83aa0127.svg Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `a2779239ae69999a04e2e98ee5be8a282a21b41b7b4c6ce00c881ecc82fcaa50` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Upgrade h2,h2c Connection Upgrade, Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type image/svg+xml Keep-Alive timeout=5, max=75 Content-Length 5020
GET H/1.1	200 OK	metamask-fox.7db94670.svg metamask.cirii.co/af645ea/style/	3 KB 3 KB	134ms 133ms	Image image/svg+xml	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://metamask.cirii.co/af645ea/style/metamask-fox.7db94670.svg Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `b855851451c3eb7220bc7331d6cf7f19dad4580ebc35610211f028848ba7fc34` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Content-Type image/svg+xml Connection Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Keep-Alive timeout=5, max=74 Content-Length 3231
GET H/1.1	200 OK	2.6aed8c2a.chunk.js Show response metamask.cirii.co/af645ea/style/	137 KB 56 KB	281ms 157ms	Script application/javascript	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/2.6aed8c2a.chunk.js Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `bb40694a558c75406abed70529e01cd8d842f86ef6e2fad0c819de7e88085222` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Content-Encoding gzip Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Vary Accept-Encoding Upgrade h2,h2c Transfer-Encoding chunked Connection Upgrade, Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type application/javascript Keep-Alive timeout=5, max=75
GET H/1.1	200 OK	main.e0985ad8.chunk.js Show response metamask.cirii.co/af645ea/style/	16 KB 6 KB	258ms 133ms	Script application/javascript	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/main.e0985ad8.chunk.js Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/Info.htm Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `ff73b3098a9334065dba72b07910fc8a3427eff120f72557c4f477669c00cdbf` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/Info.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:48 GMT Content-Encoding gzip Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Vary Accept-Encoding Upgrade h2,h2c Connection Upgrade, Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Content-Type application/javascript Keep-Alive timeout=5, max=75 Content-Length 5753
GET H/1.1	200 OK	caret-down.svg metamask.cirii.co/af645ea/style/	164 B 452 B	132ms 132ms	Image image/svg+xml	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://metamask.cirii.co/af645ea/style/caret-down.svg Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/style/index.css Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `e5ca4b439e879644b1528ecc7c538a6240ee9210a16a63861a5086c15815b026` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/af645ea/style/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:49 GMT Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Content-Type image/svg+xml Connection Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Keep-Alive timeout=5, max=73 Content-Length 164
GET H/1.1	200 OK	EuclidCircularB-Regular-WebXL.ttf metamask.cirii.co/af645ea/style/	151 KB 151 KB	136ms 136ms	Font font/ttf	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/EuclidCircularB-Regular-WebXL.ttf Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/style/index.css Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c` Request headers Referer http://metamask.cirii.co/af645ea/style/index.css Origin http://metamask.cirii.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:49 GMT Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Content-Type font/ttf Connection Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Keep-Alive timeout=5, max=74 Content-Length 154192
GET H/1.1	200 OK	EuclidCircularB-Bold-WebXL.ttf metamask.cirii.co/af645ea/style/	147 KB 148 KB	132ms 131ms	Font font/ttf	162.241.224.140 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://metamask.cirii.co/af645ea/style/EuclidCircularB-Bold-WebXL.ttf Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/style/index.css Protocol HTTP/1.1 Server 162.241.224.140 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5189.bluehost.com Software Apache / Resource Hash `df4f17393abc2d0e8ea15d6b55644cfdee10d34445d6c26204f427554f3754de` Request headers Referer http://metamask.cirii.co/af645ea/style/index.css Origin http://metamask.cirii.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Fri, 27 May 2022 13:13:49 GMT Last-Modified Thu, 26 May 2022 20:25:14 GMT Server Apache Accept-Ranges bytes Content-Type font/ttf Connection Keep-Alive host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Keep-Alive timeout=5, max=73 Content-Length 150928
GET H2	200	/ api.growfastorganic.in/MT/	0 183 B	1714ms 1417ms	Image text/html	162.241.148.128 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://api.growfastorganic.in/MT/ Requested by Host: metamask.cirii.co URL: http://metamask.cirii.co/af645ea/style/index.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.148.128 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-148-128.unifiedlayer.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer http://metamask.cirii.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers pragma no-cache date Fri, 27 May 2022 13:13:49 GMT cache-control no-store, no-cache, must-revalidate expires Thu, 19 Nov 1981 08:52:00 GMT server Apache content-length 0 content-type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Metamask (Crypto)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.growfastorganic.in
metamask.cirii.co
162.241.148.128
162.241.224.140
08b11e464af41dc1764715793aee5078e632b68606feb061b996f3ff8be7401c
6d3332575dbf8b576f8f1d6366861601d8a962f566179c21b8583ae08a13e831
a2779239ae69999a04e2e98ee5be8a282a21b41b7b4c6ce00c881ecc82fcaa50
b855851451c3eb7220bc7331d6cf7f19dad4580ebc35610211f028848ba7fc34
bb40694a558c75406abed70529e01cd8d842f86ef6e2fad0c819de7e88085222
c4ee94725b477419a3960fdfdd78914425c0665b0668755122ffeb5002df4bdc
df4f17393abc2d0e8ea15d6b55644cfdee10d34445d6c26204f427554f3754de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5ca4b439e879644b1528ecc7c538a6240ee9210a16a63861a5086c15815b026
e6b76ca9e44aeb121cbbe8f23bc6a95d41c42feab6df86d53a281a281510989c
f1127ec0ab64a9b6b33538b684a6dabb76c16e209fdf0d5c5f7b723125d93c2f
ff73b3098a9334065dba72b07910fc8a3427eff120f72557c4f477669c00cdbf

metamask.cirii.co Open in urlscan Pro 162.241.224.140 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

8 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

557 kBTransfer

1276 kBSize

0 Cookies

1 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

metamask.cirii.co Open in urlscan Pro
162.241.224.140 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

557 kB
Transfer

1276 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!