Report - metamaskonline.xyz/swaps.html

Report Overview

Visited public
2023-11-15 07:45:16
Tags
URL
metamaskonline.xyz/swaps.html
Finishing URL
metamaskonline.xyz/swaps.html
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Title
Buy, Store and Swap Tokens | MetaMask

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
metamask.icu	unknown	2023-01-17	2020-06-02 02:18:52	2023-10-07 14:17:07	862 B	3.6 kB	199.59.243.225
fonts.googleapis.com	8877	2005-01-25	2013-06-10 22:14:26	2023-11-15 03:06:09	451 B	1.4 kB	142.250.74.106
metamaskonline.xyz	unknown	2023-11-14	2023-11-14 13:27:57	2023-11-15 04:03:31	6.1 kB	1.4 MB	188.114.97.1
fonts.gstatic.com	unknown	2008-02-11	2014-09-09 02:40:21	2023-11-15 07:34:06	1.1 kB	18 kB	142.250.74.163
e1.o.lencr.org	6159	2020-06-29	2021-08-20 09:36:30	2023-11-14 18:35:40	656 B	1.5 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-15 07:45:00	medium	Client IP	Internal IP	ET INFO DNS Query for Suspicious .icu Domain
2023-11-15 07:45:00	medium	Client IP	199.59.243.225	ET INFO Suspicious Domain (*.icu) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet
2023-11-15	medium	metamaskonline.xyz/	Crypto/Wallet

PhishTank

Scan Date	Severity	Indicator	Alert
2023-11-15	medium	metamaskonline.xyz/js/analytics.js	Other
2023-11-15	medium	metamaskonline.xyz/swaps.html	Other
2023-11-15	medium	metamaskonline.xyz/fonts/EuclidCircularB-Bold-WebXL.woff2	Other
2023-11-15	medium	metamaskonline.xyz/images/swaps-header2.png	Other
2023-11-15	medium	metamaskonline.xyz/css/metamask-staging-2.webflow.css	Other
2023-11-15	medium	metamaskonline.xyz/js/gtag.js	Other
2023-11-15	medium	metamaskonline.xyz/fonts/EuclidCircularB-Regular-WebXL.woff2	Other
2023-11-15	medium	metamaskonline.xyz/images/mm-logo.svg	Other
2023-11-15	medium	metamaskonline.xyz/css/webflow.css	Other
2023-11-15	medium	metamaskonline.xyz/js/webfont.js	Other
2023-11-15	medium	metamaskonline.xyz/js/jquery-3.5.1.min.dc5e7f18c8.js	Other
2023-11-15	medium	metamaskonline.xyz/js/webflow.js	Other
2023-11-15	medium	metamaskonline.xyz/css/normalize.css	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed
2023-11-15	medium	metamaskonline.xyz	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	From	Size	First Seen	Last Seen
	metamaskonline.xyz/swaps.html	ScriptElement	131 B	2023-03-07	2025-05-03
Pretty URL metamaskonline.xyz/swaps.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:18 Last Seen2025-05-03 16:42 Times Seen54 Hash 8da5c3d05348bfc0ef2e7d64796f08ce e080496b1ba9bcbc603d81c6021044631b89a0c8 f8b75ad14956c9b4a7da3b51493be28faf5bf3b7bc4dc509868bd0e31f240fbf Loading...

	metamaskonline.xyz/swaps.html	ScriptElement	271 B	2023-03-07	2025-05-03
Pretty URL metamaskonline.xyz/swaps.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:18 Last Seen2025-05-03 16:42 Times Seen58 Hash 5cc04270e6de1ba3403b9bb4aa18e0bb 02b450b0709e7e8b42847897d4f71388c6b891f1 9aeb52da922aad84c3d824450a12d0c862b6405e789d0df794d43ebbcfac1468 Loading...

	metamaskonline.xyz/swaps.html	ScriptElement	251 B	2023-03-07	2025-05-03
Pretty URL metamaskonline.xyz/swaps.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:18 Last Seen2025-05-03 16:42 Times Seen54 Hash bed44b24e4fff29f2e0bf3739e46316c 584f9bbf144ef51dfcc79953b1770628319d43dd c0c9670efa75fdbcfae7a3b9caea4279885ce290e76f8769d7b4d7421ef593cf Loading...

	metamaskonline.xyz/js/gtag.js	ScriptElement	92 kB	2023-03-07	2025-05-03
Pretty URL metamaskonline.xyz/js/gtag.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:18 Last Seen2025-05-03 16:42 Times Seen55 Hash 8565965902198b680974beb4f8006741 3e60fb528c543082cc483acd620b78002e848fbf 28c8a04ee3648c79f7e5b15b1a62a816eb8073a4133bfb69ca291e5972e0f291 Loading...

	metamaskonline.xyz/js/analytics.js	ScriptElement	50 kB	2023-03-07	2025-05-04
Pretty URL metamaskonline.xyz/js/analytics.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-05-04 12:04 Times Seen102 Hash 876c0f150943aff8b256da31f79ac00e b54a0b23c420cc5a9e491cbb3817ecdb65e81991 fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Loading...

	metamaskonline.xyz/js/webflow.js	ScriptElement	568 kB	2023-03-07	2025-05-04
Pretty URL metamaskonline.xyz/js/webflow.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:18 Last Seen2025-05-04 15:45 Times Seen94 Hash aa932307fd6818913c360441a1d21397 5d832542de495c05a829b2cdba867b8e508a69dc 8de8a14b1b42b80ff2a89d3afaccd40bad8e6f1b507cc20fe78408c8ff7aa252 Loading...

	metamaskonline.xyz/js/webfont.js	ScriptElement	13 kB	2023-03-07	2025-05-09
Pretty URL metamaskonline.xyz/js/webfont.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-05-09 03:35 Times Seen17500 Hash 7c96a5f11d9741541d5e3c42ff6380d7 d3fa2564c021cf730e58ffddb138cf6b57ed126e 81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee Loading...

	metamaskonline.xyz/swaps.html	ScriptElement	302 B	2023-03-13	2024-08-20
Pretty URL metamaskonline.xyz/swaps.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:00 Last Seen2024-08-20 19:30 Times Seen1 Hash 69b68d341958ad3e8f993c0706450c6f 6a73f35786fbdc8df594e337cdd3f748326e343c 72525bd0ffe1960b1531fb352f1408ea4c8315f031752e7ba4d762b8ee75520e Loading...

	metamaskonline.xyz/swaps.html	ScriptElement	292 B	2023-03-08	2024-08-20
Pretty URL metamaskonline.xyz/swaps.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 20:34 Last Seen2024-08-20 19:30 Times Seen2 Hash 3c97f812f27964d6823f5765f7071413 f73a3232c31fdde4737101e417ad2b7856949768 855840411ed2df07dd79355dcb493386324f5123709e7577f557dad703ec6178 Loading...

	metamaskonline.xyz/js/jquery-3.5.1.min.dc5e7f18c8.js	ScriptElement	90 kB	2023-03-07	2025-05-09
Pretty URL metamaskonline.xyz/js/jquery-3.5.1.min.dc5e7f18c8.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 03:37 Times Seen108569 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

HTTP Transactions (20)

URL IP Response Size

metamaskonline.xyz/js/analytics.js

188.114.97.1

200 OK

21 kB

URL GET HTTP/3
metamaskonline.xyz/js/analytics.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text, with very long lines (1325)
Size
21 kB (20861 bytes)
Hash
876c0f150943aff8b256da31f79ac00e
b54a0b23c420cc5a9e491cbb3817ecdb65e81991
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/analytics.js HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Cookie: _ga=GA1.2.492630445.1700034300; _gid=GA1.2.312242173.1700034300; _gat_gtag_UA_37075177_6=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: application/javascript
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-c179"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: HIT
age: 1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aMMnCt7Jb9TArgMNDK28AKkQxkzTbOd9T5P4eEPC%2FaINcx9q1ceQwbASpCgjn22HiLHc1TppxKnEuJRqUjjldi4fBXgzTxTUc71hhvpqQyHx9%2FRkrAIV4iwTnmOBFuldoIe672o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df43ad62b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/changaone/v20/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2

142.250.74.163

200 OK

7.9 kB

URL GET HTTP/2
fonts.gstatic.com/s/changaone/v20/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintEB:59:E9:F3:0F:CE:D8:1A:8C:BB:EE:7D:2E:B7:B8:39:73:7A:CE:28
ValidityMon, 16 Oct 2023 08:10:00 GMT - Mon, 08 Jan 2024 08:09:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7900, version 1.0\012- data
Size
7.9 kB (7900 bytes)
Hash
61e86e7a20ecf3ba181ca4b9a9a1cdbd
482a65cffc69109af26669d64accbef71db3b836
fbd0536d5b92c0dbe6ad2637800ae8da10c20755b564a3575bd12bba57f73b18

HTTP Headers

GET /s/changaone/v20/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://metamaskonline.xyz
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7900
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 14 Nov 2023 21:37:08 GMT
expires: Wed, 13 Nov 2024 21:37:08 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 24 Aug 2023 21:10:56 GMT
content-type: font/woff2
age: 36471
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/changaone/v20/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2

142.250.74.163

200 OK

8.4 kB

URL GET HTTP/2
fonts.gstatic.com/s/changaone/v20/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintEB:59:E9:F3:0F:CE:D8:1A:8C:BB:EE:7D:2E:B7:B8:39:73:7A:CE:28
ValidityMon, 16 Oct 2023 08:10:00 GMT - Mon, 08 Jan 2024 08:09:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 8404, version 1.0\012- data
Size
8.4 kB (8404 bytes)
Hash
141119ae119bf7ca75e10ef82f66e442
adebf435aa078db3c116cb9faae15f2ad81d3ac5
c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff

HTTP Headers

GET /s/changaone/v20/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://metamaskonline.xyz
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 8404
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 10 Nov 2023 18:18:12 GMT
expires: Sat, 09 Nov 2024 18:18:12 GMT
cache-control: public, max-age=31536000
age: 394007
last-modified: Thu, 24 Aug 2023 20:56:52 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

metamaskonline.xyz/swaps.html

188.114.97.1

200 OK

60 kB

URL User Request GET HTTP/2
metamaskonline.xyz/swaps.html
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (930), with CRLF line terminators
Size
60 kB (59552 bytes)
Hash
04d0b12f1b8e1a2d50c78669e48b390e
39f5c4caa3f04974743be21b641b2c2d601795c7
076101fa0542457f369467a7003671182f595b4e0807c83ad0a5784008e2a16f

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /swaps.html HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 15 Nov 2023 07:44:58 GMT
content-type: text/html
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ITbWQ9c9OJ%2F16S0OfF4%2F1WClsxsX7pBdhtkFy0KDSuQQxmBVvrXrAPUf7etUv2b3FKo0rOrdhOSvaiOGX8SBZSbnEBDciUcuv7qwR99%2BTxw885Y7%2F9jF%2BZDLn6xKMvS58a%2FERM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df37fe24067b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

metamaskonline.xyz/fonts/EuclidCircularB-Bold-WebXL.woff2

188.114.97.1

200 OK

44 kB

URL GET HTTP/3
metamaskonline.xyz/fonts/EuclidCircularB-Bold-WebXL.woff2
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
Web Open Font Format (Version 2), TrueType, length 44544, version 3.66\012- data
Size
44 kB (44544 bytes)
Hash
9024d0bf73943172297c4628d0054e20
36c3795e7b297d06589e15ef59592683d9ed0974
88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fonts/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/css/metamask-staging-2.webflow.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:45:00 GMT
content-type: font/woff2
content-length: 44544
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
etag: "61e8a920-ae00"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uLHKRJ9xUydgR3q1QlhQhV6dJPeqm8lqkXaXUn5UXx70kKM1tHo4cRvYhkNvXNUmtvK763ed1GIp3TUty1Jc2rgA%2BpeebIN1qNfVJ3aXuIvAs2yzdXxtL37Xam3iJWGda8zdFdo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8265df430cf6b503-OSL
alt-svc: h3=":443"; ma=86400

e1.o.lencr.org/

23.36.76.226

344 B

URL
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
344 B (344 bytes)
Hash
3b3fd56449ba755a5908c86de2d774c0
c0ddccf0c249be88d2220504209eb520dfe2f8ac
5fbfe2b13b8ab2edb758b3bda380667020c317987e6781f1df7fb434b884d85e

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "5FBFE2B13B8AB2EDB758B3BDA380667020C317987E6781F1DF7FB434B884D85E"
Last-Modified: Wed, 15 Nov 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21551
Expires: Wed, 15 Nov 2023 13:44:12 GMT
Date: Wed, 15 Nov 2023 07:45:01 GMT
Connection: keep-alive

e1.o.lencr.org/

23.36.76.226

345 B

URL
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
8085e7afeaa64240ffa27fdabc60dc11
dccc7a2f2e7c623f2fbcc5d744fd12f7504e36fc
39887a7ac8d88bdecde60ed5fc065b7c3d443f24bc792316393924a8a98414bb

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "39887A7AC8D88BDECDE60ED5FC065B7C3D443F24BC792316393924A8A98414BB"
Last-Modified: Wed, 15 Nov 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Wed, 15 Nov 2023 13:45:01 GMT
Date: Wed, 15 Nov 2023 07:45:01 GMT
Connection: keep-alive

metamask.icu/images/favicon.ico

199.59.243.225

200 OK

1.1 kB

URL GET HTTP/1.1
metamask.icu/images/favicon.ico
IP
199.59.243.225:443
ASN
#16509 AMAZON-02

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerLet's Encrypt
Subjectmetamask.icu
Fingerprint81:3F:4E:62:0E:79:78:4E:09:58:F8:8E:18:F8:E0:AC:47:46:D2:91
ValiditySun, 10 Sep 2023 05:14:38 GMT - Sat, 09 Dec 2023 05:14:37 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (386)
Size
1.1 kB (1089 bytes)
Hash
419ba97ef15fb117080f10495b44bbc3
36b2bd9baad5d0a869df4417b45f86dac68cf586
eeae55c70137824ef61496de6d9b137f26ce36de6c2ee2f56752f5852a948e23

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: metamask.icu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 15 Nov 2023 07:45:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1089
X-Request-Id: 867cf165-8ad2-453c-9208-58ad98a12fe0
Cache-Control: no-store, max-age=0
Accept-Ch: sec-ch-prefers-color-scheme
Critical-Ch: sec-ch-prefers-color-scheme
Vary: sec-ch-prefers-color-scheme
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_v3t+aU45Kts/SbIRYk6ysAKoAs3rKMrtzL9g+ck/JgSer+huei+4OFnUWFaoWFsGgByRXlPX6EbhKyErG5pDEw==
Set-Cookie: parking_session=867cf165-8ad2-453c-9208-58ad98a12fe0; expires=Wed, 15 Nov 2023 08:00:01 GMT; path=/
Connection: close

metamaskonline.xyz/images/swaps-header2.png

188.114.97.1

200 OK

257 kB

URL GET HTTP/3
metamaskonline.xyz/images/swaps-header2.png
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
PNG image data, 991 x 1000, 8-bit/color RGBA, non-interlaced\012- data
Size
257 kB (257392 bytes)
Hash
83dec877839500745ece7b834926151b
bdae28c44478c2e60c17f59044250f6a3c39e66d
a319de845f62189895cc3c180d7eec7188b70102d5e1d623a926140bee5b9672

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/swaps-header2.png HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/css/metamask-staging-2.webflow.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:45:00 GMT
content-type: image/png
content-length: 257392
last-modified: Thu, 20 Jan 2022 00:13:12 GMT
etag: "61e8a918-3ed70"
expires: Fri, 15 Dec 2023 07:44:59 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2F7LIS5ivALnrpgljFz10u5BNkylD9S%2FOlKsUQxLn2OeC7J223Uh9wM3sylHeuuJDC%2BAmSU0p6fLquB1NKFtoScd9%2FiG4ZEV1bcRnJTMcnWqe9yOZTKKf1g5F58oxz58KRErsFk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8265df42ecdab503-OSL
alt-svc: h3=":443"; ma=86400

metamask.icu/images/webclip.png

199.59.243.225

200 OK

1.1 kB

URL GET HTTP/1.1
metamask.icu/images/webclip.png
IP
199.59.243.225:443
ASN
#16509 AMAZON-02

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerLet's Encrypt
Subjectmetamask.icu
Fingerprint81:3F:4E:62:0E:79:78:4E:09:58:F8:8E:18:F8:E0:AC:47:46:D2:91
ValiditySun, 10 Sep 2023 05:14:38 GMT - Sat, 09 Dec 2023 05:14:37 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (386)
Size
1.1 kB (1089 bytes)
Hash
cd2929ebc8350cc00ac880ef6a109e48
dbaa25cd105caed8b8629e9756874f7a90bef0af
598aa790bb2e22b84c8e0adacfbd96afacb48252c4dc2fc5f45e9490c3139b71

HTTP Headers

GET /images/webclip.png HTTP/1.1
Host: metamask.icu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 15 Nov 2023 07:45:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1089
X-Request-Id: bcdc0531-c0d1-48cf-a5d8-46c907a8717f
Cache-Control: no-store, max-age=0
Accept-Ch: sec-ch-prefers-color-scheme
Critical-Ch: sec-ch-prefers-color-scheme
Vary: sec-ch-prefers-color-scheme
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xedalA4ww5GE/depwDw2gacq5nKTsoPvXPK0P+U7611zb5TYsbsh4tGM38UdqN16xuhdGyuzn0cPB8+uYP4eSw==
Set-Cookie: parking_session=bcdc0531-c0d1-48cf-a5d8-46c907a8717f; expires=Wed, 15 Nov 2023 08:00:01 GMT; path=/
Connection: close

metamaskonline.xyz/css/metamask-staging-2.webflow.css

188.114.97.1

200 OK

136 kB

URL GET HTTP/3
metamaskonline.xyz/css/metamask-staging-2.webflow.css
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text
Size
136 kB (136311 bytes)
Hash
a2bec8bcf2d4e18af8c9891c48ea1baa
ee9cbb2dbc10d733644ffb9484d960658511e2fd
fe6a6b9d959300e239c7411474bddd8078da03c949eeb1e165d500bb92a389ff

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/metamask-staging-2.webflow.css HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: text/css
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-21477"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BNPURJnX1SqNiVChFBlf6UVNNThshUk5I5OYArWN80krw2%2BZsGQQ5d90jM8JSTZbTvhk%2Bu4MFNSOmmR0Xh%2Fs7NIohWT%2BQPoWF3dJsL8Zkm%2FruqN%2FEsT7VPsGktqGAkHOppvAySE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3ce8b6b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/js/gtag.js

188.114.97.1

200 OK

92 kB

URL GET HTTP/3
metamaskonline.xyz/js/gtag.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text, with very long lines (1896)
Size
92 kB (92548 bytes)
Hash
8565965902198b680974beb4f8006741
3e60fb528c543082cc483acd620b78002e848fbf
28c8a04ee3648c79f7e5b15b1a62a816eb8073a4133bfb69ca291e5972e0f291

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/gtag.js HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: application/javascript
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-16984"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v4icqCRkv7rFm47bxIz%2F0PQqpbekB5mYpvQx1BmZZFTz43AoxGACd%2FPDBP4wc4SHGlA5mFCHYxX3ROg8BWlHEdmDuGfL7FekB%2B1ICS8p80Y2hXRun8B8rgER0nyHuKko0DhXLI4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3ce8b9b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.googleapis.com/css?family=Changa+One:400,400italic

142.250.74.106

200 OK

800 B

URL GET HTTP/2
fonts.googleapis.com/css?family=Changa+One:400,400italic
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintFA:D7:68:E4:12:7D:FE:22:87:DE:95:F1:1E:49:5A:49:FA:12:1E:B9
ValidityMon, 16 Oct 2023 08:10:01 GMT - Mon, 08 Jan 2024 08:10:00 GMT

File type
ASCII text, with very long lines (816), with no line terminators
Size
800 B (800 bytes)
Hash
d649df21660305e95bf70d4282367324
4a3aeaf4830f03b873105998d8ceaa017bc0b65c
338d6967247111e7857d08db563973e8782b09601225fece0af3420e5cd2fa56

HTTP Headers

GET /css?family=Changa+One:400,400italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 15 Nov 2023 07:44:59 GMT
date: Wed, 15 Nov 2023 07:44:59 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

metamaskonline.xyz/fonts/EuclidCircularB-Regular-WebXL.woff2

188.114.97.1

200 OK

45 kB

URL GET HTTP/3
metamaskonline.xyz/fonts/EuclidCircularB-Regular-WebXL.woff2
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
Web Open Font Format (Version 2), TrueType, length 45196, version 3.66\012- data
Size
45 kB (45196 bytes)
Hash
2d75957df3bb3aa6ed84f6591b0d5a1a
906424e75625f63b0188471067065794d0348536
8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fonts/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/css/metamask-staging-2.webflow.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:45:00 GMT
content-type: font/woff2
content-length: 45196
last-modified: Thu, 20 Jan 2022 00:13:18 GMT
etag: "61e8a91e-b08c"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9u3pWMLQoN9SB8l3j6%2BeuB51EdLsg5r7OXK2yKLOPuJrhwQt%2F%2ByU1HIkGyrhwa3HpFqA6r5fU9l5yS%2BOMWDHl8fK%2FmPfoLCNT2l8P7bAwIm9ayPak5PRiob5M5GJthRYnhCXfMw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8265df42fcedb503-OSL
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/images/mm-logo.svg

188.114.97.1

200 OK

12 kB

URL GET HTTP/3
metamaskonline.xyz/images/mm-logo.svg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1001)
Size
12 kB (12019 bytes)
Hash
51bcea2625eb2c6e9268a7377a792c86
5eeb306e6584eed1747c36c11724f193711d430e
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/mm-logo.svg HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: image/svg+xml
last-modified: Thu, 20 Jan 2022 00:12:12 GMT
etag: W/"61e8a8dc-2ef3"
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sWKDAM1VKe7Xam9hsfGICYYTEIVqnrXSrQdfrFqLza%2FhiaT2uwX8qQ38XMOwXRVA%2FhvZB90MBuo5c1D25fgN9l3zIZ5um7gW9U9JyvmblFHH40fqCsn4yk4UpRA0CW1gkmSg7sc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8265df3ce8bdb503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/css/webflow.css

188.114.97.1

200 OK

39 kB

URL GET HTTP/3
metamaskonline.xyz/css/webflow.css
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type

Size
39 kB (39109 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/webflow.css HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: text/css
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-98c5"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cQlQLJ0rc5%2FWi3KOLhXj5PDdRiqr4Ts85yY9TL%2BicE2B7VIluvxUimEGv3KsHFZNE%2BHZOCW7VOioEhp7tROggpYSMIDj%2FoOlqKKSH1Sc55PeugcsSq63TwsnZzQKtRdKfplPZ18%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3ce8b5b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/js/webfont.js

188.114.97.1

200 OK

13 kB

URL GET HTTP/3
metamaskonline.xyz/js/webfont.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text, with very long lines (2134)
Size
13 kB (13188 bytes)
Hash
7c96a5f11d9741541d5e3c42ff6380d7
d3fa2564c021cf730e58ffddb138cf6b57ed126e
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/webfont.js HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: application/javascript
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-3384"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LPRsoTBCN5eiANOdCpKMfE2LmYQgmcsXzZ73wztPg5Zf53lXRS2i8p7ED5sCmEmQkGtSE4QchPLYg3be5iaFvB39VT3gaMCGhiwgRONTgaY2TN6e1tbm9plObTjAHKV21PN34d0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3ce8b8b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/js/jquery-3.5.1.min.dc5e7f18c8.js

188.114.97.1

200 OK

90 kB

URL GET HTTP/3
metamaskonline.xyz/js/jquery-3.5.1.min.dc5e7f18c8.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text, with very long lines (65451)
Size
90 kB (89476 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/jquery-3.5.1.min.dc5e7f18c8.js HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: application/javascript
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-15d84"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uAHD6KSQ8JoxhnE9ydUqB3QZNJ3QwDOz8KBHey9bIDceP08%2BMAUdLez2g%2FS%2FQ0V3j7Q89u2tz%2F1lToEiwIrqOLa0vRLjnTReb%2FAb8ZIoGovoDb7uVi6ZaIXsiO%2FUS0VTBnABdK4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3d08d3b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/js/webflow.js

188.114.97.1

200 OK

568 kB

URL GET HTTP/3
metamaskonline.xyz/js/webflow.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type

Size
568 kB (568434 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/webflow.js HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:59 GMT
content-type: application/javascript
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-8ac72"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rL%2FNzOxs0geLjkYprt2y%2BOS5REtYvIZCLbuIqBT59uwQ1C63AdpltBLrOrK2DVjI3%2FvfBBOSmuxktuK1dNyCXiI6sa5W3vbvCkpKtKDDZhtU1nNblGsEGIvVUHNiRdzEuuT5A90%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3d18d5b503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

metamaskonline.xyz/css/normalize.css

188.114.97.1

200 OK

7.8 kB

URL GET HTTP/3
metamaskonline.xyz/css/normalize.css
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://metamaskonline.xyz/swaps.html
Certificate
IssuerGoogle Trust Services LLC
Subjectmetamaskonline.xyz
Fingerprint36:24:16:75:19:56:29:36:07:7B:48:6B:A5:72:45:A8:2D:68:85:EA
ValidityTue, 14 Nov 2023 11:37:08 GMT - Mon, 12 Feb 2024 11:37:07 GMT

File type
ASCII text, with very long lines (8147), with no line terminators
Size
7.8 kB (7772 bytes)
Hash
21240e0cead3210a28555c3fa89acab0
486fbbc9a997da04985e8ffb5b52e74e0a6f35ea
2881f1b580116868946ef393e44e46ce9ec94fda36f6d1eb840290671830db6a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Crypto/Wallet
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/normalize.css HTTP/1.1
Host: metamaskonline.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metamaskonline.xyz/swaps.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 15 Nov 2023 07:44:58 GMT
content-type: text/css
last-modified: Thu, 20 Jan 2022 00:13:20 GMT
vary: Accept-Encoding
etag: W/"61e8a920-1e5c"
expires: Wed, 15 Nov 2023 19:44:58 GMT
cache-control: max-age=43200
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2FM0CVEd2UM8p%2BoifaFB208eVyWSc9Os3LhZQCOX5guLbqetCKR6ag%2BNOUzxf07T4GTFQdiwD8lDSRFCmgnhyUvSCrWO%2FXPxPYiAiUjmTsTOxB3wgM4HhiJ3JBzK1IgAxyklaS0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8265df3ce8afb503-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by