Report - metamask.io.merge.reef.co.ke/

Report Overview

URL

metamask.io.merge.reef.co.ke/
IP

5.9.235.235

ASN

#24940 Hetzner Online GmbH
Submitted

2023-02-14T16:24:09Z

Access
Tags

crypto phishing
urlquery detections

Phishing - Generic Crypto/Wallet

Detections

urlquery

25
Network Intrusion Detection

0
Threat Detection Systems

42

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
ocsp.pki.goog (4)	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	1372	2800	142.250.74.131
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	54.149.203.40
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	61618	34.120.237.76
fonts.googleapis.com (1)	8877	2013-06-10T22:14:26Z	2023-03-13T08:14:31Z	408	630	142.250.74.74
r3.o.lencr.org (6)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2028	5319	95.101.11.115
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2374	35.241.9.150
cdn.ethers.io (1)	459220	2017-08-30T09:27:23Z	2023-03-13T07:52:11Z	385	540	54.230.111.14
www.gstatic.com (1)	unknown	2016-07-26T11:37:06Z	2023-03-13T07:57:11Z	465	1963	142.250.74.3
ocsp.sca1b.amazontrust.com (1)	1015	2017-03-03T16:20:51Z	2019-03-27T05:05:54Z	350	944	54.230.245.100
metamask.io.merge.reef.co.ke (25)	unknown	2022-11-30T04:34:53Z	2023-03-07T17:53:25Z	8457	1055232	5.9.235.235
fonts.gstatic.com (3)	unknown	2014-09-09T02:40:21Z	2023-03-13T08:44:36Z	1377	147003	142.250.74.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-01-28	medium	metamask.io.merge.reef.co.ke/secure.html	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Crypto/Wallet

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-14	medium	metamask.io.merge.reef.co.ke/	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/webfont.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/css.html	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/enterprise.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/analytics.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/tag.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/storage.secure.min.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/jquery-3.5.1.min.dc5e7f18c8.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/plx.chock.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/webflow.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/mm-logo.svg	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Bold-WebXL.woff2	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Regular-WebXL.woff2	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/secure.html	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/script.js	Phishing
2023-02-14	medium	metamask.io.merge.reef.co.ke/meta/bootstrap-tagsinput.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

HTTP Transactions (53)

URL IP Response Size

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

8281405c524ff6eb1b0046b1c9661ce4

8233cad9810b06677bb8330dc7492dd5d1a65067

f9758415d785323b3f2108cb7762c5fc6cdc7f9fc49a46d05d691e56f93bc19f

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F9758415D785323B3F2108CB7762C5FC6CDC7F9FC49A46D05D691E56F93BC19F"
Last-Modified: Tue, 14 Feb 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14666
Expires: Tue, 14 Feb 2023 20:28:24 GMT
Date: Tue, 14 Feb 2023 16:23:58 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

111c8a4d6ad583c6126cfa9c4648851f

7bb69828eadedd57e2eb57f0612e0208bde3fcc7

44c24f6c3c0470e5b2112f9089eef8029a4f80dc966eacee001841b08e59cb79

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "44C24F6C3C0470E5B2112F9089EEF8029A4F80DC966EACEE001841B08E59CB79"
Last-Modified: Mon, 13 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5333
Expires: Tue, 14 Feb 2023 17:52:51 GMT
Date: Tue, 14 Feb 2023 16:23:58 GMT
Connection: keep-alive

metamask.io.merge.reef.co.ke/

5.9.235.235

200 OK

2938

URL HTTP/1.1

metamask.io.merge.reef.co.ke/
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text

Size

2938
Hash

a2d4bc164ed35f0e8ab9a24a8d78d2ba

23b05632d6673e53091a9423a58cb5c9e287a8cc

f1526c918214e606e6d02f5c5f5ae7a78391de99d09e2d07d70e041dda13ee91

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET / HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Tue, 20 Sep 2022 01:07:28 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2938
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

bf0c602d32b3c14606f22a86183b5e3c

6eabd8d83475eba731968abe1a05a8bfd272f160

6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Backoff, Alert, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 14 Feb 2023 15:49:03 GMT
content-type: application/json
age: 2095
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

3534c46dafa4e959cb5f4aba0b1d8cd7

f4aa8774355b04bf1f074aeb73c56c52b32568ab

68b7b6679046611b607c073416e818c6d0391e2953ecc8781b02e57a9b5af306

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "68B7B6679046611B607C073416E818C6D0391E2953ECC8781B02E57A9B5AF306"
Last-Modified: Mon, 13 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3792
Expires: Tue, 14 Feb 2023 17:27:10 GMT
Date: Tue, 14 Feb 2023 16:23:58 GMT
Connection: keep-alive

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Tue, 14 Feb 2023 16:23:58 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

metamask.io.merge.reef.co.ke/meta/webflow.css

5.9.235.235

200 OK

9350

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/webflow.css
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Unicode text, UTF-8 text, with very long lines (2587)

Size

9350
Hash

d143e827e4004f5af028b3c37e3748dd

7531565e84fd2011b5ca8a9b179ecdd4b65d89b6

f425ff60551250b2f1dc6a40d92d5ab84847781d370740a945b6b8f1866c4e84

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /meta/webflow.css HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: text/css
last-modified: Wed, 22 Dec 2021 15:30:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 9350
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/normalize.css

5.9.235.235

200 OK

2633

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/normalize.css
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text

Size

2633
Hash

74b55c54efadbc58b06a6042cc858472

127ffb851c8bb77bf00de3280d0e078571704de7

435035717bcd1da635fd11e9d0d22c40d2753c48383b1728f66bfd1607bcd54a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /meta/normalize.css HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: text/css
last-modified: Wed, 22 Dec 2021 15:30:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2633
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

e76071a28ee566dababb3834f46d68ed

aebb4e68c1ba2de0f90025283e8ed8470944fde0

78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: YErResrnOoySbrRlV4esx3Z3t4thES2/DEmN/h3wY3PxFYC/WPcOwZWf68fAQVqGyuV4qtMYx/c=
x-amz-request-id: M9XSH8YJ75YKNF55
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 14 Feb 2023 15:48:34 GMT
age: 2124
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

metamask.io.merge.reef.co.ke/meta/webfont.js

5.9.235.235

200 OK

5431

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/webfont.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (2134)

Size

5431
Hash

f2e75ef01e8ce9b37cec75250d84e8bf

76e367a654e7cdaa51872ab26a31eb96605b4544

4a40bdcd270c0a713cc75ff940ab738302bb466ad84bd39780d96dfb77bfedde

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/webfont.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5431
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/css.html

5.9.235.235

200 OK

274

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/css.html
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text

Size

274
Hash

a0a15fba936f518c2c1c071b0089c64c

6f8526c13dda4943229b9535931f8a6fd169da3a

6e9864f7491582647d88fee2b9503d22fc8735f673bb9be1809437c11af8af96

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/css.html HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Wed, 22 Dec 2021 15:30:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 274
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/enterprise.js

5.9.235.235

200 OK

617

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/enterprise.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (1008), with no line terminators

Size

617
Hash

d81ef5cb351ba48ede3354fa5248ce44

9a08bcf54317bb24610116e0650b520b32dcb7e3

69e117e70a745175180e8c577cec146b059da38bfd77265a8544cfc78a51e32b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/enterprise.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:24 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 617
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/analytics.js

5.9.235.235

200 OK

20110

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/analytics.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (1325)

Size

20110
Hash

f6172b83fb5bcd8fadd246270f6e7948

910ba56b59eac08dd3461bbf81a19378028b2664

62559499e80252ed5f16b8d9972825db8479ad069a5f3e63a82c37a0d9d4ce91

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/analytics.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 20110
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/tag.js

5.9.235.235

200 OK

7583

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/tag.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (21652), with no line terminators

Size

7583
Hash

030e152d0cbf5d9c345726676e20f490

d39cd836763535ada905adb47e4d028a80f51849

01cb61852e9ab6166e2651c568c84e93d2dd80a7296b26d2f0539e5dc614787f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/tag.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:44 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 7583
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

f5067af0270e15c7a9474f4164857326

32b475f2e62e41425bed727d9879ebcbbb60aa3a

60d910b309744465e215e9a977ad16146387dcc6c1160ae1192d5c26e71c02b5

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Feb 2023 16:23:58 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

metamask.io.merge.reef.co.ke/meta/storage.secure.min.js

5.9.235.235

200 OK

13331

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/storage.secure.min.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (38562), with no line terminators

Size

13331
Hash

3d92102abedfdb24487dce53034d530b

98a4881577f81b625bc08bf33331295fd996df48

b6df362a0fb0fa4eb5c3e8724f44a5a483550e971d2ff3131c82efcfb7d262a2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/storage.secure.min.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:42 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 13331
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/jquery-3.5.1.min.dc5e7f18c8.js

5.9.235.235

200 OK

30970

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/jquery-3.5.1.min.dc5e7f18c8.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (65451)

Size

30970
Hash

21ab05a6dc4822c20e4f8e617d59503e

0431002ed053581f86ceeca6589f3b3fc039d1ee

d55c3c4566cd69b2af1ac0ef1f24f7d9e781bd67701c2e84a2300a8464636b34

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/jquery-3.5.1.min.dc5e7f18c8.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:32 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 30970
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/plx.chock.js

5.9.235.235

200 OK

312

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/plx.chock.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text

Size

312
Hash

f8a281c232ca490b0fb6a69a0a69aa93

8586880ea6c9a49dd4b2b45ee6f7eff01c5c7683

4acac0377cad7da2cbf6e18c4e9096e95484429bf4589b472bbc276c43b6110e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/plx.chock.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 312
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/metamask-staging-2.webflow.css

5.9.235.235

200 OK

17590

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/metamask-staging-2.webflow.css
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text

Size

17590
Hash

53ff35d49ab5d2089b65f13389233f86

cf1714af3125e0fc6b07408fa4269ab003baa162

509ea7e5aac1909a1a0b328b497e47f04cd10eaa3927e65a37cf1900bea5996f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /meta/metamask-staging-2.webflow.css HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: text/css
last-modified: Wed, 22 Dec 2021 15:30:36 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 17590
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

07d48e9dfec32c7826a0ae0d7bf37047

6cb3a01b5cc934f070bd363abe0acc6856412f40

e7094b2dfa67bad54e8a075146d0c62026c573560fe359ee1869b5727eb03145

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E7094B2DFA67BAD54E8A075146D0C62026C573560FE359EE1869B5727EB03145"
Last-Modified: Mon, 13 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5560
Expires: Tue, 14 Feb 2023 17:56:39 GMT
Date: Tue, 14 Feb 2023 16:23:59 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Content-Type, Pragma, ETag, Retry-After, Backoff, Expires, Alert, Cache-Control, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 14 Feb 2023 15:51:22 GMT
age: 1957
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

metamask.io.merge.reef.co.ke/meta/webflow.js

5.9.235.235

200 OK

147063

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/webflow.js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Unicode text, UTF-8 text, with very long lines (50020)

Size

147063
Hash

8a4663ee78192e5c9506c2a338ce7723

dba17ca619195bfb7ff1a1b55d196bff2029b89f

f2892479732a4c07ecece62f4c8f12fd9ade7fab06766368a9c87f3bbe96dd59

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/webflow.js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:58 GMT
content-type: application/javascript
last-modified: Wed, 22 Dec 2021 15:30:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 147063
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/wpp.gif

5.9.235.235

200 OK

3877

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/wpp.gif
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

GIF image data, version 87a, 470 x 40\012- data

Size

3877
Hash

941648b845842a709da73e24652cf8a4

099e5f97e602d026c51537c9b45328dc99261d7c

2a7344e607a878f0acac7f5c9c3a65fc8a4423f00e21d3fb7a814cae051631d9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /meta/wpp.gif HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: image/gif
last-modified: Wed, 22 Dec 2021 15:30:48 GMT
accept-ranges: bytes
content-length: 3877
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

push.services.mozilla.com/

54.149.203.40

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

54.149.203.40:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 4gI57yplNiQTovioXd0zMg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: mS6e6UFMDtIronUCIjKtstxIXYg=

fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2

142.250.74.35

200 OK

8404

URL HTTP/1.1

fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP

142.250.74.35:0
ASN

#15169 GOOGLE

Magic

Web Open Font Format (Version 2), TrueType, length 8404, version 1.0\012- data

Size

8404
Hash

141119ae119bf7ca75e10ef82f66e442

adebf435aa078db3c116cb9faae15f2ad81d3ac5

c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff

HTTP Headers

                                        GET /s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://metamask.io.merge.reef.co.ke
Connection: keep-alive
Referer: http://fonts.googleapis.com/

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 8404
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 11 Feb 2023 10:13:10 GMT
Expires: Sun, 11 Feb 2024 10:13:10 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 21 Apr 2022 17:15:41 GMT
Content-Type: font/woff2
Age: 281449

metamask.io.merge.reef.co.ke/meta/mm-logo.svg

5.9.235.235

200 OK

3289

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/mm-logo.svg
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1001)

Size

3289
Hash

75536fc9d6e2f24b5d4a43206f59daea

d6b451451650bb4028e6e36562cf590370534324

1fec7292d135f29856c58b107c76d144f532a9a3b5d36acefa89ae4e3e990c61

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/mm-logo.svg HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: image/svg+xml
last-modified: Wed, 22 Dec 2021 15:30:36 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 3289
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2

142.250.74.35

200 OK

7900

URL HTTP/1.1

fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
IP

142.250.74.35:0
ASN

#15169 GOOGLE

Magic

Web Open Font Format (Version 2), TrueType, length 7900, version 1.0\012- data

Size

7900
Hash

61e86e7a20ecf3ba181ca4b9a9a1cdbd

482a65cffc69109af26669d64accbef71db3b836

fbd0536d5b92c0dbe6ad2637800ae8da10c20755b564a3575bd12bba57f73b18

HTTP Headers

                                        GET /s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://metamask.io.merge.reef.co.ke
Connection: keep-alive
Referer: http://fonts.googleapis.com/

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7900
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 13 Feb 2023 05:52:04 GMT
Expires: Tue, 13 Feb 2024 05:52:04 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 21 Apr 2022 17:15:19 GMT
Content-Type: font/woff2
Age: 124315

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

f5067af0270e15c7a9474f4164857326

32b475f2e62e41425bed727d9879ebcbbb60aa3a

60d910b309744465e215e9a977ad16146387dcc6c1160ae1192d5c26e71c02b5

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Feb 2023 16:23:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Bold-WebXL.woff2

5.9.235.235

200 OK

44544

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Bold-WebXL.woff2
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Web Open Font Format (Version 2), TrueType, length 44544, version 3.66\012- data

Size

44544
Hash

9024d0bf73943172297c4628d0054e20

36c3795e7b297d06589e15ef59592683d9ed0974

88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/meta/metamask-staging-2.webflow.css

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: font/woff2
last-modified: Wed, 22 Dec 2021 15:30:26 GMT
accept-ranges: bytes
content-length: 44544
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Regular-WebXL.woff2

5.9.235.235

200 OK

45196

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/EuclidCircularB-Regular-WebXL.woff2
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Web Open Font Format (Version 2), TrueType, length 45196, version 3.66\012- data

Size

45196
Hash

2d75957df3bb3aa6ed84f6591b0d5a1a

906424e75625f63b0188471067065794d0348536

8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/meta/metamask-staging-2.webflow.css

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: font/woff2
last-modified: Wed, 22 Dec 2021 15:30:26 GMT
accept-ranges: bytes
content-length: 45196
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/images/webclip.png

5.9.235.235

200 OK

URL HTTP/1.1

metamask.io.merge.reef.co.ke/images/webclip.png
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /images/webclip.png HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: image/png
last-modified: Wed, 22 Dec 2021 21:03:30 GMT
accept-ranges: bytes
content-length: 0
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/images/favicon.png

5.9.235.235

200 OK

URL HTTP/1.1

metamask.io.merge.reef.co.ke/images/favicon.png
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /images/favicon.png HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: image/png
last-modified: Wed, 22 Dec 2021 21:03:30 GMT
accept-ranges: bytes
content-length: 0
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/js

5.9.235.235

200 OK

92325

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/js
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

ASCII text, with very long lines (1815)

Size

92325
Hash

fb2ab9b8632250b0d7aa50c08150cfe1

73b3f266ac08c9fb07e1de1664fed384ccd5bc86

5d419e0ff614b331e4f8fed2ba7c1380b1f5983f98d820a6a0f7040b55f60b5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet
fortinet	Phishing

HTTP Headers

                                        GET /meta/js HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
last-modified: Wed, 22 Dec 2021 15:30:32 GMT
accept-ranges: bytes
content-length: 92325
date: Tue, 14 Feb 2023 16:23:58 GMT
server: LiteSpeed

metamask.io.merge.reef.co.ke/meta/hero2.4.png

5.9.235.235

200 OK

589568

URL HTTP/1.1

metamask.io.merge.reef.co.ke/meta/hero2.4.png
IP

5.9.235.235:0
ASN

#24940 Hetzner Online GmbH

Magic

PNG image data, 1752 x 1452, 8-bit/color RGBA, non-interlaced\012- data

Size

589568
Hash

d0ec70f4c666fbf6ad0d30a52d08c5c9

e48f0688bc4f592824840478d12c05df0dd12002

3f4bfc7c6cc471e9d95936dc109852c4f6a4bf1163b63eeabfe840565d5ad8d1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
openphish	Crypto/Wallet

HTTP Headers

                                        GET /meta/hero2.4.png HTTP/1.1
Host: metamask.io.merge.reef.co.ke
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/meta/metamask-staging-2.webflow.css

                                        HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Tue, 21 Feb 2023 16:23:59 GMT
content-type: image/png
last-modified: Wed, 22 Dec 2021 15:30:30 GMT
accept-ranges: bytes
content-length: 589568
date: Tue, 14 Feb 2023 16:23:59 GMT
server: LiteSpeed

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

605c0a47169c45b131ccb1ed345cf048

110d17ee2aa9a2cb7128e27554ec8dcbb1f59296

0ac9bb15a9f9edd3750752ddf33d3478bedd369cc5f22b6a0e258f55958b7774

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Feb 2023 16:24:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js

142.250.74.3

404 Not Found

1621

URL HTTP/2

www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js
IP

142.250.74.3:0
ASN

#15169 GOOGLE

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)

Size

1621
Hash

c90524d6a02b27addb56c350fe6fbb2d

d713d1b53323c0169ffe0649be8c9d04a189f999

4aefd395113d052a874ac1919aed0e288835e0377683f1e71e98838d16c986e0

HTTP Headers

                                        GET /recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://metamask.io.merge.reef.co.ke
Connection: keep-alive
Referer: http://metamask.io.merge.reef.co.ke/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Tue, 14 Feb 2023 16:24:00 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1621
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

605c0a47169c45b131ccb1ed345cf048

110d17ee2aa9a2cb7128e27554ec8dcbb1f59296

0ac9bb15a9f9edd3750752ddf33d3478bedd369cc5f22b6a0e258f55958b7774

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 14 Feb 2023 16:24:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d42a01fdf9af7a50d630c42fde100d30

a7568d35657f934220298ca4c2fb102398554196

f215d87cad50e9310bf2a4df263b24e1c87e7cda29e48f93f6b0d76eb218ab1d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F215D87CAD50E9310BF2A4DF263B24E1C87E7CDA29E48F93F6B0D76EB218AB1D"
Last-Modified: Mon, 13 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11921
Expires: Tue, 14 Feb 2023 19:42:41 GMT
Date: Tue, 14 Feb 2023 16:24:00 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d42a01fdf9af7a50d630c42fde100d30

a7568d35657f934220298ca4c2fb102398554196

f215d87cad50e9310bf2a4df263b24e1c87e7cda29e48f93f6b0d76eb218ab1d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F215D87CAD50E9310BF2A4DF263B24E1C87E7CDA29E48F93F6B0D76EB218AB1D"
Last-Modified: Mon, 13 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11921
Expires: Tue, 14 Feb 2023 19:42:41 GMT
Date: Tue, 14 Feb 2023 16:24:00 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9fe38f96-4b04-43d2-9644-5b2f7cd0c0c9.jpeg

34.120.237.76

200 OK

14477

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9fe38f96-4b04-43d2-9644-5b2f7cd0c0c9.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (16)

#1 JS:Script (size: 303580)

#2 JS:Script (size: 2386)

#3 JS:Script (size: 1008)

#4 JS:Script (size: 50205)

#5 JS:Script (size: 13188)

#6 JS:Script (size: 250)

#7 JS:Script (size: 601104)

#8 JS:Script (size: 21104)

#9 JS:Script (size: 89476)

#10 JS:Script (size: 38562)

#11 JS:Script (size: 3393)

#12 JS:Script (size: 69)

#13 JS:Script (size: 0)

#14 JS:Script (size: 253)

#15 JS:Script (size: 92325)

#16 JS:Script (size: 21652)

HTTP Transactions (53)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN