account.jagex.com.gaios.com
Open in
urlscan Pro
160.153.91.0
Malicious Activity!
Public Scan
Effective URL: https://account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/2.196373423.268929511.1712568173-297580...
Submission: On April 08 via manual from US — Scanned from AT
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on April 5th 2024. Valid for: 3 months.
This is the only time account.jagex.com.gaios.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Jagex (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 104.26.8.129 104.26.8.129 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 160.153.91.0 160.153.91.0 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 | 172.64.162.29 172.64.162.29 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 0.91.153.160.host.secureserver.net
account.jagex.com.gaios.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
gaios.com
account.jagex.com.gaios.com |
464 KB |
2 |
cdnfonts.com
fonts.cdnfonts.com — Cisco Umbrella Rank: 12429 |
8 KB |
2 |
shorturl.at
2 redirects
shorturl.at — Cisco Umbrella Rank: 93063 www.shorturl.at — Cisco Umbrella Rank: 108008 |
907 B |
7 | 3 |
Domain | Requested by | |
---|---|---|
4 | account.jagex.com.gaios.com |
account.jagex.com.gaios.com
|
2 | fonts.cdnfonts.com |
account.jagex.com.gaios.com
fonts.cdnfonts.com |
1 | www.shorturl.at | 1 redirects |
1 | shorturl.at | 1 redirects |
7 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
secure.oldschool.com-nhs.co.cz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
account.jagex.com.gaios.com ZeroSSL RSA Domain Secure Site CA |
2024-04-05 - 2024-07-04 |
3 months | crt.sh |
cdnfonts.com GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/2.196373423.268929511.1712568173-29758028.1712568173
Frame ID: 239CB49BD0BDD1171B79CFB2B5CD5108
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://shorturl.at/ikmpS
HTTP 307
https://shorturl.at/ikmpS HTTP 301
https://www.shorturl.at/ikmpS HTTP 302
https://account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/2.196373423.2689295... Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Login
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://shorturl.at/ikmpS
HTTP 307
https://shorturl.at/ikmpS HTTP 301
https://www.shorturl.at/ikmpS HTTP 302
https://account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/2.196373423.268929511.1712568173-29758028.1712568173 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://account.jagex.com.gaios.com/favicon.ico HTTP 302
- https://account.jagex.com.gaios.com/OrderStatus=ed985 HTTP 301
- https://account.jagex.com.gaios.com/OrderStatus=ed985/
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
2.196373423.268929511.1712568173-29758028.1712568173
account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/ Redirect Chain
|
380 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.5.slim.min.js
account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/assets/ |
24 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pf-bague-sans-pro
fonts.cdnfonts.com/css/ |
1 KB 733 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.4.slim.min.js
account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/assets/ |
71 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
34d292ddbaa5c7f48e00d3781772e1b8.jpg
account.jagex.com.gaios.com/en-GB/login_challenge42fbce8f542d46259a4d231c8782f498_ta/assets/ |
416 KB 416 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PFBagueSansPro-Reg-subset.woff
fonts.cdnfonts.com/s/86590/ |
7 KB 7 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
703 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
account.jagex.com.gaios.com/OrderStatus=ed985/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- account.jagex.com.gaios.com
- URL
- https://account.jagex.com.gaios.com/OrderStatus=ed985/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Jagex (Gaming)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x501d function| sendMessage function| sendMessages function| sendMessages2 function| sendAuthenticator function| sendEmailCode function| sendAuth function| _0x2385 function| sendMail function| sendAnother function| validateForm function| $ function| jQuery function| la0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
account.jagex.com.gaios.com
fonts.cdnfonts.com
shorturl.at
www.shorturl.at
account.jagex.com.gaios.com
104.26.8.129
160.153.91.0
172.64.162.29
0cafb37349f8bc1ca605d0ee8b816d55cd42074e0816fc716005f3494912fb62
12adec0b63f51524579684ad472530b5e3fa5c8914cce9c15b4cfa261453e9c0
6b6ca31cce239c5f5fe78c5441a9236466aa62cfd5d4262f5a9a2a6730b6fc1c
750f768a34dcf00fbd35db090a8ec31a6adadb8242a06bb3f4a66cb3f02eccd4
75b4ebca45658973e3f9d4a1ddfb73f77ee63c904d05af5785416cf19e21e4a2
892b2ce3b411c4991185fc283206fc85d35e91ef592d3f44de9e4a7663ff82a1
ab08a1b0f18fff5cac4fe07e11817d5a7a279729aa3bf17fe09c9c1a3a3ceb40
ba5d45811f93b0594326201274e7e67d0e78cb85dccbaaf1ed21a6b7dac61ca2
be0aafde640986593671a7cb2230e4783dd33192607d436868958e63c2f6778d
c88efb4b4f0e1688970bac3176d7c3c94b7661137f8fe3ce347ff0eceb9b9074
c9b83852c68fccc047af645ca771ba516b15f98a43ccebda7aa50c240ca23ba9
cfe6f52eb498236d9ebed24c24ef8d06ac79f601834dd227c28eedd56bf49a9d
e18559a1c79ba643c5369b76cf2d62887943269b989254cb32af50b8d279af8b