services.runescape.com-u.cz Open in urlscan Pro
93.158.239.35  Malicious Activity! Public Scan

5 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request loginform.ws824,184,425,42189856,1 Show response services.runescape.com-u.cz/m=weblogin/	9 KB 10 KB	439ms 43ms	Document text/html	93.158.239.35 FNXTEC
General Check archive.org Show headers Download Go to Full URL https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305 Server 93.158.239.35 , Netherlands, ASN60503 (FNXTEC, NL), Reverse DNS protected.hyperfilter.com Software / Resource Hash 06bc38c6776cff277ce057ada58a43e89beb416bb0a85651f61ba92bdab80b84 Request headers :method GET :authority services.runescape.com-u.cz :scheme https :path /m=weblogin/loginform.ws824,184,425,42189856,1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 set-cookie 1-session=MTU2NTU2NzA0M3xEdi1CQkFFQ180SUFBUkFCRUFBQVpfLUNBQUlHYzNSeWFXNW5EQXdBQ2t4dloybHVSbWxsYkdRR2MzUnlhVzVuREJJQUVGaFZkR04zWm1oaVMzSklTRU5wY1VvR2MzUnlhVzVuREE4QURWQmhjM04zYjNKa1JtbGxiR1FHYzNSeWFXNW5EQklBRUc1aFYzWnhkMjE1ZVdaVGVsRkNZbmc9fCj-wzAfAwgWCuyiETsUUBz5ZkO8RMwdaJMPmq0FAKpj; Path=/; Expires=Tue, 10 Sep 2019 23:44:03 GMT; Max-Age=2592000 content-type text/html; charset=utf-8 date Sun, 11 Aug 2019 23:44:03 GMT
GET H/1.1	200 OK	vendor-119.css www.runescape.com/css/c/responsive/runescape/	111 KB 15 KB	416ms 326ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/runescape/vendor-119.css Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash fd5432016b141839618936e48084f81a5f92f7e6948051c2b6a3d21d8ad77f58 Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 11 Aug 2019 23:44:07 GMT Content-Encoding gzip Last-modified Sun, 04-Aug-2019 23:44:07 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 15264 Expires Sun, 11 Aug 2019 23:59:07 GMT
GET H/1.1	200 OK	site-119.css www.runescape.com/css/c/responsive/runescape/	302 KB 87 KB	423ms 332ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/runescape/site-119.css Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash 2cdf04937b9db92b4495e59187e907b3c2682623100d72a4c9064daa8f2d9eee Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 11 Aug 2019 23:44:07 GMT Content-Encoding gzip Last-modified Sun, 04-Aug-2019 23:44:07 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 89186 Expires Sun, 11 Aug 2019 23:59:07 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.11.0/	94 KB 33 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:825::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 19 Jun 2019 19:11:19 GMT content-encoding gzip x-content-type-options nosniff age 4595567 status 200 alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 33576 x-xss-protection 0 last-modified Tue, 20 Dec 2016 18:17:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 18 Jun 2020 19:11:19 GMT
GET H2	200	oldschool.png services.runescape.com-u.cz/assets/img/logos/	29 KB 29 KB	30ms 27ms	Image image/png	93.158.239.35 FNXTEC
General Check archive.org Show headers Download Go to Show image Full URL https://services.runescape.com-u.cz/assets/img/logos/oldschool.png Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305 Server 93.158.239.35 , Netherlands, ASN60503 (FNXTEC, NL), Reverse DNS protected.hyperfilter.com Software / Resource Hash f3eb8d586a710fd04797363692acb5593196681b589f8491a43be0fc68000474 Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Sun, 11 Aug 2019 23:44:03 GMT last-modified Thu, 07 Mar 2019 20:53:41 GMT accept-ranges bytes content-length 29503 content-type image/png
GET H2	200	runescape.png services.runescape.com-u.cz/assets/img/logos/	3 KB 3 KB	28ms 26ms	Image image/png	93.158.239.35 FNXTEC
General Check archive.org Show headers Download Go to Show image Full URL https://services.runescape.com-u.cz/assets/img/logos/runescape.png Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305 Server 93.158.239.35 , Netherlands, ASN60503 (FNXTEC, NL), Reverse DNS protected.hyperfilter.com Software / Resource Hash 20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3 Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Sun, 11 Aug 2019 23:44:03 GMT last-modified Thu, 07 Mar 2019 20:53:41 GMT accept-ranges bytes content-length 3375 content-type image/png
GET H/1.1	200 OK	tile.jpg www.runescape.com/img/responsive/runescape/backgrounds/	2 KB 2 KB	161ms 160ms	Image image/jpeg	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/runescape/backgrounds/tile.jpg Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89 Request headers Sec-Fetch-Mode no-cors Referer https://www.runescape.com/css/c/responsive/runescape/site-119.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 11 Aug 2019 23:44:07 GMT Last-modified Sun, 04-Aug-2019 23:44:07 GMT Server nginx X-Cache-Status BYPASS Content-Type image/jpeg Cache-control max-age=900, public Connection keep-alive Content-Length 1929 Expires Sun, 11 Aug 2019 23:59:07 GMT
GET H2	200	dual.jpg services.runescape.com-u.cz/assets/img/backgrounds/	539 KB 539 KB	25ms 25ms	Image image/jpeg	93.158.239.35 FNXTEC
General Check archive.org Show headers Download Go to Show image Full URL https://services.runescape.com-u.cz/assets/img/backgrounds/dual.jpg Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305 Server 93.158.239.35 , Netherlands, ASN60503 (FNXTEC, NL), Reverse DNS protected.hyperfilter.com Software / Resource Hash 6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b Request headers Sec-Fetch-Mode no-cors Referer https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Sun, 11 Aug 2019 23:44:03 GMT last-modified Thu, 07 Mar 2019 20:53:41 GMT accept-ranges bytes content-length 551874 content-type image/jpeg
GET H/1.1	200 OK	fb.svg www.runescape.com/img/responsive/common/logos/	429 B 707 B	161ms 161ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/fb.svg Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash 4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb Request headers Sec-Fetch-Mode no-cors Referer https://www.runescape.com/css/c/responsive/runescape/site-119.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 11 Aug 2019 23:44:07 GMT Server nginx X-Cache-Status BYPASS Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 429 Expires Sun, 11 Aug 2019 23:59:07 GMT
GET H/1.1	200 OK	google.svg www.runescape.com/img/responsive/common/logos/	763 B 1 KB	219ms 169ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/google.svg Requested by Host: services.runescape.com-u.cz URL: https://services.runescape.com-u.cz/m=weblogin/loginform.ws824,184,425,42189856,1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a Request headers Sec-Fetch-Mode no-cors Referer https://www.runescape.com/css/c/responsive/runescape/site-119.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 11 Aug 2019 23:44:07 GMT Server nginx X-Cache-Status BYPASS Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 763 Expires Sun, 11 Aug 2019 23:59:07 GMT
GET DATA	200 OK	truncated /	25 KB 25 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Origin https://services.runescape.com-u.cz Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	59 KB 59 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Origin https://services.runescape.com-u.cz Response headers Content-Type application/x-font-woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Runescape (Online) Generic (Online) Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| checkUsername function| checkPassword function| checkLogin function| checkField

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			services.runescape.com-u.cz/	1970-01-19 03:35:59	Name: 1-session Value: MTU2NTU2NzA0M3xEdi1CQkFFQ180SUFBUkFCRUFBQVpfLUNBQUlHYzNSeWFXNW5EQXdBQ2t4dloybHVSbWxsYkdRR2MzUnlhVzVuREJJQUVGaFZkR04zWm1oaVMzSklTRU5wY1VvR2MzUnlhVzVuREE4QURWQmhjM04zYjNKa1JtbGxiR1FHYzNSeWFXNW5EQklBRUc1aFYzWnhkMjE1ZVdaVGVsRkNZbmc9fCj-wzAfAwgWCuyiETsUUBz5ZkO8RMwdaJMPmq0FAKpj

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
services.runescape.com-u.cz
www.runescape.com
2a00:1450:4001:825::200a
91.235.140.148
93.158.239.35
06bc38c6776cff277ce057ada58a43e89beb416bb0a85651f61ba92bdab80b84
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
2cdf04937b9db92b4495e59187e907b3c2682623100d72a4c9064daa8f2d9eee
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
f3eb8d586a710fd04797363692acb5593196681b589f8491a43be0fc68000474
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a
fd5432016b141839618936e48084f81a5f92f7e6948051c2b6a3d21d8ad77f58