runica.net
Open in
urlscan Pro
2606:4700:30::681b:bbd0
Malicious Activity!
Public Scan
Effective URL: https://runica.net/wp-includes/customize/recaptcha/login?cmd=_signin&dispatch=03539042971e19b60c7d45f93&locale=en_
Submission: On November 20 via automatic, source phishtank
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on November 5th 2018. Valid for: 6 months.
This is the only time runica.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 10 | 2606:4700:30:... 2606:4700:30::681b:bbd0 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
9 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
runica.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
runica.net
2 redirects
runica.net |
75 KB |
0 |
julieslight.com
Failed
css.julieslight.com Failed |
|
9 | 2 |
Domain | Requested by | |
---|---|---|
10 | runica.net |
2 redirects
runica.net
|
0 | css.julieslight.com Failed |
runica.net
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni196631.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-11-05 - 2019-05-14 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://runica.net/wp-includes/customize/recaptcha/login?cmd=_signin&dispatch=03539042971e19b60c7d45f93&locale=en_
Frame ID: B373734A35BF093103808C7E2451A0B1
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://runica.net/wp-includes/customize/recaptcha
HTTP 301
https://runica.net/wp-includes/customize/recaptcha/ HTTP 302
https://runica.net/wp-includes/customize/recaptcha/login?cmd=_signin&dispatch=03539042971e19b60... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://runica.net/wp-includes/customize/recaptcha
HTTP 301
https://runica.net/wp-includes/customize/recaptcha/ HTTP 302
https://runica.net/wp-includes/customize/recaptcha/login?cmd=_signin&dispatch=03539042971e19b60c7d45f93&locale=en_ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
runica.net/wp-includes/customize/recaptcha/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main2.css
runica.net/wp-includes/customize/recaptcha/css/ |
64 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.js
runica.net/wp-includes/customize/recaptcha/js/vendor/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery2.js
runica.net/wp-includes/customize/recaptcha/js/vendor/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plugins2.js
runica.net/wp-includes/customize/recaptcha/js/ |
55 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main2.js
runica.net/wp-includes/customize/recaptcha/js/ |
3 KB 869 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
login,css
css.julieslight.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
runica.net/wp-includes/customize/recaptcha/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
runica.net/wp-includes/customize/recaptcha/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- css.julieslight.com
- URL
- http://css.julieslight.com/login,css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| html5 object| Modernizr function| yepnope function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
runica.net/ | Name: PHPSESSID Value: i7a2c1k8aqr38cf1umjkjiaud5 |
|
.runica.net/ | Name: __cfduid Value: d327d5c8f379d4bfc15b99530dfa9f84c1542705038 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
css.julieslight.com
runica.net
css.julieslight.com
2606:4700:30::681b:bbd0
3d6fd1d01b7b8800c81c9557eab05a0ca5858483c426e0ba9bdca515dd7b2521
607530a98b7c468dd0734a70b6e1d3d1decf1d2e5f949cae492b98f43ee74949
69fcf7682b771176634dc54deb0c412cf9ec40df931d56a0480ee51b47ed1598
c06548ba46194569184a132f20189bd49c7c71ddbde87b93dad377d6e90d0ad4
cf0a8ff047b8dd6b10dcab9a3be0413e2be2f11dd3173210b1423498d1b93fff
cfc158ba1c0c395d5a76a917c7bd1eab76a36401cc512a99d869198941a65dbb
d706fbfd240448c9d55c48c055c8124dfa0c20cf6caec529c2717a5d5d265dd0
e8fbccfcac07bb996f74fd19e77f601372a374b3f756a2d8389e931271945c2a