services.runescape.com-z.ru
Open in
urlscan Pro
194.36.191.196
Malicious Activity!
Public Scan
Effective URL: https://services.runescape.com-z.ru/login.ws,SAT2226892068,1?I=MTg1LjE1Ni4xNzUuMTA3
Submission: On August 05 via automatic, source phishtank
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 3rd 2020. Valid for: 3 months.
This is the only time services.runescape.com-z.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Runescape (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 192.0.78.26 192.0.78.26 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 10 | 194.36.191.196 194.36.191.196 | 60117 (HS) (HS) | |
10 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
com-z.ru
1 redirects
services.runescape.com-z.ru |
1 MB |
1 |
href.li
href.li |
429 B |
10 | 2 |
Domain | Requested by | |
---|---|---|
10 | services.runescape.com-z.ru |
1 redirects
href.li
services.runescape.com-z.ru |
1 | href.li | |
10 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tls.automattic.com Let's Encrypt Authority X3 |
2020-06-11 - 2020-09-09 |
3 months | crt.sh |
services.runescape.com-z.ru cPanel, Inc. Certification Authority |
2020-08-03 - 2020-11-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://services.runescape.com-z.ru/login.ws,SAT2226892068,1?I=MTg1LjE1Ni4xNzUuMTA3
Frame ID: 50EEA031B376294282B1D773110E9D6F
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://href.li/?https://services.runescape.com-z.ru/2019giveaway Page URL
-
https://services.runescape.com-z.ru/2019giveaway
HTTP 302
https://services.runescape.com-z.ru/login.ws,SAT2226892068,1?I=MTg1LjE1Ni4xNzUuMTA3 Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://href.li/?https://services.runescape.com-z.ru/2019giveaway Page URL
-
https://services.runescape.com-z.ru/2019giveaway
HTTP 302
https://services.runescape.com-z.ru/login.ws,SAT2226892068,1?I=MTg1LjE1Ni4xNzUuMTA3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
href.li/ |
533 B 429 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.ws,SAT2226892068,1
services.runescape.com-z.ru/ Redirect Chain
|
12 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PDPNLI.css
services.runescape.com-z.ru/MEUELY/SXFUOT/ |
70 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QUDKRT.css
services.runescape.com-z.ru/MEUELY/SXFUOT/ |
287 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UPIZMC.png
services.runescape.com-z.ru/MEUELY/GRPKRC/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UPIZMC2.png
services.runescape.com-z.ru/MEUELY/GRPKRC/ |
29 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tile.jpg
services.runescape.com-z.ru/img/m0tek/runescape/backgrounds/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OBWQTP.jpg
services.runescape.com-z.ru/MEUELY/WMYMVZ/ |
1 MB 1 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.svg
services.runescape.com-z.ru/AllahAkbar/PathOfNoReturn/m0tek/ |
429 B 350 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google.svg
services.runescape.com-z.ru/AllahAkbar/PathOfNoReturn/m0tek/ |
763 B 422 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
59 KB 59 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Runescape (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
href.li
services.runescape.com-z.ru
192.0.78.26
194.36.191.196
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
230d91b44ffd4de6a3cfe521b2560e5ed59763df51a5de76fc01513787fb1682
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
c2bb142610c83f14921c54bdc9f6322383ab5bfca543e88f4706b4ff47fd0ab0
c3ebdb7f3f843918a47fedddc3425f5b2d619e7b8761051a86090f48543630ed
dc0b9c5c0c22dd73b243e18829283aee3cc38eab7d7c6d624a2553344714f7ab
e08058982a21bd9a4cee22d6e09f9e4f1c046112243bef3c99937851009b34ca
e0c6f6795983dffe0e31b0cfe48417345e2c94ba27d76e22c1b056dce1ffd7e7
f3eb8d586a710fd04797363692acb5593196681b589f8491a43be0fc68000474
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a