secure.oldschool.co-trw.xyz Open in urlscan Pro
23.254.228.246 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Submission Tags: 7216245
Submission: On July 06 via api (July 6th 2021, 1:29:57 pm UTC) from NL

Summary HTTP 11 Redirects Links 5 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 23.254.228.246, located in United States and belongs to HOSTWINDS, US. The main domain is secure.oldschool.co-trw.xyz.
TLS certificate: Issued by R3 on July 5th 2021. Valid for: 3 months.

This is the only time secure.oldschool.co-trw.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Runescape (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	23.254.228.246 23.254.228.246		54290 (HOSTWINDS) (HOSTWINDS)
1	2a00:1450:400... 2a00:1450:4001:813::200a		15169 (GOOGLE) (GOOGLE)
11	3

10 23.254.228.246 (United States)

ASN54290 (HOSTWINDS, US)
PTR: hwsrv-891413.hostwindsdns.com

secure.oldschool.co-trw.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	co-trw.xyz secure.oldschool.co-trw.xyz	1 MB
1	googleapis.com ajax.googleapis.com	33 KB
11	2

	Domain	Requested by
10	secure.oldschool.co-trw.xyz	secure.oldschool.co-trw.xyz
1	ajax.googleapis.com	secure.oldschool.co-trw.xyz
11	2

This site contains links to these domains. Also see Links.

Domain
oldschool.runescape.com
www.runescape.com
secure.runescape.com

Subject Issuer	Validity	Valid
secure.oldschool.co-trw.xyz R3	`2021-07-05` - `2021-10-03`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Frame ID: DF5644F6B5A0B57FE3D9A6D4C2874FD1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1355 kB
Transfer

1413 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://oldschool.runescape.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.runescape.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.runescape.com/cant_log_in
Title: Can't Log In?

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=sn-integration/google/gamelogin.ws?mod=www&ssl=0&dest=community
Title: Log In

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=account-creation/create_account
Title: Create an account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set loginform.ws12,8563,74,25,1 Show response
secure.oldschool.co-trw.xyz/m=weblogin/ 7 KB
7 KB 148ms
44ms Document
text/html 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 / PHP/8.0.8
Resource Hash: cc08d1b7d8a911653712da4ca75552492af547be52f3c1c524ea2932a251e9a6

Request headers

Host: secure.oldschool.co-trw.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:33 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
X-Powered-By: PHP/8.0.8
Set-Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6923
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK oldschool.png
secure.oldschool.co-trw.xyz/assets/img/logos/ 109 KB
109 KB 28ms
27ms Image
image/png 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/assets/img/logos/oldschool.png
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 223634982a56797f7cc29e2d15f5115ea8a7dbe27f1a7cdd0375b4f27e71f6ff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:50 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "1b445-5844b421a8080"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 111685

GET
H/1.1 200
OK runescape.png
secure.oldschool.co-trw.xyz/assets/img/logos/ 3 KB
4 KB 93ms
43ms Image
image/png 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/assets/img/logos/runescape.png
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:50 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "d2f-5844b421a8080"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3375

GET
H/1.1 200
OK vendor.css
secure.oldschool.co-trw.xyz/assets/css/ 113 KB
113 KB 86ms
38ms Stylesheet
text/css 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.oldschool.co-trw.xyz/assets/css/vendor.css
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: ec82bf718cf9176787755af3447cd3cff195856df4ffc7d4a7ba8c12ee677f24

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "1c2b2-5844b42390500"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 115378

GET
H/1.1 200
OK site.css
secure.oldschool.co-trw.xyz/assets/css/ 257 KB
257 KB 92ms
43ms Stylesheet
text/css 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 24c59612a4984cd121aa6cfcf0127ccfc7d23db59aba3988980fa9b9542340b7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "403aa-5844b42390500"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 263082

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ 94 KB
33 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js

Requested by

Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.oldschool.co-trw.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 10:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11934
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33576
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 10:10:39 GMT

GET
H/1.1 200
OK global.js Show response
secure.oldschool.co-trw.xyz/assets/weblogin/js/ 2 KB
2 KB 91ms
42ms Script
application/javascript 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.oldschool.co-trw.xyz/assets/weblogin/js/global.js?10
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 6ff5a1c0a6bdad5422b5728390a3a4805980c198ff878dac156ace9cd835e505

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "60c-5844b42390500"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1548

GET
H/1.1 200
OK dual.jpg
secure.oldschool.co-trw.xyz/assets/img/backgrounds/ 743 KB
743 KB 83ms
33ms Image
image/jpeg 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/assets/img/backgrounds/dual.jpg
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: f5091afb05db302c7c8371856cd12299d71136a72b6395d798df5ea73df6751a

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/m=weblogin/loginform.ws12,8563,74,25,1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:50 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "b9c82-5844b421a8080"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 760962

GET
H/1.1 404
Not Found tile.jpg
secure.oldschool.co-trw.xyz/img/responsive/runescape/backgrounds/ 250 B
250 B 31ms
30ms Image
text/html 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/img/responsive/runescape/backgrounds/tile.jpg
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 367ca1240f957110e53976ab28b9fe757fed5933d3c688949ed394053a9f0272

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 250
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK fb.svg
secure.oldschool.co-trw.xyz/common/img/logos/ 429 B
762 B 33ms
32ms Image
image/svg+xml 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/common/img/logos/fb.svg
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: 4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "1ad-5844b42390500"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 429

GET
H/1.1 200
OK google.svg
secure.oldschool.co-trw.xyz/common/img/logos/ 763 B
1 KB 28ms
27ms Image
image/svg+xml 23.254.228.246
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.oldschool.co-trw.xyz/common/img/logos/google.svg
Requested by: Host: secure.oldschool.co-trw.xyz
URL: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.254.228.246 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-891413.hostwindsdns.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8 /
Resource Hash: f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: secure.oldschool.co-trw.xyz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
Cookie: PHPSESSID=qnfuklfj5d5p4a49g5meu7pmn1
Connection: keep-alive
Referer: https://secure.oldschool.co-trw.xyz/assets/css/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 13:29:34 GMT
Last-Modified: Sun, 17 Mar 2019 14:40:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/8.0.8
ETag: "2fb-5844b42390500"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 763

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646

Request headers

Origin: https://secure.oldschool.co-trw.xyz
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
DATA 200
OK truncated
/ 59 KB
59 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d

Request headers

Origin: https://secure.oldschool.co-trw.xyz
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Runescape (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| currentMousePos function| checkLogin function| checkMouse function| checkField function| checkCaptcha

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secure.oldschool.co-trw.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: qnfuklfj5d5p4a49g5meu7pmn1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
secure.oldschool.co-trw.xyz
23.254.228.246
2a00:1450:4001:813::200a
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
223634982a56797f7cc29e2d15f5115ea8a7dbe27f1a7cdd0375b4f27e71f6ff
24c59612a4984cd121aa6cfcf0127ccfc7d23db59aba3988980fa9b9542340b7
367ca1240f957110e53976ab28b9fe757fed5933d3c688949ed394053a9f0272
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
6ff5a1c0a6bdad5422b5728390a3a4805980c198ff878dac156ace9cd835e505
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
cc08d1b7d8a911653712da4ca75552492af547be52f3c1c524ea2932a251e9a6
ec82bf718cf9176787755af3447cd3cff195856df4ffc7d4a7ba8c12ee677f24
f5091afb05db302c7c8371856cd12299d71136a72b6395d798df5ea73df6751a
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a