secure.runescape.rs-b.xyz Open in urlscan Pro
193.142.59.79  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set eoc.php Show response secure.runescape.rs-b.xyz/pages/runescape/	71 KB 4 KB	960ms 104ms	Document text/html	193.142.59.79 HOSTSLIM-GLOBAL-N...
General Check archive.org Show headers Download Go to Full URL https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 193.142.59.79 -, , ASN207083 (HOSTSLIM-GLOBAL-NETWORK, NL), Reverse DNS Software nginx / PHP/7.3.18RC1 Resource Hash a91d3e0c923393cc69c737cee7c77cb4c9dbd60d30b326fec0131a54f6d1cb7a Request headers Host secure.runescape.rs-b.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx Date Fri, 08 May 2020 00:25:46 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Vary Accept-Encoding X-Powered-By PHP/7.3.18RC1 Set-Cookie PHPSESSID=2acoh2bsmcbnh5otcj2fm42u1j; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Content-Encoding gzip
GET H/1.1	200 OK	vendor-130.css www.runescape.com/css/c/responsive/dual/	111 KB 15 KB	391ms 317ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/vendor-130.css Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash fd5432016b141839618936e48084f81a5f92f7e6948051c2b6a3d21d8ad77f58 Request headers Referer https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 00:25:45 GMT Content-Encoding gzip Last-modified Fri, 01-May-2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 15264 Expires Fri, 08 May 2020 00:40:45 GMT
GET H/1.1	200 OK	site-130.css www.runescape.com/css/c/responsive/dual/	310 KB 88 KB	400ms 326ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/site-130.css Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash ca0236a514d5afa5a984e13509ae9ea6d6dbac087416b0290f609e9ddfec0c99 Request headers Referer https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 00:25:45 GMT Content-Encoding gzip Last-modified Fri, 01-May-2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 89782 Expires Fri, 08 May 2020 00:40:45 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.11.0/	94 KB 33 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:824::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 14 Apr 2020 21:00:51 GMT content-encoding gzip x-content-type-options nosniff age 1999493 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33576 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 14 Apr 2021 21:00:51 GMT
GET H/1.1	200 OK	global.js Show response secure.runescape.rs-b.xyz/assets/weblogin/js/	714 B 680 B	26ms 25ms	Script application/javascript	193.142.59.79 HOSTSLIM-GLOBAL-N...
General Check archive.org Show headers Download Go to Full URL https://secure.runescape.rs-b.xyz/assets/weblogin/js/global.js Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 193.142.59.79 -, , ASN207083 (HOSTSLIM-GLOBAL-NETWORK, NL), Reverse DNS Software nginx / Resource Hash bab23ec75e1f1700c3a54dd5a3c0b112d37b2319d9698f22a3f16ec887cc44e0 Request headers Referer https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 00:25:46 GMT Content-Encoding gzip Last-Modified Thu, 07 May 2020 16:41:05 GMT Server nginx ETag W/"5eb43a21-2ca" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=315360000 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	404 Not found	runescape.png www.runescape.com/img/responsive/common/logos/	0 0	259ms 186ms	Image text/html	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/runescape.png Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	tile.jpg www.runescape.com/img/responsive/runescape/backgrounds/	2 KB 2 KB	174ms 173ms	Image image/jpeg	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/runescape/backgrounds/tile.jpg Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89 Request headers Referer https://www.runescape.com/css/c/responsive/dual/site-130.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 00:25:45 GMT Last-modified Fri, 01-May-2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type image/jpeg Cache-control max-age=900, public Connection keep-alive Content-Length 1929 Expires Fri, 08 May 2020 00:40:45 GMT
GET H/1.1	200 OK	dual.jpg www.runescape.com/img/responsive/common/backgrounds/	539 KB 539 KB	312ms 312ms	Image image/jpeg	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/backgrounds/dual.jpg Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash 6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b Request headers Referer https://www.runescape.com/css/c/responsive/dual/site-130.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 08 May 2020 00:25:45 GMT Last-modified Fri, 01-May-2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type image/jpeg Cache-control max-age=900, public Connection keep-alive Content-Length 551874 Expires Fri, 08 May 2020 00:40:45 GMT
GET H/1.1	200 OK	fb.svg www.runescape.com/img/responsive/common/logos/	429 B 707 B	304ms 304ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/fb.svg Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash 4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb Request headers Referer https://www.runescape.com/css/c/responsive/dual/site-130.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 May 2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 429 Expires Fri, 08 May 2020 00:40:45 GMT
GET H/1.1	200 OK	google.svg www.runescape.com/img/responsive/common/logos/	763 B 1 KB	311ms 266ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/google.svg Requested by Host: secure.runescape.rs-b.xyz URL: https://secure.runescape.rs-b.xyz/pages/runescape/eoc.php?id=14 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a Request headers Referer https://www.runescape.com/css/c/responsive/dual/site-130.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 May 2020 00:25:45 GMT Server nginx X-Cache-Status BYPASS Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 763 Expires Fri, 08 May 2020 00:40:45 GMT
GET DATA	200 OK	truncated /	25 KB 25 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer Origin https://secure.runescape.rs-b.xyz Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	59 KB 59 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer Origin https://secure.runescape.rs-b.xyz Response headers Content-Type application/x-font-woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer) Runescape (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| yeWGVZTpG object| HRIfrEzZhjd function| $ function| jQuery function| checkLogin function| checkField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
secure.runescape.rs-b.xyz
www.runescape.com
193.142.59.79
2a00:1450:4001:824::200a
91.235.140.148
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
a91d3e0c923393cc69c737cee7c77cb4c9dbd60d30b326fec0131a54f6d1cb7a
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
bab23ec75e1f1700c3a54dd5a3c0b112d37b2319d9698f22a3f16ec887cc44e0
ca0236a514d5afa5a984e13509ae9ea6d6dbac087416b0290f609e9ddfec0c99
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a
fd5432016b141839618936e48084f81a5f92f7e6948051c2b6a3d21d8ad77f58