services.runescape.rs-se.xyz Open in urlscan Pro
31.210.21.148 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Submission: On September 25 via automatic, source openphish (September 25th 2021, 1:18:08 am UTC) — Scanned from DE

Summary HTTP 20 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 20 HTTP transactions. The main IP is 31.210.21.148, located in Netherlands and belongs to AS_DELIS, US. The main domain is services.runescape.rs-se.xyz.
TLS certificate: Issued by R3 on September 24th 2021. Valid for: 3 months.

This is the only time services.runescape.rs-se.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Runescape (Online) Generic (Online) Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
15	31.210.21.148 31.210.21.148	211252 (AS_DELIS) (AS_DELIS)
2	104.16.18.94 104.16.18.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.106 142.250.185.106	15169 (GOOGLE) (GOOGLE)
1	151.101.65.229 151.101.65.229	54113 (FASTLY) (FASTLY)
20	5

15 31.210.21.148 (Netherlands)

ASN211252 (AS_DELIS, US)

services.runescape.rs-se.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.18.94 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.229 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	rs-se.xyz services.runescape.rs-se.xyz	752 KB
2	cloudflare.com cdnjs.cloudflare.com	17 KB
1	jsdelivr.net cdn.jsdelivr.net	7 KB
1	googleapis.com ajax.googleapis.com	34 KB
0	ip-api.com Failed ip-api.com Failed
20	5

	Domain	Requested by
15	services.runescape.rs-se.xyz	services.runescape.rs-se.xyz cdn.jsdelivr.net
2	cdnjs.cloudflare.com	services.runescape.rs-se.xyz
1	cdn.jsdelivr.net	services.runescape.rs-se.xyz
1	ajax.googleapis.com	services.runescape.rs-se.xyz
0	ip-api.com Failed	cdn.jsdelivr.net
20	5

This site contains links to these domains. Also see Links.

Domain
www.runescape.com
auth.jagex.com
social.auth.jagex.com
secure.runescape.com

Subject Issuer	Validity	Valid
services.runescape.rs-se.xyz R3	`2021-09-24` - `2021-12-23`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Frame ID: 091069D1EF3E0B61E0BF101EA75F1B51
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RuneScape Log In

Detected technologies

Django (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

20
Requests

95 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

894 kB
Transfer

1410 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://www.runescape.com/

Search URL Search Domain Scan URL

URL: https://www.runescape.com/cant_log_in
Title: Can't Log In?

Search URL Search Domain Scan URL

URL: https://auth.jagex.com/google/v1/social/login/en?correlationId=https%3Awww%3Acommunity
Title: Log in with Google

Search URL Search Domain Scan URL

URL: https://auth.jagex.com/apple/v1/social/login/en?correlationId=https%3Awww%3Acommunity
Title: Log in with Apple

Search URL Search Domain Scan URL

URL: https://social.auth.jagex.com/v1/login?provider=steam-web&clientLanguageCode=en&callbackUrl=https%3A%2F%2Fsecure.runescape.com%2Fm%3Dweblogin%2Flogin%3Fredirto%3Dhttps%253Awww%253Acommunity%26theme%3Drunescape%26flow%3Dweb&errorCallbackUrl=https%3A%2F%2Fsecure.runescape.com%2Fm%3Dweblogin%2FsocialError%3Fredirto%3Dhttps%253Awww%253Acommunity%26theme%3Drunescape%26flow%3Dweb
Title: Log in with Steam

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=sn-integration/facebook/gamelogin.ws?mod=www&ssl=1&dest=community
Title: Log in with Facebook

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=account-creation/create_account
Title: Create an account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set loginform.ws660,754,307,10170339,4,3042 Show response
services.runescape.rs-se.xyz/m=weblogin/ 10 KB
3 KB 170ms
116ms Document
text/html 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

120a98eb30b023c0327874fad68cdfb4f60e9599c8c557cc7b99ce7e42c4482c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Host: services.runescape.rs-se.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding Cookie
X-Frame-Options: DENY
X-Content-Type-Options: nosniff nosniff
Referrer-Policy: same-origin no-referrer-when-downgrade
Set-Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA; expires=Sat, 24 Sep 2022 01:18:01 GMT; Max-Age=31449600; Path=/; SameSite=Lax
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

GET
H/1.1 200
OK vendor-151.css
services.runescape.rs-se.xyz/static/runescape_login/css/dual/ 113 KB
15 KB 46ms
45ms Stylesheet
text/css 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/vendor-151.css

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

876aa84b5c13c20f86a041db2b68a2d0bb456661cc7b3b1066f7cc3f3702c227

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: W/"611d49d0-1c3c6"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK site-151.css
services.runescape.rs-se.xyz/static/runescape_login/css/dual/ 384 KB
97 KB 111ms
72ms Stylesheet
text/css 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

1684783bb4b210e3a99134a7e89c5832d8df165b22e7622a17189420b5b2442d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: W/"611d49d0-600fb"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ 58 KB
11 KB 29ms
13ms Stylesheet
text/css 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 01:18:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9262948
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10480
cf-request-id: 0a94038c8f0000175e002a6000000001
timing-allow-origin: *
last-modified: Tue, 16 Mar 2021 19:29:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "60510736-e7d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKaisvBBqGI5B7A8jR7fxkLZfLucCC2RzL7VOy6xgFL3vboS67EZFhRCuu9kg8rG05O4X6nxK8bBv4nWmW4dkwIvQ8Li9VRC55iF27vasmJm92i0DkuIKosH2FV8RDIDngSdsfPe"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69406a8e189c5b38-FRA
expires: Thu, 15 Sep 2022 01:18:01 GMT

GET
H/1.1 200
OK oldschool.png
services.runescape.rs-se.xyz/static/runescape_login/img/ 7 KB
8 KB 125ms
51ms Image
image/png 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/oldschool.png

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

1b89ca6caf8519eae363240a624f2139e5e5647adfe382b1c445734398d7f5fc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: "611d49d0-1c26"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7206
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK runescape.png
services.runescape.rs-se.xyz/static/runescape_login/img/ 3 KB
4 KB 81ms
48ms Image
image/png 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/runescape.png

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: "611d49d0-d2f"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3375
X-Content-Type-Options: nosniff

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ 94 KB
34 KB 50ms
14ms Script
text/javascript 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

sffe /

Resource Hash

b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 09:38:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56382
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33576
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Sat, 24 Sep 2022 09:38:19 GMT

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios/dist/ 19 KB
7 KB 22ms
6ms Script
application/javascript 151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0d5437ecf617def25148981d7d10c12a883a3b71e851503cd767f21ad8aeb515

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35457
x-jsd-version: 0.21.4
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 6834
etag: W/"4ad5-6xdr1eZTB71f+XiAdXZxHeIeQLg"
x-served-by: cache-fra19120-FRA, cache-hhn4037-HHN
x-jsd-version-type: version
date: Sat, 25 Sep 2021 01:18:01 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 platform.min.js Show response
cdnjs.cloudflare.com/ajax/libs/platform/1.3.6/ 14 KB
6 KB 29ms
14ms Script
application/javascript 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/platform/1.3.6/platform.min.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c039b6e245af3041933a2e283eb929be6c05618616e34ef2b8e3ca2bb368007

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 01:18:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 115031
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5648
timing-allow-origin: *
last-modified: Sat, 04 Jul 2020 11:56:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f006e5f-38b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oF8SGW4SPvkJQquv9k7cd2yBE5Zut65RJ9%2FMxoYswvgTWC41L4xHBTePXaNGhboXOOd%2Fb1aUvXARL2HMvuARLSzNbRGk8AXRw%2BenB4L6VIthV%2BDsg3%2BIERxS19GT3sZ39Z3Gdtzj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69406a8e189d5b38-FRA
expires: Thu, 15 Sep 2022 01:18:01 GMT

GET
H/1.1 200
OK login.js Show response
services.runescape.rs-se.xyz/static/runescape_login/js/ 1 KB
1 KB 68ms
22ms Script
application/javascript 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/js/login.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

4e38f516482b1af70acd074331f808e48534b329e7faacf5ba91cce05a38d6d9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 12:40:26 GMT
Server: nginx
ETag: W/"611cffba-4b3"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK telemetry.js Show response
services.runescape.rs-se.xyz/static/runescape_login/js/ 1 KB
1 KB 121ms
72ms Script
application/javascript 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/js/telemetry.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

a54733cc0c60f66bc978e5fdfe3faa61d7585e1baa13deab6ed86566e7bc92bf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 12 Jul 2021 18:09:11 GMT
Server: nginx
ETag: W/"60ec8547-41d"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK js.cookie.min.js Show response
services.runescape.rs-se.xyz/static/runescape_login/js/ 2 KB
2 KB 85ms
16ms Script
application/javascript 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/js/js.cookie.min.js

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

39b8fe6364621725ff90431a34af0f87976d95c00cbfd1d0f3711a3f1fa1a07b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:01 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Mon, 12 Jul 2021 18:09:11 GMT
Server: nginx
ETag: W/"60ec8547-79f"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=utf-8
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET /
ip-api.com/json/ 0
0

POST
H/1.1 201
Created / Show response
services.runescape.rs-se.xyz/api/v1/add_current_visitor/ 172 B
733 B 76ms
76ms XHR
application/json 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/api/v1/add_current_visitor/

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

7e4b65b7bfb9d32e3ccd43369e0276b410652237023a2f465b0caf15e12b4658

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://services.runescape.rs-se.xyz
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9
Sec-Fetch-Dest: empty
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Content-Length: 164
Pragma: no-cache
Host: services.runescape.rs-se.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Cache-Control: no-cache
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Sec-Fetch-Site: same-origin
Accept: application/json, text/plain, */*
Referer: https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: same-origin no-referrer-when-downgrade
Server: nginx
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json
Allow: POST, OPTIONS
X-Content-Type-Options: nosniff nosniff
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept
Content-Length: 172
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK tile.jpg
services.runescape.rs-se.xyz/static/runescape_login/img/responsive/runescape/backgrounds/ 2 KB
2 KB 17ms
17ms Image
image/jpeg 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/responsive/runescape/backgrounds/tile.jpg

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: "611d49d0-789"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/jpeg
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1929
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK dual.jpg
services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/backgrounds/ 539 KB
539 KB 31ms
31ms Image
image/jpeg 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/backgrounds/dual.jpg

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: "611d49d0-86bc2"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/jpeg
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 551874
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK google.svg
services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/ 763 B
948 B 17ms
17ms Image
image/svg+xml 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/google.svg

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: W/"611d49d0-2fb"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK apple-black.svg
services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/ 2 KB
1 KB 17ms
17ms Image
image/svg+xml 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/apple-black.svg

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

22557750f99896418f230d1d90cd2a86395226e2b7f7c0254d18ba96dd3abdeb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: W/"611d49d0-716"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK fb.svg
services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/ 429 B
888 B 18ms
17ms Image
image/svg+xml 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/img/responsive/common/logos/fb.svg

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/site-151.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: W/"611d49d0-1ad"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Vary: Accept-Encoding
X-Content-Type-Options: nosniff

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646

Request headers

Referer
Origin: https://services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
DATA 200
OK truncated
/ 59 KB
59 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d

Request headers

Referer
Origin: https://services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
H/1.1 200
OK fontawesome-webfont.woff2
services.runescape.rs-se.xyz/static/runescape_login/fonts/ 75 KB
76 KB 49ms
31ms Font
font/woff2 31.210.21.148
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL

https://services.runescape.rs-se.xyz/static/runescape_login/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: services.runescape.rs-se.xyz
URL: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/vendor-151.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.210.21.148 , Netherlands, ASN211252 (AS_DELIS, US),

Reverse DNS

Software

nginx /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://services.runescape.rs-se.xyz
Accept-Encoding: gzip, deflate, br
Host: services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/vendor-151.css
Cookie: csrftoken=LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA
Connection: keep-alive
Referer: https://services.runescape.rs-se.xyz/static/runescape_login/css/dual/vendor-151.css
Origin: https://services.runescape.rs-se.xyz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 25 Sep 2021 01:18:02 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 18 Aug 2021 17:56:32 GMT
Server: nginx
ETag: "611d49d0-12d68"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: font/woff2
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 77160
X-Content-Type-Options: nosniff

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ip-api.com
URL: http://ip-api.com/json/?fields=status,message,continent,continentCode,country,countryCode,region,regionName,city,district,zip,lat,lon,timezone,offset,currency,isp,org,as,asname,reverse,mobile,proxy,hosting,query

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Runescape (Online) Generic (Online) Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			services.runescape.rs-se.xyz/	1970-01-20 06:13:02	Name: csrftoken Value: LMsn5UmcqCXmrr4Xk4ih81JIJihYAE8u3V3GWl1gpJcMs49moUIYNUq84G5cJMJA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js(Line 1) Message: Mixed Content: The page at 'https://services.runescape.rs-se.xyz/m=weblogin/loginform.ws660,754,307,10170339,4,3042' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://ip-api.com/json/?fields=status,message,continent,continentCode,country,countryCode,region,regionName,city,district,zip,lat,lon,timezone,offset,currency,isp,org,as,asname,reverse,mobile,proxy,hosting,query'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
ip-api.com
services.runescape.rs-se.xyz
ip-api.com
104.16.18.94
142.250.185.106
151.101.65.229
31.210.21.148
0d5437ecf617def25148981d7d10c12a883a3b71e851503cd767f21ad8aeb515
120a98eb30b023c0327874fad68cdfb4f60e9599c8c557cc7b99ce7e42c4482c
1684783bb4b210e3a99134a7e89c5832d8df165b22e7622a17189420b5b2442d
1b89ca6caf8519eae363240a624f2139e5e5647adfe382b1c445734398d7f5fc
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
22557750f99896418f230d1d90cd2a86395226e2b7f7c0254d18ba96dd3abdeb
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
39b8fe6364621725ff90431a34af0f87976d95c00cbfd1d0f3711a3f1fa1a07b
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
4e38f516482b1af70acd074331f808e48534b329e7faacf5ba91cce05a38d6d9
6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
7e4b65b7bfb9d32e3ccd43369e0276b410652237023a2f465b0caf15e12b4658
876aa84b5c13c20f86a041db2b68a2d0bb456661cc7b3b1066f7cc3f3702c227
8c039b6e245af3041933a2e283eb929be6c05618616e34ef2b8e3ca2bb368007
a54733cc0c60f66bc978e5fdfe3faa61d7585e1baa13deab6ed86566e7bc92bf
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a

services.runescape.rs-se.xyz Open in urlscan Pro 31.210.21.148 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

20 Requests

95 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

894 kBTransfer

1410 kBSize

1 Cookies

7 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

services.runescape.rs-se.xyz Open in urlscan Pro
31.210.21.148 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

95 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

894 kB
Transfer

1410 kB
Size

1
Cookies

20 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!