services.runescape.rs-sx.xyz
Open in
urlscan Pro
31.210.21.148
Malicious Activity!
Public Scan
Submission Tags: 7303121
Submission: On September 26 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 26th 2021. Valid for: 3 months.
This is the only time services.runescape.rs-sx.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Runescape (Online) Generic (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 31.210.21.148 31.210.21.148 | 211252 (AS_DELIS) (AS_DELIS) | |
2 | 104.16.18.94 104.16.18.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.217.18.106 172.217.18.106 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.1.229 151.101.1.229 | 54113 (FASTLY) (FASTLY) | |
20 | 5 |
ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f10.1e100.net
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
rs-sx.xyz
services.runescape.rs-sx.xyz |
752 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
17 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net |
7 KB |
1 |
googleapis.com
ajax.googleapis.com |
34 KB |
0 |
ip-api.com
Failed
ip-api.com Failed |
|
20 | 5 |
Domain | Requested by | |
---|---|---|
15 | services.runescape.rs-sx.xyz |
services.runescape.rs-sx.xyz
cdn.jsdelivr.net |
2 | cdnjs.cloudflare.com |
services.runescape.rs-sx.xyz
|
1 | cdn.jsdelivr.net |
services.runescape.rs-sx.xyz
|
1 | ajax.googleapis.com |
services.runescape.rs-sx.xyz
|
0 | ip-api.com Failed |
cdn.jsdelivr.net
|
20 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.runescape.com |
auth.jagex.com |
social.auth.jagex.com |
secure.runescape.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
services.runescape.rs-sx.xyz R3 |
2021-09-26 - 2021-12-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020 |
2021-04-30 - 2022-06-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://services.runescape.rs-sx.xyz/m=weblogin/loginform.ws320,254,607,50870339,4,7042
Frame ID: 21C8DA12522AC98D64D1AD29DA9245CD
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
RuneScape Log InDetected technologies
Django (Web Frameworks) ExpandDetected patterns
- (?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Can't Log In?
Search URL Search Domain Scan URL
Title: Log in with Google
Search URL Search Domain Scan URL
Title: Log in with Apple
Search URL Search Domain Scan URL
Title: Log in with Steam
Search URL Search Domain Scan URL
Title: Log in with Facebook
Search URL Search Domain Scan URL
Title: Create an account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
loginform.ws320,254,607,50870339,4,7042
services.runescape.rs-sx.xyz/m=weblogin/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor-151.css
services.runescape.rs-sx.xyz/static/runescape_login/css/dual/ |
113 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
site-151.css
services.runescape.rs-sx.xyz/static/runescape_login/css/dual/ |
384 KB 97 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oldschool.png
services.runescape.rs-sx.xyz/static/runescape_login/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runescape.png
services.runescape.rs-sx.xyz/static/runescape_login/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ |
94 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdn.jsdelivr.net/npm/axios/dist/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
platform.min.js
cdnjs.cloudflare.com/ajax/libs/platform/1.3.6/ |
14 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
services.runescape.rs-sx.xyz/static/runescape_login/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telemetry.js
services.runescape.rs-sx.xyz/static/runescape_login/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.cookie.min.js
services.runescape.rs-sx.xyz/static/runescape_login/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
ip-api.com/json/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
services.runescape.rs-sx.xyz/api/v1/add_current_visitor/ |
172 B 733 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tile.jpg
services.runescape.rs-sx.xyz/static/runescape_login/img/responsive/runescape/backgrounds/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dual.jpg
services.runescape.rs-sx.xyz/static/runescape_login/img/responsive/common/backgrounds/ |
539 KB 539 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google.svg
services.runescape.rs-sx.xyz/static/runescape_login/img/responsive/common/logos/ |
763 B 948 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apple-black.svg
services.runescape.rs-sx.xyz/static/runescape_login/img/responsive/common/logos/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.svg
services.runescape.rs-sx.xyz/static/runescape_login/img/responsive/common/logos/ |
429 B 888 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
59 KB 59 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome-webfont.woff2
services.runescape.rs-sx.xyz/static/runescape_login/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ip-api.com
- URL
- http://ip-api.com/json/?fields=status,message,continent,continentCode,country,countryCode,region,regionName,city,district,zip,lat,lon,timezone,offset,currency,isp,org,as,asname,reverse,mobile,proxy,hosting,query
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Runescape (Online) Generic (Online) Microsoft (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| axios object| platform function| Cookies1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
services.runescape.rs-sx.xyz/ | Name: csrftoken Value: ts4IL1mbsGCXTzKXzQmw321rZZoBo2Zi89iSNPXPwgQKku9fDbxTChBndEJTTUVI |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self'; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
ip-api.com
services.runescape.rs-sx.xyz
ip-api.com
104.16.18.94
151.101.1.229
172.217.18.106
31.210.21.148
0d5437ecf617def25148981d7d10c12a883a3b71e851503cd767f21ad8aeb515
1684783bb4b210e3a99134a7e89c5832d8df165b22e7622a17189420b5b2442d
1b89ca6caf8519eae363240a624f2139e5e5647adfe382b1c445734398d7f5fc
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
22557750f99896418f230d1d90cd2a86395226e2b7f7c0254d18ba96dd3abdeb
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
39b8fe6364621725ff90431a34af0f87976d95c00cbfd1d0f3711a3f1fa1a07b
422bdd85db9cc012786246c901ef3c27c94020e11706947083c583d3f1c615e0
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
4e38f516482b1af70acd074331f808e48534b329e7faacf5ba91cce05a38d6d9
6300dd738f3805e1c8dfd01bde16f4613334f991240dd30b7ab6833bb0b14a8b
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
876aa84b5c13c20f86a041db2b68a2d0bb456661cc7b3b1066f7cc3f3702c227
8c039b6e245af3041933a2e283eb929be6c05618616e34ef2b8e3ca2bb368007
a54733cc0c60f66bc978e5fdfe3faa61d7585e1baa13deab6ed86566e7bc92bf
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
c837f24e36d83de1fed233159e2ea0f0b0b9f016cbb8141d26dc89b704c2d3fd
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a