secure.oldschool.com-ea.cz Open in urlscan Pro
185.82.212.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shorturl.at/qHLPX
Effective URL:
https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php
Submission: On March 28 via automatic, source openphish (March 28th 2023, 2:13:40 am UTC) — Scanned from NL

Summary HTTP 18 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 5 IPs in 5 countries across 5 domains to perform 18 HTTP transactions. The main IP is 185.82.212.80, located in Czech Republic and belongs to GRANSY Gransy s.r.o. gransy.com, CZ. The main domain is secure.oldschool.com-ea.cz.
TLS certificate: Issued by R3 on March 3rd 2023. Valid for: 3 months.

This is the only time secure.oldschool.com-ea.cz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Runescape (Online) Generic (Online) Microsoft (Consumer) Jagex (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	185.82.212.80 185.82.212.80	60592 (GRANSY Gr...) (GRANSY Gransy s.r.o. gransy.com)
13	91.235.140.148 91.235.140.148	44521 (JAGEX-AS) (JAGEX-AS)
1	162.19.58.160 162.19.58.160	16276 (OVH) (OVH)
1	93.158.238.139 93.158.238.139	60503 (FNXTEC) (FNXTEC)
18	5

2 2a06:98c1:3120::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

shorturl.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.shorturl.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.82.212.80 (Czech Republic)

ASN60592 (GRANSY Gransy s.r.o. gransy.com, CZ)
PTR: 80.ry.cz

secure.oldschool.com-ea.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 91.235.140.148 (United Kingdom)

ASN44521 (JAGEX-AS, GB)
PTR: nginx.web.any.jagex.com

www.runescape.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.58.160 (France)

ASN16276 (OVH, FR)
PTR: ns3096649.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 93.158.238.139 (Amsterdam, Netherlands)

ASN60503 (FNXTEC, BR)
PTR: protected.hyperfilter.com

secure.oldschool.com-or.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	runescape.com www.runescape.com — Cisco Umbrella Rank: 238901	412 KB
3	com-ea.cz secure.oldschool.com-ea.cz	4 KB
2	shorturl.at 2 redirects shorturl.at — Cisco Umbrella Rank: 138217 www.shorturl.at — Cisco Umbrella Rank: 162819	964 B
1	com-or.cz secure.oldschool.com-or.cz	416 KB
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 12794	7 KB
18	5

	Domain	Requested by
13	www.runescape.com	secure.oldschool.com-ea.cz www.runescape.com
3	secure.oldschool.com-ea.cz	secure.oldschool.com-ea.cz
1	secure.oldschool.com-or.cz	secure.oldschool.com-ea.cz
1	i.ibb.co	secure.oldschool.com-ea.cz
1	www.shorturl.at	1 redirects
1	shorturl.at	1 redirects
18	6

This site contains links to these domains. Also see Links.

Domain
secure.runescape.com
auth.jagex.com

Subject Issuer	Validity	Valid
secure.oldschool.com-ea.cz R3	`2023-03-03` - `2023-06-01`	3 months	crt.sh
www.runescape.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-05` - `2023-09-19`	a year	crt.sh
ibb.co R3	`2023-02-06` - `2023-05-07`	3 months	crt.sh
com-or.cz R3	`2023-03-22` - `2023-06-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php
Frame ID: 503442041D85C3682821D499A1DFCC47
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://shorturl.at/qHLPX HTTP 301
https://www.shorturl.at/qHLPX HTTP 302
https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

18
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

5
IPs

5
Countries

923 kB
Transfer

2154 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://secure.runescape.com/m=weblogin/cant_log_in
Title: Can't Log In?

Search URL Search Domain Scan URL

URL: https://auth.jagex.com/google/v1/social/login/en?correlationId=https%3Awww%3Aaccount_settings
Title: Log in with Google

Search URL Search Domain Scan URL

URL: https://auth.jagex.com/apple/v1/social/login/en?correlationId=https%3Awww%3Aaccount_settings
Title: Log in with Apple

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=sn-integration/facebook/gamelogin.ws?mod=www&ssl=1&dest=account_settings
Title: Log in with Facebook

Search URL Search Domain Scan URL

URL: https://secure.runescape.com/m=account-creation/create_account
Title: Create an account

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shorturl.at/qHLPX HTTP 301
https://www.shorturl.at/qHLPX HTTP 302
https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request loginform444900095958539495484780.php Show response secure.oldschool.com-ea.cz/m.weblogins-/ Redirect Chain https://shorturl.at/qHLPX https://www.shorturl.at/qHLPX https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php	26 KB 4 KB	649ms 44ms	Document text/html	185.82.212.80 GRANSY Gransy s.r...
General Check archive.org Show headers Download Go to Full URL https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.82.212.80 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. gransy.com, CZ), Reverse DNS 80.ry.cz Software openresty/1.21.4.1 / PHP/7.2.34 Resource Hash `369a41408c5ae0d9113047d263fe0b7a18312a8f7c7c729e0863aab512121a7f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-length 3879 content-type text/html; charset=UTF-8 date Tue, 28 Mar 2023 02:13:34 GMT server openresty/1.21.4.1 vary Accept-Encoding x-powered-by PHP/7.2.34 Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7aec5ac14cfbb74e-AMS content-type text/html; charset=UTF-8 date Tue, 28 Mar 2023 02:13:33 GMT location https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EuQalBN4v0T5PHmC%2FGKDWbcSqQZBpbveKD4I8ePMm9Ncqi71YwTeXS86m2Er3apdK1tnG3utFWhCTuflvc3s1rXfrF%2FQ4eIur6P8FH6JR5Bx9NHeWM4gS6tvQQNp39rDurrERUy7rXB7zFjnig0%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-content-type-options nosniff x-frame-options SAMEORIGIN x-nginx-upstream-cache-status MISS x-server-powered-by Engintron x-xss-protection 1; mode=block
GET H2	404	Criciousand-meth-shake-Exit-be-till-in-ches-Shad secure.oldschool.com-ea.cz/	0 0	40ms 39ms	Script text/html	185.82.212.80 GRANSY Gransy s.r...
General Check archive.org Show headers Download Go to Full URL https://secure.oldschool.com-ea.cz/Criciousand-meth-shake-Exit-be-till-in-ches-Shad Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.82.212.80 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. gransy.com, CZ), Reverse DNS 80.ry.cz Software openresty/1.21.4.1 / Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Tue, 28 Mar 2023 02:13:34 GMT server openresty/1.21.4.1 content-length 289 content-type text/html; charset=iso-8859-1
GET H/1.1	200 OK	vendor-151.css www.runescape.com/css/c/responsive/dual/	108 KB 15 KB	143ms 38ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/vendor-151.css Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `3687b09c4994ffee6d6cc814f6096ff9bcf660d76f05f5e3a8240fa7ce7ae0bf` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 15009 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	site-151.css www.runescape.com/css/c/responsive/dual/	395 KB 98 KB	144ms 39ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/site-151.css Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `32b54e148f3c01cc9af9e6d89d0c81471e61e74e0f60f910cc4d202c2a08e583` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 99988 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	oldschool.png www.runescape.com/img/responsive/common/logos/	7 KB 7 KB	20ms 20ms	Image image/png	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/oldschool.png Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `1b89ca6caf8519eae363240a624f2139e5e5647adfe382b1c445734398d7f5fc` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Last-modified Tue, 21-Mar-2023 02:08:14 GMT Server nginx Content-Type image/png Cache-control max-age=900, public Connection keep-alive Content-Length 7206 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	runescape.png www.runescape.com/img/responsive/common/logos/	3 KB 4 KB	21ms 20ms	Image image/png	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/runescape.png Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Last-modified Tue, 21-Mar-2023 01:59:14 GMT Server nginx Content-Type image/png Cache-control max-age=900, public Connection keep-alive Content-Length 3375 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	vendor-153.js Show response www.runescape.com/js/c/responsive/	473 KB 145 KB	126ms 40ms	Script text/javascript	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/js/c/responsive/vendor-153.js Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `d56064584d48865df9b8ede96f5c7624013144e66e74712c810b7a1397dfafeb` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/javascript; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 147789 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	theme-dual-153.js Show response www.runescape.com/js/c/responsive/	67 KB 13 KB	123ms 37ms	Script text/javascript	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/js/c/responsive/theme-dual-153.js Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `650a5424045f9ac8c2c558efa9aef2587d9a82660b0122cc11c1f34f8678e827` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/javascript; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 12542 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	vendor-151.css www.runescape.com/css/c/responsive/runescape/	108 KB 15 KB	127ms 41ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/runescape/vendor-151.css Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `3687b09c4994ffee6d6cc814f6096ff9bcf660d76f05f5e3a8240fa7ce7ae0bf` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 15009 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	site-151.css www.runescape.com/css/c/responsive/runescape/	384 KB 98 KB	125ms 40ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/runescape/site-151.css Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `e3f9b982ee9b9db41cf9f814193de18e0e135bb4a38f7d3cd9b43fee1b658bfe` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 99564 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	theme-runescape-153.js Show response www.runescape.com/js/c/responsive/	70 KB 13 KB	20ms 19ms	Script text/javascript	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/js/c/responsive/theme-runescape-153.js Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `7e89e724524fee20fc04f966afcbc6c57e717fcf2b61fe32f395c85504871373` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type text/javascript; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 13337 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H2	200	padlock.png i.ibb.co/kSJPbWR/	6 KB 7 KB	78ms 19ms	Image image/png	162.19.58.160 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/kSJPbWR/padlock.png Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.160 , France, ASN16276 (OVH, FR), Reverse DNS ns3096649.ip-162-19-58.eu Software nginx / Resource Hash `765b0b9c33a847c925ad7cde98b3176d0a12d26d08b246ed47f3664212c1f943` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Tue, 28 Mar 2023 02:13:34 GMT last-modified Sat, 18 Sep 2021 21:36:29 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 6417 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	tile.jpg www.runescape.com/img/responsive/runescape/backgrounds/	2 KB 2 KB	20ms 19ms	Image image/jpeg	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/runescape/backgrounds/tile.jpg Requested by Host: www.runescape.com URL: https://www.runescape.com/css/c/responsive/dual/site-151.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89` Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.runescape.com/css/c/responsive/dual/site-151.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Last-modified Tue, 21-Mar-2023 02:01:30 GMT Server nginx Content-Type image/jpeg Cache-control max-age=900, public Connection keep-alive Content-Length 1929 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET DATA	200 OK	truncated /	25 KB 25 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646` Request headers Referer Origin https://secure.oldschool.com-ea.cz accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type application/x-font-woff
GET H/1.1	200 OK	dual.jpg secure.oldschool.com-or.cz/assets/img/backgrounds/	416 KB 416 KB	620ms 27ms	Image image/jpeg	93.158.238.139 FNXTEC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.oldschool.com-or.cz/assets/img/backgrounds/dual.jpg Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.158.238.139 Amsterdam, Netherlands, ASN60503 (FNXTEC, BR), Reverse DNS protected.hyperfilter.com Software nginx / Resource Hash `cfe6f52eb498236d9ebed24c24ef8d06ac79f601834dd227c28eedd56bf49a9d` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 01:13:37 GMT Last-Modified Mon, 13 Feb 2023 23:15:20 GMT Server nginx ETag "63eac488-68082" Content-Type image/jpeg Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 426114 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	google.svg www.runescape.com/img/responsive/common/logos/	763 B 1 KB	20ms 19ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/google.svg Requested by Host: www.runescape.com URL: https://www.runescape.com/css/c/responsive/dual/site-151.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a` Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.runescape.com/css/c/responsive/dual/site-151.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 763 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	apple-black.svg www.runescape.com/img/responsive/common/logos/	2 KB 1 KB	21ms 20ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/apple-black.svg Requested by Host: www.runescape.com URL: https://www.runescape.com/css/c/responsive/dual/site-151.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `22557750f99896418f230d1d90cd2a86395226e2b7f7c0254d18ba96dd3abdeb` Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.runescape.com/css/c/responsive/dual/site-151.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Content-Encoding gzip Last-modified Tue, 21-Mar-2023 02:11:50 GMT Server nginx Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 911 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET H/1.1	200 OK	fb.svg www.runescape.com/img/responsive/common/logos/	429 B 711 B	20ms 19ms	Image image/svg+xml	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/common/logos/fb.svg Requested by Host: www.runescape.com URL: https://www.runescape.com/css/c/responsive/dual/site-151.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb` Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.runescape.com/css/c/responsive/dual/site-151.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Tue, 28 Mar 2023 02:13:34 GMT Last-modified Tue, 21-Mar-2023 01:58:50 GMT Server nginx Content-Type image/svg+xml Cache-control max-age=900, public Connection keep-alive Content-Length 429 Expires Tue, 28 Mar 2023 02:28:34 GMT
GET DATA	200 OK	truncated /	59 KB 59 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d` Request headers Referer Origin https://secure.oldschool.com-ea.cz accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type application/x-font-woff
GET H2	404	Criciousand-meth-shake-Exit-be-till-in-ches-Shad secure.oldschool.com-ea.cz/	0 0	42ms 41ms	Script text/html	185.82.212.80 GRANSY Gransy s.r...
General Check archive.org Show headers Download Go to Full URL https://secure.oldschool.com-ea.cz/Criciousand-meth-shake-Exit-be-till-in-ches-Shad Requested by Host: secure.oldschool.com-ea.cz URL: https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.82.212.80 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. gransy.com, CZ), Reverse DNS 80.ry.cz Software openresty/1.21.4.1 / Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure.oldschool.com-ea.cz/m.weblogins-/loginform444900095958539495484780.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Tue, 28 Mar 2023 02:13:34 GMT server openresty/1.21.4.1 content-length 289 content-type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Runescape (Online) Generic (Online) Microsoft (Consumer) Jagex (Gaming)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://secure.oldschool.com-ea.cz/Criciousand-meth-shake-Exit-be-till-in-ches-Shad Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://secure.oldschool.com-ea.cz/Criciousand-meth-shake-Exit-be-till-in-ches-Shad Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.ibb.co
secure.oldschool.com-ea.cz
secure.oldschool.com-or.cz
shorturl.at
www.runescape.com
www.shorturl.at
162.19.58.160
185.82.212.80
2a06:98c1:3120::3
91.235.140.148
93.158.238.139
1b89ca6caf8519eae363240a624f2139e5e5647adfe382b1c445734398d7f5fc
20c865ce77047a5c5803795945e97ee228b3a86bc72c6ac1779c96681e4ebac3
22557750f99896418f230d1d90cd2a86395226e2b7f7c0254d18ba96dd3abdeb
32b54e148f3c01cc9af9e6d89d0c81471e61e74e0f60f910cc4d202c2a08e583
3687b09c4994ffee6d6cc814f6096ff9bcf660d76f05f5e3a8240fa7ce7ae0bf
369a41408c5ae0d9113047d263fe0b7a18312a8f7c7c729e0863aab512121a7f
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
4a32072c69079ffc44b4947317ec7144a1aef8a25a5ec9a0deaecd8196c1aadb
650a5424045f9ac8c2c558efa9aef2587d9a82660b0122cc11c1f34f8678e827
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
765b0b9c33a847c925ad7cde98b3176d0a12d26d08b246ed47f3664212c1f943
7e89e724524fee20fc04f966afcbc6c57e717fcf2b61fe32f395c85504871373
cfe6f52eb498236d9ebed24c24ef8d06ac79f601834dd227c28eedd56bf49a9d
d56064584d48865df9b8ede96f5c7624013144e66e74712c810b7a1397dfafeb
e3f9b982ee9b9db41cf9f814193de18e0e135bb4a38f7d3cd9b43fee1b658bfe
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
f5b87209caa2e310f5d31890ce945dd194e12ada9839d8d5571ac994e477335a

secure.oldschool.com-ea.cz Open in urlscan Pro 185.82.212.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

20 %IPv6

5 Domains

6 Subdomains

5 IPs

5 Countries

923 kBTransfer

2154 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

secure.oldschool.com-ea.cz Open in urlscan Pro
185.82.212.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

5
IPs

5
Countries

923 kB
Transfer

2154 kB
Size

0
Cookies

18 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!