www.runescapesbonds-claims.com Open in urlscan Pro
198.54.116.189 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html
Effective URL:
https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html
Submission: On October 11 via api (October 11th 2020, 2:55:46 am UTC) from QA

Summary HTTP 13 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 198.54.116.189, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is www.runescapesbonds-claims.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 15th 2020. Valid for: a year.

This is the only time www.runescapesbonds-claims.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer) Runescape (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 11	198.54.116.189 198.54.116.189	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	91.235.140.148 91.235.140.148	44521 (JAGEX-AS) (JAGEX-AS)
13	3

11 198.54.116.189 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server120-5.web-hosting.com

www.runescapesbonds-claims.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.235.140.148 (United Kingdom)

ASN44521 (JAGEX-AS, GB)
PTR: nginx.web.any.jagex.com

www.runescape.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	runescapesbonds-claims.com 1 redirects www.runescapesbonds-claims.com	198 KB
3	runescape.com www.runescape.com	105 KB
13	2

	Domain	Requested by
11	www.runescapesbonds-claims.com	1 redirects www.runescapesbonds-claims.com
3	www.runescape.com	www.runescapesbonds-claims.com www.runescape.com
13	2

This site contains links to these domains. Also see Links.

Domain
www.runescape.com
runescape.com

Subject Issuer	Validity	Valid
runescapesbonds-claims.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-15` - `2021-09-15`	a year	crt.sh
www.runescape.com DigiCert SHA2 High Assurance Server CA	`2020-08-26` - `2022-09-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html
Frame ID: FB5ED0F4DF4DE820BAEF575E4021064D
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html HTTP 301
https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

387 kB
Transfer

850 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://www.runescape.com/community
Title:

Search URL Search Domain Scan URL

URL: https://runescape.com/game
Title: I have not set a PIN

Search URL Search Domain Scan URL

URL: http://runescape.com/game
Title: Exit

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html HTTP 301
https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request verification.ws821,321,584,42184523,159092.html Show response www.runescapesbonds-claims.com/m=weblogin/ Redirect Chain http://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html	21 KB 4 KB	470ms 157ms	Document text/html	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `3a89279ec19c6a8bc3ccf185c4660756ab9b69d71a9558a8b8513af17fe2c52e` Request headers :method GET :authority www.runescapesbonds-claims.com :scheme https :path /m=weblogin/verification.ws821,321,584,42184523,159092.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 11 Oct 2020 02:55:29 GMT server Apache last-modified Fri, 11 Sep 2020 21:32:02 GMT accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 3874 content-type text/html Redirect headers date Sun, 11 Oct 2020 02:55:29 GMT server Apache location https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html content-length 305 content-type text/html; charset=iso-8859-1
GET H2	200	fonts-1.css www.runescapesbonds-claims.com/m=weblogin/data3/	24 KB 18 KB	304ms 302ms	Stylesheet text/css	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/fonts-1.css Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `37d05fdff312ec2646504aad81a7660ad6bb212374ae39195f2c12cefd595a08` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 11 Oct 2020 02:55:29 GMT content-encoding gzip last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 18060
GET H/1.1	200 OK	vendor-119.css www.runescape.com/css/c/responsive/dual/	111 KB 15 KB	380ms 332ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/vendor-119.css Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `9594cc4499ad0e99ff45c70a1baf976f89cc5657ca441fb9f0b58ff9a23cd5c7` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 02:55:30 GMT Content-Encoding gzip Last-modified Sun, 04-Oct-2020 02:55:30 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 15287 Expires Sun, 11 Oct 2020 03:10:30 GMT
GET H/1.1	200 OK	site-119.css www.runescape.com/css/c/responsive/dual/	309 KB 88 KB	387ms 338ms	Stylesheet text/css	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Full URL https://www.runescape.com/css/c/responsive/dual/site-119.css Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `5458abc158c1e4a6581fb6b2c238234eb5fb1320e86f8be12354e5c55baa1bda` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 02:55:30 GMT Content-Encoding gzip Last-modified Sun, 04-Oct-2020 02:55:30 GMT Server nginx X-Cache-Status BYPASS Content-Type text/css; charset=ISO-8859-1 Cache-control max-age=900, public Connection keep-alive Content-Length 89676 Expires Sun, 11 Oct 2020 03:10:30 GMT
GET H2	200	modules-4.css www.runescapesbonds-claims.com/m=weblogin/data3/	56 KB 6 KB	443ms 442ms	Stylesheet text/css	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/modules-4.css Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `85ee33ac41afb0017130545ffa199741d36099571ed63041add9cd780d62abc8` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 11 Oct 2020 02:55:29 GMT content-encoding gzip last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 5987
GET H2	200	analytics.js Show response www.runescapesbonds-claims.com/m=weblogin/data3/	27 KB 11 KB	161ms 160ms	Script application/javascript	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/analytics.js Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `e7459b80a74d6c5de3de81e8ab0a8276d9f61404dadb68122a24206bb9b41f65` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 11 Oct 2020 02:55:30 GMT content-encoding gzip last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes content-length 11497
GET H2	200	jquery.min.js Show response www.runescapesbonds-claims.com/m=weblogin/data3/	91 KB 32 KB	444ms 443ms	Script application/javascript	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/jquery.min.js Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 11 Oct 2020 02:55:29 GMT content-encoding gzip last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes content-length 32798
GET H2	200	rs-logo.png www.runescapesbonds-claims.com/m=weblogin/data3/	4 KB 5 KB	158ms 157ms	Image image/png	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/rs-logo.png Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `31cda2f0cb23f89e6db2c7bd925022d01f0506e8a3298a36be3850752a7299ce` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 11 Oct 2020 02:55:30 GMT last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache accept-ranges bytes content-length 4486 content-type image/png
GET H2	200	padlock.png www.runescapesbonds-claims.com/m=weblogin/data3/	6 KB 6 KB	161ms 159ms	Image image/png	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/padlock.png Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `765b0b9c33a847c925ad7cde98b3176d0a12d26d08b246ed47f3664212c1f943` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 11 Oct 2020 02:55:30 GMT last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache accept-ranges bytes content-length 6417 content-type image/png
GET H2	200	logger.png www.runescapesbonds-claims.com/m=weblogin/data3/	111 KB 111 KB	263ms 262ms	Image image/png	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescapesbonds-claims.com/m=weblogin/data3/logger.png Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `48ddf4f7b59568b8de6189e1778b63086a7e0281c40f29a7a461e50793b060ed` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 11 Oct 2020 02:55:30 GMT last-modified Fri, 11 Sep 2020 21:32:08 GMT server Apache accept-ranges bytes content-length 113645 content-type image/png
GET H/1.1	200 OK	tile.jpg www.runescape.com/img/responsive/runescape/backgrounds/	2 KB 2 KB	164ms 164ms	Image image/jpeg	91.235.140.148 JAGEX-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescape.com/img/responsive/runescape/backgrounds/tile.jpg Requested by Host: www.runescape.com URL: https://www.runescape.com/css/c/responsive/dual/site-119.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 91.235.140.148 , United Kingdom, ASN44521 (JAGEX-AS, GB), Reverse DNS nginx.web.any.jagex.com Software nginx / Resource Hash `e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89` Request headers Referer https://www.runescape.com/css/c/responsive/dual/site-119.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 02:55:30 GMT Last-modified Sun, 04-Oct-2020 02:55:30 GMT Server nginx X-Cache-Status BYPASS Content-Type image/jpeg Cache-control max-age=900, public Connection keep-alive Content-Length 1929 Expires Sun, 11 Oct 2020 03:10:30 GMT
GET H2	404	vista.jpg www.runescapesbonds-claims.com/assets/	315 B 315 B	579ms 578ms	Image text/html	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.runescapesbonds-claims.com/assets/vista.jpg Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/data3/modules-4.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/data3/modules-4.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Sun, 11 Oct 2020 02:55:30 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated /	25 KB 25 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646` Request headers Origin https://www.runescapesbonds-claims.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	59 KB 59 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d` Request headers Origin https://www.runescapesbonds-claims.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/x-font-woff
GET H2	206	bankpin.mp3 www.runescapesbonds-claims.com/m=weblogin/	4 KB 4 KB	551ms 551ms	Media audio/mpeg	198.54.116.189 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.runescapesbonds-claims.com/m=weblogin/bankpin.mp3 Requested by Host: www.runescapesbonds-claims.com URL: https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.189 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server120-5.web-hosting.com Software Apache / Resource Hash `45df6e6092c2a70240c663b88ba17deed7e475444c14519684a65e391522b572` Request headers Referer https://www.runescapesbonds-claims.com/m=weblogin/verification.ws821,321,584,42184523,159092.html Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Range bytes=0- Response headers date Sun, 11 Oct 2020 02:55:30 GMT last-modified Fri, 11 Sep 2020 21:32:02 GMT server Apache status 206 content-type audio/mpeg Content-Range bytes 0-3761/3762 accept-ranges bytes Content-Length 3762

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer) Runescape (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.runescape.com
www.runescapesbonds-claims.com
198.54.116.189
91.235.140.148
31cda2f0cb23f89e6db2c7bd925022d01f0506e8a3298a36be3850752a7299ce
37d05fdff312ec2646504aad81a7660ad6bb212374ae39195f2c12cefd595a08
3a89279ec19c6a8bc3ccf185c4660756ab9b69d71a9558a8b8513af17fe2c52e
45df6e6092c2a70240c663b88ba17deed7e475444c14519684a65e391522b572
480f0c53edc1e4dfa14bc1479b8a298ecb4f4c5a92ba2917a3612eb8b242d13d
48ddf4f7b59568b8de6189e1778b63086a7e0281c40f29a7a461e50793b060ed
5458abc158c1e4a6581fb6b2c238234eb5fb1320e86f8be12354e5c55baa1bda
6865695148fa8984d5d3d639003a358bf01f2b89934b861d35d72fad4f341646
765b0b9c33a847c925ad7cde98b3176d0a12d26d08b246ed47f3664212c1f943
85ee33ac41afb0017130545ffa199741d36099571ed63041add9cd780d62abc8
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
9594cc4499ad0e99ff45c70a1baf976f89cc5657ca441fb9f0b58ff9a23cd5c7
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e48e93362cdac23391f9bb460098291904bcc73fb4f57446e22701860a07ed89
e7459b80a74d6c5de3de81e8ab0a8276d9f61404dadb68122a24206bb9b41f65

www.runescapesbonds-claims.com Open in urlscan Pro 198.54.116.189 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

387 kBTransfer

850 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

www.runescapesbonds-claims.com Open in urlscan Pro
198.54.116.189 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

387 kB
Transfer

850 kB
Size

0
Cookies

13 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!