Scanner evidence shows a phishing clone hosting under account.osrforum.it with a page title and UI strongly mimicking Jagex. The domain does not belong to Jagex, while assets and logos are loaded from the same impersonating domain, including image and JS assets that mirror Jagex branding. The presence of a login form configured to post to a suspicious index.php and a honeypot field indicates credential harvesting behavior. The SSL certificate is newly issued for a domain attempting to impersonate a well-known brand, and the page uses a Cloudflare IP, suggesting hosting behind a WAF but not legitimate ownership. This is a high-risk credential-phishing setup intended to deceive users into entering credentials for Jagex on a non-official domain.