mass.report
Scan Intelligence Report0/100
critical Risk
account11521.osrsforum.it
https://account11521.osrsforum.it/
IP
104.21.69.183 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
—
HTTP
404 · 17.6s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: osrsforum.it
Scanned 3 times since Mar 9, 2026, 01:24 AM UTC
✗ Critical (100)
Registered-domain escalation suggested
Suggested nowSubmit osrsforum.it as the primary IOC, enriched with evidence from hostile subdomains like account11521.osrsforum.it.
2 hostile subdomains across 2 completed scans were observed under this registered domain. Recent hosts: account.osrsforum.it, jagexaccounts.osrsforum.it.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Unknown
Credential Phishingfinance | technology | ecommerce | cryptocurrency | other · 4/5/2026
Summary
The page at account11521.osrsforum.it visually attempts to impersonate a trusted brand, but the domain is not the brand’s official domain. The page is effectively empty in static HTML, returns a 404, and the SSL cert is recently issued for osrsforum.it, with the hostname matching the suspicious subdomain. The attached screenshot is the strongest indicator of impersonation, suggesting a cloned login/credential harvesting interface, though no form exists in the static HTML. The lack of visible branding in the HTML source combined with the misleading domain strongly indicates a phishing setup intended to surface credentials on user interaction.
Attack Techniques (5)
Typosquatting or subdomain impersonation (account11521.osrsforum.it) targeting an unrelated brand surfaceBrand impersonation via visual cloning in screenshot (likely login/credential capture UI)Empty static HTML with dynamic rendering expected (SPA) to load brand assets at runtimeSSL certificate issued recently for the impersonated domain (brand-new certs on phishing domains)Anonymous or obscured hosting via Cloudflare (CDN/WAF) masking origin server
Indicators of Compromise (7)
▸DOMAIN: account11521.osrsforum.it (distinct from any known legitimate brand domain)
▸SSL Subject: CN=osrsforum.it; SANs include account11521.osrsforum.it
▸HTTP 404 on base path; 200 from api.ipify.org (no brand assets loaded)
▸Page HTML contains no forms, no login fields, and zero external scripts/assets
▸Network requests show only baseline host check and IP reveal service; no brand asset URLs loaded
▸Screenshot indicates potential visual branding imitation (brand logos/text inferred from image)
▸WHOIS not available or privacy-protected; domain age unknown but cert issued Mar 9 2026
Risk AssessmentUsed in abuse reports
High risk of credential harvesting due to clear brand impersonation signals and user-facing phishing UI suggested by the attached screenshot. The domain does not belong to the legitimate brand’s domain space, yet the SSL certificate is freshly issued for the impersonated domain, and the page attempts to mimic a login experience despite no static HTML forms. This combination—domain impersonation, brand-aligned visual cues in the screenshot, and lack of legitimate asset loading—constitutes a deliberate phishing setup designed to deceive users into entering credentials. Immediate action should be taken to block or suspend the domain and investigate the hosting and registrant details for takedown and user protection.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API