mass.report
Scan Intelligence Report0/100
critical Risk
runescapesoldschool.gamingvote.com
https://runescapesoldschool.gamingvote.com/portal/m%3Dforum%26forums320321%266265498749321openidread%26state%3DD3uqAg4QCO%3D6265498749321%266265498749%3Dauthloginoauth2codejpp%266265498749%3D321%26674321/
IP
104.21.90.15 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
79 days
HTTP
200 · 21.4s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: gamingvote.com
Scanned 31 times since Mar 10, 2026, 11:26 AM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
RuneScape
Vendors
26/30
Status
partial
✓ google✓ sophos✓ eset✓ microsoft✓ brightcloud✓ drweb✓ isitphish✓ polyswarm✗ norton✓ bitdefender✓ mcafee✗ avg✓ yandex✗ avast✓ phishreport✓ kaspersky✓ apple✓ cisa✓ spamhaus✓ netcraft✓ urlquery✓ openphish✓ emsisoft✓ apwg✓ virustotal✓ urlabuse✓ phishtank✗ urlscan✓ threatyeti✓ fortiguard
Registered-domain escalation suggested
Suggested nowSubmit gamingvote.com as the primary IOC, enriched with evidence from hostile subdomains like runescapesoldschool.gamingvote.com.
4 hostile subdomains across 31 completed scans were observed under this registered domain. Recent hosts: oldschoolrunescape.gamingvote.com, oldschoolosrsrunescape.gamingvote.com, osrsrunescapeoldschool.gamingvote.com, runescapesoldschool.gamingvote.com.
KB/IOK Matches (1)May 28, 2026, 03:15 PM UTC
runescape-forum-clone-kit
runescape-forum-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
RuneScape
Credential Phishinggaming | technology | ecommerce · 6/3/2026
Summary
This site at account.osrforum.it impersonates RuneScape community/forum branding to lure users into posting or exposing credentials. The page title and UI resemble RuneScape forums, with Runescape header links and a RuneScape logo loaded from external storage, while the domain is not an official RuneScape domain. It hosts a login-style form gateway and multiple POST endpoints targeting a login challenge path, indicative of credential collection in a SPA-like environment.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://runescapesoldschool.gamingvote.com/cdn-cgi/rum?, https://runescapesoldschool.gamingvote.com/cdn-cgi/challenge-platform/h/b/jsd/oneshot/1eec422858ff/0.4865959932648789:1779981023:cWHuYsMEmXHzzNjC9YtkKmfLEcd9yl4uC3DDxYySFCo/a02e377ac97bc3f8.
▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, main.js, fonts-101.css, pagesmz-146.css, member_player_disc.png, chat(1).png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 3
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 51
Hosts: 3
Domains: 3
Suspicious Endpoints
hxxps://runescapesoldschool[.]gamingvote[.]com/portal/assisted-login-login-challenge-dc197744c4a04124a6d04da6b85adcb4-238398720-1406457486-1694086910-1863512970-169408678563454200-2-238398720/
Attack Techniques (5)
Typosquatted/brand-masquerading domain presenting RuneScape forum UICloned SPA-like forum interface loading Runescape assets from external CDNLogin/assisted-login POST endpoints designed to capture credentials (even if inputs appear hidden in HTML)External scripts and tracking beacons (cloudflare insights) to evade scanners while serving real victimsSSL cert newly issued (0 days) and WAF/CDN presence (Cloudflare) often used to mask hosting while phishing
Indicators of Compromise (8)
▸DOMAIN: account.osrforum.it (not Runescape's official domain)
▸Page title: Quitting! 30B Giveaway,Up Tp 600M For Each Player(LEVEL BASED). (impersonation lure)
▸HTML forms: POST to https://account.osrforum.it/portal/assisted-login-login-challenge-dc197744c4a04124a6d04da6b85adcb4-... (inputs: none)
▸IFRAME sourcing content from account.osrforum.it and external assets under usb.databesa.cloud
▸SSL certificate issued Mar 8 2026 with SANs including account.osrforum.it and osrforum.it
▸External script: https://static.cloudflareinsights.com/beacon.min.js
▸Network requests fetch branding assets (header_logo.png, various forum-themed PNGs) from usb.databesa.cloud indicating cloned UI
▸Suspicious POST: /cdn-cgi/rum (likely Cloudflare minifier or analytics; indicates WAF interactions)
Risk AssessmentUsed in abuse reports
Scanner observed a domain impersonating a RuneScape community forum, with the page UI copying Runescape branding including the header, logo, and navigation. The page uses a newly issued SSL certificate and loads brand assets from external CDN domains, suggesting an attempt to impersonate a legitimate service and collect potentially sensitive input via POST endpoints. The presence of hidden form inputs and iframes indicates data exfiltration and credential harvesting risk. Immediate action recommended: suspend_domain and suspend_hosting to prevent further credential theft attempts; alert Runescape security team and monitor for similar clones.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API