https://tr.ee/JJynVJ
151.101.130.133 · Fastly, Inc.
Montreal, Canada
—
200 · 20.3s
Valid· R12, Let's Encrypt, US
COMPLETED
Domain Intelligence: tr.ee
Scanned 2 times since Mar 9, 2026, 01:27 AM UTC
No KB/IOK detections were recorded for this scan.
technology | finance | ecommerce | gaming · 4/5/2026
The scan shows a redirect to osrsjagex.gamingvote.com with a page titled 'Just a moment...' and evidence of Cloudflare Turnstile integration. Visual cues in the screenshot suggest a branding overlay that does not match tr.ee, but the final URL and assets indicate a potential impersonation attempt or phishing flow targeting Runescape/League-of-something users. No explicit login form is observed in static HTML, but dynamic SPA behavior is suspected, and the presence of hidden inputs and off-domain endpoints supports credential capture risk.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 17
Hosts: 4
Domains: 4
The page appears to be hosting a credential collection flow under a domain that visually opposes the tr.ee branding (per the screenshot) and redirects to an external domain under gamingvote.com. The combination of SPA-style credential capture signals, off-domain endpoints, and Cloudflare challenge integration strongly suggests an attempt to harvest credentials or perform brand impersonation. The presence of hidden inputs and dynamic rendering further supports this risk. Recommend treating as high-risk phishing/adversarial impersonation activity and monitor for further abuse. If confirmed, suspend domain or block URL actions should be considered while contacting the registrar for investigation.
Block URL