https://osrsforums.com-assisted-login-login-challenge-dc197744c4a04124a6d04da6b85a.workers.dev/portal/m-forum-forums320-321-6265498749-321-6265498749-321-6265498749-321-6265498749-321-626549874-321/
172.67.192.36 · Cloudflare, Inc.
Toronto, Canada
2592 days
200 · 9.0s
Valid· E7, Let's Encrypt, US
COMPLETED
Domain Intelligence: workers.dev
Scanned 3 times since Mar 10, 2026, 03:40 AM UTC
Registered-domain escalation suggested
Suggested nowSubmit workers.dev as the primary IOC, enriched with evidence from hostile subdomains like osrsforums.com-assisted-login-login-challenge-dc197744c4a04124a6d04da6b85a.workers.dev.
2 hostile subdomains across 3 completed scans were observed under this registered domain. Recent hosts: osrsforums.com-assisted-login-login-challenge-dc197744c4a04124a6d04da6b85a.workers.dev, jagex-forums.com-uk.workers.dev.
runescape-forum-clone-kit
runescape-forum-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
gaming | technology | ecommerce · 4/5/2026
This site at account.osrforum.it impersonates RuneScape community/forum branding to lure users into posting or exposing credentials. The page title and UI resemble RuneScape forums, with Runescape header links and a RuneScape logo loaded from external storage, while the domain is not an official RuneScape domain. It hosts a login-style form gateway and multiple POST endpoints targeting a login challenge path, indicative of credential collection in a SPA-like environment.
Capture
Stages: 1
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 3
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 48
Hosts: 2
Domains: 1
Suspicious Endpoints
hxxps://osrsforums[.]com-assisted-login-login-challenge-dc197744c4a04124a6d04da6b85a[.]workers[.]dev/portal/assisted-login-login-challenge-dc197744c4a04124a6d04da6b85adcb4-238398720-1406457486-1694086910-1863512970-169408678563454200-2-238398720-140645748/
Scanner observed a domain impersonating a RuneScape community forum, with the page UI copying Runescape branding including the header, logo, and navigation. The page uses a newly issued SSL certificate and loads brand assets from external CDN domains, suggesting an attempt to impersonate a legitimate service and collect potentially sensitive input via POST endpoints. The presence of hidden form inputs and iframes indicates data exfiltration and credential harvesting risk. Immediate action recommended: suspend_domain and suspend_hosting to prevent further credential theft attempts; alert Runescape security team and monitor for similar clones.
Suspend Domain