mass.report
Scan Intelligence Report0/100
medium Risk
temporary-maintenance143.site
https://temporary-maintenance143.site/superbahis.html
IP
104.21.6.88 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
1 day ⚠
HTTP
403 · 22.0s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
ATO
Vendors
29/31
Status
partial
✓ avast✓ avg✓ chainpatrol✓ brightcloud✗ drweb✓ bitdefender✗ norton✓ microsoft✓ sophos✓ polyswarm✓ apple✓ yandex✓ spamhaus✓ openphish✓ isitphish✓ apwg✓ mcafee✓ urlquery✓ cisa✓ eset✓ urlscan✓ emsisoft✓ netcraft✓ phishreport✓ phishtank✓ virustotal✓ urlabuse✓ google✓ kaspersky✓ threatyeti✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
ATO
Unknownfinance | technology | ecommerce | cryptocurrency | other · 6/3/2026
Summary
The scan target resolves to a newly registered domain (1 day old) using a Cloudflare block page rather than content from a known brand. The page presents a Cloudflare 403/Attention Required block and does not display any recognizable branding or credential collection UI in static HTML. Network evidence shows a POST to a Cloudflare rum endpoint and a subsequent IP discovery request, but the actual phishing content could not be loaded due to the WAF, which indicates anti-scraping behavior. Nonetheless, domain-intelligence signals and the blocking page strongly suggest the operator is attempting to evade scans, with potential for later hosting of phishing content on the same domain.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://temporary-maintenance143.site/cdn-cgi/rum?.
▸Distinctive asset clues: v8c78df7c7c0f484497ecbca7046644da1771523124516, cf.errors.css, browser-bar.png, cf-no-screenshot-error.png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 7
Hosts: 2
Domains: 2
Attack Techniques (0)
Indicators of Compromise (0)
No specific IOCs identified in source
Risk AssessmentUsed in abuse reports
The domain is extremely young and behind Cloudflare, and the scan was blocked by a WAF, with the block page indicating defensive controls. While the actual phishing content could not be retrieved, the combination of a new domain, potential dynamic credential collection (SPA risk), and explicit anti-scanner evasion signals strongly suggests malicious intent and the possibility of hosting phishing content in the near term. Recommend monitoring and further investigation; consider taking preventive actions if corroborated by additional content showing impersonation or credential harvesting attempts.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API