https://tr.betboo-giris.live/
172.67.195.170 · Cloudflare, Inc.
Toronto, Canada
0 days ⚠
200 · 31.9s
Valid· WE1, Google Trust Services, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
BETBOO / elitbahis
Vendors
29/31
Status
partial
Registered-domain escalation
Submit venusmedya.net as the primary IOC, enriched with evidence from hostile subdomains like tr.betboo-giris.live.
No KB/IOK detections were recorded for this scan.
gambling | technology | finance · 4/29/2026
The page presents Betboo/Elitbahis branding with a deceptive URL path, a rapid redirect to an off-domain host, and a SPA-like structure that may render credential fields via JavaScript. Static HTML contains zero login fields, but the SPA could capture credentials dynamically. The final URL and assets indicate off-brand hosting and potential credential collection infrastructure. This constitutes strong impersonation signals (brand look-alike) with potential credential capture, though direct form submission is not observable in static HTML.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 15
Hosts: 7
Domains: 7
The domain tr.betboo-giris.live is extremely new and appears to be part of an impersonation attempt of a Betboo/Elitbahis branding. The final redirected destination venusmedya.net serves betboo.html content under a different host, with SPA-style rendering that could capture credentials without visible forms in static HTML. The POST to venusmedya.net/cdn-cgi/rum? and the presence of external advertising banners suggest data exfiltration or user tracking. While there is no explicit static login form observed, the combination of branding, rapid redirects, and dynamic credential-capable UI strongly indicate credential harvesting potential via impersonation. Recommend urgent monitoring and containment actions until brand-accurate attribution is confirmed.
Suspend Domain