mass.report
Scan Intelligence Report0/100
low Risk
playtoro-dk.com
https://playtoro-dk.com
IP
172.67.141.164 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
78 days
HTTP
200 · 19.3s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
ATO
Unknowntechnology | ecommerce | finance | gambling · 4/5/2026
Summary
The page presents ATO branding and branding elements, but the domain playtoro-dk.com is not the official PlayToro domain. Visual elements (logo, header, and game thumbnails) align with PlayToro branding, and the page appears to be a generic casino site with SPA-like behavior and dynamic credential capture risk. The presence of a visible login/registration UI in the header and the SPA behavior suggest potential credential harvesting risk, but there is no definitive evidence of a phishing form in the static HTML; dynamic rendering could still capture credentials. The site is newly registered (78 days) with a recent SSL cert and Cloudflare hosting, which can accompany cloaking or evasion signals mentioned by the analyst. Analyst flagged likely cloaking/evasion behavior for this target. Analyst context noted: Analyst note: this target may cloak content or block scanners.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://playtoro-dk.com/cdn-cgi/rum?.
▸Distinctive asset clues: email-decode.min.js, v8c78df7c7c0f484497ecbca7046644da1771523124516, style.css, playtoro-dk.com_139ZXGlj0Db2y-KYvpAlAUXdcG46rjtfu.png, piggy-riches-2-megaways.jpg.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 81
Hosts: 2
Domains: 2
Attack Techniques (3)
Analyst-flagged cloaking/evasion behaviorBrand impersonation indicators (playtoro branding on a non-official domain)SPA/JS-driven credential capture risk (static HTML contains no forms; forms may be rendered client-side)
Indicators of Compromise (2)
▸POST request to /cdn-cgi/rum? observed (Cloudflare related) but not clearly tied to credential submission
▸Visible login and registration buttons in header (LOG IND, REGISTRERER) which could host credential capture UI via JS
Risk AssessmentUsed in abuse reports
The site presents strong indicators of potential impersonation risk: PlayToro branding on a domain not owned by the official service, combined with SPA rendering that could host credential collection without visible static forms. The presence of login/registration UI and cloaking indicators (analyst note of cloaking) necessitates monitoring and potential takedown actions if further evidence shows credential harvesting or impersonation. The SSL cert is fresh, and the domain is short-lived (78 days), increasing phishing risk signals. Recommend heightened monitoring and potential domain suspension if abuse is confirmed. Analyst-reported cloaking/evasion suspicion increases confidence that the operator is actively attempting to evade automated security analysis. Analyst context was provided and corroborated during this assessment (Analyst note: this target may cloak content or block scanners.).
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API