mass.report
Scan Intelligence Report0/100
medium Risk
m.superbahisgunceli.icu
https://m.superbahisgunceli.icu/
IP
104.21.72.135 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
1 day ⚠
HTTP
200 · 22.0s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Unknown
Vendors
30/31
Status
partial
✓ bitdefender✓ brightcloud✓ avg✗ norton✓ polyswarm✓ sophos✓ eset✓ chainpatrol✓ microsoft✓ yandex✓ apple✓ cisa✓ openphish✓ emsisoft✓ urlquery✓ phishtank✓ netcraft✓ urlscan✓ spamhaus✓ apwg✓ isitphish✓ phishreport✓ virustotal✓ avast✓ urlabuse✓ drweb✓ threatyeti✓ fortiguard✓ google✓ mcafee✓ kaspersky
Registered-domain escalation
Submit superbahisgunceli.icu as the primary IOC, enriched with evidence from hostile subdomains like m.superbahisgunceli.icu.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Unknown
Unknownfinance | technology | ecommerce | government | social_media | cryptocurrency | telecommunications | education | other · 7/19/2026
Summary
The page on m.superbahisgunceli.icu displays Turkish text stating illegal betting is a crime, with a dark modal UI that imitates a warning banner. The URL path and page title do not clearly map to a first-party brand, and the domain is a very new .icu with Cloudflare underpinnings. The SPA-like structure and the presence of a POST to a rum endpoint suggest potential credential collection or abuse, but there is no explicit brand impersonation or credential form visible in static HTML; the page appears to be an impersonation-like warning rather than a clearly branded phishing login for a known service at this time.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://m.superbahisgunceli.icu/cdn-cgi/rum?.
▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, css2.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 9
Hosts: 4
Domains: 4
Attack Techniques (3)
SPA-like page rendering with dynamic credential capture risk (static HTML shows no forms; forms may be rendered by JavaScript)Impersonation-like warning modal using bold Turkish branding cues and a high-contrast design to induce urgencyExternal script loading from Cloudflare Insights beacon and a suspicious CDN/rum endpoint POST
Indicators of Compromise (2)
▸TLD .icu (suspicious for phishing/rapidly changing domains)
▸POST request to https://m.superbahisgunceli.icu/cdn-cgi/rum? (204) indicating possible beacon/telemetry or data exfiltration channel
Risk AssessmentUsed in abuse reports
The site is operating on a newly created domain with a Turkish-language anti-betting warning UI that visually imitates a warning panel. The presence of a POST beacon endpoint and dynamic rendering hints at possible data capture flows, but there is no explicit credential form in the static HTML. The combination of a new domain, .icu TLD, and a suspiciously styled impersonation-like interface constitutes a moderate risk signal for abuse or credential collection. Monitor and investigate further for actual credential theft or data exfiltration behavior if dynamic UI renders a login or form on runtime.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API