The domain ATO is extremely new (1 day) and is using Cloudflare as a fronting WAF. The final redirect to superbahis2196.com plus the analyst note describing a fake IBAN payment flow strongly suggests malicious intent including credential/phishing infrastructure and payment information theft. However, the scanner was BLOCKED by Cloudflare, so the actual phishing page could not be verified in this capture. The combination of a new domain, redirect to a clone site, and explicit phishing-related narrative indicates a high likelihood of abuse and potential credential or payment data theft activity. Recommend treating as high risk and taking defensive action pending full content access. Analyst-reported cloaking/evasion suspicion increases confidence that the operator is actively attempting to evade automated security analysis. Analyst context was provided and corroborated during this assessment (Redirection to "https://www.superbahis2196.com/bahis" this fake addres which is faking original brand web page but totally phishing users with fake IBAN payment information. Prove https://ibb.co/HvjxJBp Analyst note: th...).