mass.report
Scan Intelligence Report0/100
low Risk
www.bm-autoszerviz.hu
https://www.bm-autoszerviz.hu/jhkgm/s%C3%BCperbahis-bahis/
IP
104.21.72.49 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
—
HTTP
520 · 18.5s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: bm-autoszerviz.hu
Scanned 3 times since Jun 13, 2026, 11:43 AM UTC
ℹ Low (5)
Registered-domain escalation
Submit bm-autoszerviz.hu as the primary IOC, enriched with evidence from hostile subdomains like www.bm-autoszerviz.hu.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
ATO
Unknowntechnology | ecommerce | finance | other · 7/19/2026
Summary
The scan shows a Cloudflare 520 error page for ATO, with the domain resolving to Cloudflare and using a valid SSL cert issued recently. The page content captured is a Cloudflare error page, not the site’s actual content. There is evidence of WAF-blocking behavior in the scan notes, but the visible page itself does not present credential harvesting or impersonation signals. Based on non-page signals, the domain appears to be behind Cloudflare rather than a brand impersonation page, and no credential capture UI is observed in the static HTML.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Distinctive asset clues: main.css, cf-icon-ok.png, cf-icon-cloud.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 7
Hosts: 1
Domains: 1
Observed Signals (1)
SPA-like behavior inferred from absence of static forms (potential dynamic credential UI).
Observed Indicators (0)
No suspicious indicators identified
Risk AssessmentUsed in abuse reports
The scan did not confirm credential phishing on this page content, as the visible content is a Cloudflare error page. However, the scanner was blocked by a WAF, which signals defensive measures and operator awareness of detection. Given the domain is behind Cloudflare and the page presented is a Cloudflare error rather than brand impersonation content, the current evidence does not establish active phishing or credential theft. Monitor the domain for future access to determine if legitimate site content resumes or if impersonation content appears elsewhere.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API