mass.report
Scan Intelligence Report0/100
high Risk
temporary-maintenance176.online
https://temporary-maintenance176.online/superbahis.html
IP
172.67.197.107 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
35 days
HTTP
200 · 30.2s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Temporary Maintenance Page impersonating Süperbahis/Elitbahis
Vendors
30/31
Status
partial
✓ sophos✓ yandex✓ polyswarm✓ bitdefender✗ norton✓ apple✓ brightcloud✓ avast✓ chainpatrol✓ avg✓ microsoft✓ eset✓ cisa✓ apwg✓ urlquery✓ phishtank✓ urlabuse✓ urlscan✓ isitphish✓ emsisoft✓ openphish✓ spamhaus✓ phishreport✓ netcraft✓ virustotal✓ drweb✓ threatyeti✓ mcafee✓ kaspersky✓ google✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Temporary Maintenance Page impersonating Süperbahis/Elitbahis
Credential Phishingecommerce | technology | finance · 7/19/2026
Summary
The page at temporary-maintenance176.online presents a Süperbahis/Elitbahis themed interface and includes branding elements and imagery associated with Elitbahis. The static HTML shows a refresh/meta redirect to link24.site, and the page uses SPA-like behavior with dynamic credential capture risks indicated by the analyst-supplied context (no static login form). External script and resources hint at credential collection logic loaded via JavaScript. The domain is newly registered (35 days) with a Let's Encrypt certificate and Cloudflare hosting, and the screenshot reveals impersonation of the Elitbahis branding, suggesting a phishing attempt aimed at elicit user interaction and potential credential submission on a third-party domain. Analyst context noted: imitating our brand and hpshigin scamming our users.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://temporary-maintenance176.online/cdn-cgi/rum?.
▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, all.min.css, css2, 468x60_2.gif, 300x300.gif.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 13
Hosts: 5
Domains: 5
Attack Techniques (5)
Brand impersonation via visual cloning (Elitbahis/Süperbahis branding in page visuals)SPA-style credential capture risk (no static login form; forms rendered by JS)Automated redirection/redirect chain (meta refresh to external URL)Obfuscated/renamed asset references and cross-domain tracking resourcesUse of a first-party-like landing with misleading offline/maintenance framing to harvest victims
Indicators of Compromise (8)
▸Page title and Turkish branding referencing Süperbahis and Elitbahis
▸Static HTML contains a meta refresh redirect to an external domain (link24.site/ZbyOg)
▸SSL certificate from Let's Encrypt for a newly registered domain (35 days old)
▸Domain resolves to Cloudflare IPs; hosting appears via Cloudflare fronting
▸Evidence of SPA behavior: no static login form in HTML; dynamic credential UI possible via external JS
▸External script loaded from Cloudflare Insights beacon and large set of assets for UI rendering
▸POST request observed to /cdn-cgi/rum? suggesting anti-abuse or analytics endpoints, but not clearly legitimate
▸Visuals in screenshot mimic Elitbahis branding with two-column card layout and yellow/blue color scheme
Risk AssessmentUsed in abuse reports
The page presents strong impersonation indicators: Turkish-lang branding for Süperbahis/Elitbahis, a meta refresh redirect to a separate domain, and SPA-style credential capture risk. Although the scanned HTML shows no static login form, the combination of branding, suspicious redirection, and dynamic content loading is consistent with an attempt to harvest user credentials or funnel victims to a malicious intermediate site. The domain is newly registered (35 days) with a valid SSL certificate, which is common in phishing setups to appear legitimate. Recommend active action and monitoring for abuse reporting, given the explicit impersonation signals and potential credential harvesting workflow. Analyst context was provided and corroborated during this assessment (imitating our brand and hpshigin scamming our users.).
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API