mass.report
Scan Intelligence Report0/100
low Risk
www.casamaia.it
https://www.casamaia.it/s%C3%BCperbahis-bahis/
IP
104.21.31.196 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
—
HTTP
520 · 19.4s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: casamaia.it
Scanned 2 times since Jun 13, 2026, 11:34 AM UTC
ℹ Low (5)
Registered-domain escalation
Submit casamaia.it as the primary IOC, enriched with evidence from hostile subdomains like www.casamaia.it.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
ATO
Unknowntechnology · 7/19/2026
Summary
The scanner shows a Cloudflare 520 error page for ATO, with no accessible content from the origin. The page title indicates a 520 error, and the static HTML reveals a Cloudflare block/error shell rather than authentic site content. There is no evidence of credential collection or impersonation on the captured page itself, but the presence of a WAF-blocked page and the unknown origin error suggest the site is currently not delivering its content. Further, SSL cert is recently issued but this alone is not conclusive of abuse.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Distinctive asset clues: main.css, cf-icon-browser.png, cf-icon-ok.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 7
Hosts: 1
Domains: 1
Attack Techniques (0)
Indicators of Compromise (0)
No specific IOCs identified in source
Risk AssessmentUsed in abuse reports
Analysis indicates the site is currently non-deliverable due to Cloudflare 520 error and an active WAF/blocked page. This blocks assessment of impersonation or credential-collection behavior on the live page. The combination of a freshly issued SSL cert and Cloudflare-origin communication issues suggests potential infrastructure misconfiguration or intentional protection against scanners. Recommend monitoring and follow-up when origin content becomes reachable to determine if impersonation or abuse occurs. If the domain remains inaccessible, the risk remains non-actionable for phishing at this time.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API