mass.report
Scan Intelligence Report0/100
medium Risk
tr.superbahis1.live
https://tr.superbahis1.live/
IP
172.67.144.135 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
1 day ⚠
HTTP
200 · 35.5s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Redirect Chain (2 hops)
302https://tr.superbahis1.live/
301https://up24.live/wtWBR
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
elitbahis925.com
Vendors
28/31
Status
partial
✓ fortiguard✓ bitdefender✓ eset✓ avg✓ avast✓ chainpatrol✓ brightcloud✗ drweb✓ apple✓ sophos✗ norton✓ microsoft✓ yandex✗ threatyeti✓ polyswarm✓ kaspersky✓ spamhaus✓ netcraft✓ urlquery✓ emsisoft✓ cisa✓ virustotal✓ urlscan✓ openphish✓ phishtank✓ phishreport✓ isitphish✓ apwg✓ urlabuse✓ google✓ mcafee
Registered-domain escalation
Submit superbahis1.live as the primary IOC, enriched with evidence from hostile subdomains like tr.superbahis1.live.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
elitbahis925.com
Unknowngambling | technology | finance | other · 4/29/2026
Summary
The domain tr.superbahis1.live redirects to elitbahis925.com/affiliates, but the content currently visible is a Cloudflare block page. The final URL and page title indicate a Cloudflare challenge page rather than legitimate site content. Evidence suggests potential impersonation/abuse via redirect to an affiliate domain, with the scanner blocked by WAF. No credential forms were found in static HTML, and the main content appears to be a block page rather than a phishing form; however, the redirect chain and off-domain affiliate URL imply possible redirection to an affiliate or fraudulent landing page.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸Content changed across stages: URL changed between stages; page title changed between stages.
▸POST targets observed during capture: https://getverified3.top/cdn-cgi/rum?, https://getverified3.top/cdn-cgi/challenge-platform/h/g/jsd/oneshot/b0a7532ac8ec/0.1575258237229139:1776680926:lFUL5TC9sX7EO078Tc5pf28fNvQkatfoBibSR0T-Pw0/9ef3ccc04efe6e2f, https://www.elitbahis925.com/cdn-cgi/rum?.
▸Distinctive asset clues: v8c78df7c7c0f484497ecbca7046644da1771523124516, main.js, all.min.css, css2, 728x90x.gif, 728x90.gif.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: Yes
URL changed between stagespage title changed between stages
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 25
Hosts: 10
Domains: 10
Observed Signals (2)
URL redirect chain to an external affiliate domainoff-domain resource loads and suspicious endpoints observed in network activity
Observed Indicators (1)
▸Redirect chain: 302 → tr.superbahis1.live/ → 301 → up24.live/wtWBR → final to elitbahis925.com
Risk AssessmentUsed in abuse reports
The site is on a brand-new domain and uses Cloudflare blocking, with redirects to an affiliate domain elitbahis925.com. The combination of a redirect to an affiliate/landing URL and off-domain resource loading, plus the scanner being blocked by a WAF, is consistent with attempts to trap victims into visiting potentially malicious or spammy landing pages. While there is no concrete credential harvesting observed in the static HTML, the redirect and external script activity warrant heightened risk and monitoring. Recommend treating as suspicious/abuse-prone until further evidence clarifies intent.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API