https://www.academiadearteybelleza.com/
142.93.62.161 · DigitalOcean, LLC
North Bergen, United States
2215 days
200 · 21.0s
Valid· R13, Let's Encrypt, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Süperbahis
Vendors
30/31
Status
partial
Registered-domain escalation
Submit academiadearteybelleza.com as the primary IOC, enriched with evidence from hostile subdomains like www.academiadearteybelleza.com.
No KB/IOK detections were recorded for this scan.
gambling | entertainment · 6/3/2026
The page presents branding for Süperbahis, but the domain shown (www.academiadearteybelleza.com) does not match the official Süperbahis brand. The page title and Open Graph data reference Süperbahis, and network/asset signals indicate a cloaked/Spa-like setup with external alias tr.superbahis1.live and visuals mimicking Süperbahis. Static HTML contains no forms; SPA behavior is implied via dynamic scripts. Overall, evidence suggests impersonation/cloaking rather than a confirmed legitimate Süperbahis first-party page. Analyst flagged likely cloaking/evasion behavior for this target. Analyst context noted: Cloaking as tr.superbahis1.live and mimicing the real superbahis brand and scamming users. Analyst note: this target may cloak content or block scanners.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 13
Hosts: 7
Domains: 7
The page shows strong impersonation indicators: branding tied to Süperbahis, but the domain resolves to www.academiadearteybelleza.com with alternate branding pointing to tr.superbahis1.live. This cloaking and cross-domain branding is a common tactic for credential phishing. The SPA nature and absence of static forms do not rule out credential capture via dynamic UI. Recommend elevated monitoring and likely action if corroborated by user reports or further evidence of credential collection from dynamic forms. The presence of a cloaked alias domain and explicit impersonation signals constitute abuse potential. Analyst-reported cloaking/evasion suspicion increases confidence that the operator is actively attempting to evade automated security analysis. Analyst context was provided and corroborated during this assessment (Cloaking as tr.superbahis1.live and mimicing the real superbahis brand and scamming users. Analyst note: this target may cloak content or block scanners.).
Monitor