mass.report
Scan Intelligence Report0/100
low Risk
www.livinout.be
https://www.livinout.be/s%C3%BCperbahis-sitesi/?srsltid=AfmBOooCku6qq2tC01m8DQavboX56lsWD7zWbVxKUY8xDFRQXOoeiu9R
IP
104.21.73.95 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
—
HTTP
520 · 13.1s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
ATO
Vendors
30/31
Status
partial
✓ cisa✓ avg✓ eset✓ apple✓ bitdefender✓ drweb✓ avast✓ chainpatrol✓ yandex✓ kaspersky✗ norton✓ sophos✓ microsoft✓ polyswarm✓ openphish✓ emsisoft✓ isitphish✓ brightcloud✓ apwg✓ netcraft✓ virustotal✓ spamhaus✓ phishreport✓ urlscan✓ urlquery✓ phishtank✓ google✓ urlabuse✓ threatyeti✓ mcafee✓ fortiguard
Registered-domain escalation
Submit livinout.be as the primary IOC, enriched with evidence from hostile subdomains like www.livinout.be.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
ATO
UnknownTechnology · 7/19/2026
Summary
The page shows a Cloudflare 520 error for the domain ATO. Visuals on the page depict Cloudflare branding and a generic error page rather than a credential-collection interface. There is no evidence of a brand impersonation or credential harvesting on the captured static content; the domain appears to be the target domain returning an error rather than a phishing clone. Based on the available data, phishing/impersonation cannot be confirmed from this scan alone.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Distinctive asset clues: main.css, cf-icon-browser.png, cf-icon-ok.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 7
Hosts: 1
Domains: 1
Observed Signals (1)
SPA considerations noted: static HTML contains no forms; potential dynamic credential capture if present via JS in runtime
Observed Indicators (1)
▸No static login/credential fields in HTML; analyst notes SPA possibility
Risk AssessmentUsed in abuse reports
The scan identifies a legitimate-looking domain returning a Cloudflare 520 error. The visual content in the screenshot includes Cloudflare branding and a generic host error; there is no evidence of credential collection interfaces or impersonation of a known brand within the captured content. The presence of a fresh SSL cert and Cloudflare diagnostics could be normal for an unavailable site, but the page does not demonstrate phishing activity based on the available indicators. Recommend monitoring and re-scan if the page becomes reachable to confirm whether any credential-capture functionality appears in runtime.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API