mass.report
Scan Intelligence Report0/100
high Risk
m.wwwsuperbahis.cam
https://m.wwwsuperbahis.cam/
IP
104.21.57.160 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 22.2s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Vendors
29/31
Status
partial
✓ eset✓ avg✓ threatyeti✓ polyswarm✗ drweb✓ phishreport✓ microsoft✗ norton✓ avast✓ chainpatrol✓ brightcloud✓ sophos✓ bitdefender✓ urlquery✓ apple✓ isitphish✓ cisa✓ spamhaus✓ urlscan✓ emsisoft✓ yandex✓ mcafee✓ kaspersky✓ apwg✓ netcraft✓ openphish✓ urlabuse✓ virustotal✓ phishtank✓ google✓ fortiguard
Registered-domain escalation
Submit wwwsuperbahis.cam as the primary IOC, enriched with evidence from hostile subdomains like m.wwwsuperbahis.cam.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
gambling · 7/19/2026
Summary
The page presents Turkish-language content warning about illegal gambling, but the visual design shown in the screenshot mirrors a dark modal with bold typography that resembles a legitimate service’s warning. The domain m.Google is extremely new (0 days) and uses a CAM TLD with Cloudflare in front, which, combined with a suspicious SSL certificate and obfuscated resource naming, signals potential impersonation or abuse. However, the evidence also shows no explicit credential form in the static HTML, and the SPA is likely rendering forms via JavaScript, so credential harvesting cannot be confirmed solely from the static HTML; the POST target observed (cdn-cgi/rum) and SPA-style structure warrant caution and further dynamic analysis to determine if credentials or sensitive data are captured.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://m.wwwsuperbahis.cam/cdn-cgi/rum?.
▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, css2.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 9
Hosts: 4
Domains: 4
Attack Techniques (4)
Single-Page Application (SPA) with dynamic credential UIObfuscated or non-descriptive asset naming in script bundlesPOST to a CDN-related endpoint (cdn-cgi/rum) without a clear legitimate purposeDark-themed modal phishing-style page mimicking a legal warning
Indicators of Compromise (6)
▸Domain age: 0 days (new domain: high risk)
▸TLD: .cam (suspicious for phishing hosting)
▸SSL certificate issued very recently (0 days old)
▸Post request to /cdn-cgi/rum? (unknown purpose but suspicious)
▸Visual impersonation cues in the screenshot (large bold Turkish text, warning badge) suggesting brand-mimicry
▸Official branding not clearly identifiable from domain alone; page title in Turkish about illegal gambling, not a known legitimate service branding
Risk AssessmentUsed in abuse reports
The domain Google is a very new domain with a CAM TLD, using Cloudflare in front and a recent SSL cert. The page content includes a large impersonation-styled warning modal that resembles a legitimate security alert, and the SPA loads an external beacon script from Cloudflare Insights. The presence of a POST to a CDN-like endpoint and the absence of static login fields in the HTML but with dynamic rendering potential raises concern for credential harvesting in runtime. Given the strong indicators of brand impersonation potential, the risk is elevated (48/100) and warrants further blocking and monitoring, with cautious action recommended if additional evidence confirms credential collection or misuse.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API