mass.report
Scan Intelligence Report0/100
low Risk
raydentalwebsite.invizag.com
https://raydentalwebsite.invizag.com/
IP
209.42.28.102 · WHG Hosting Services Ltd
Location
Canary Wharf, United Kingdom
Domain Age
453 days
HTTP
200 · 21.6s
SSL
Valid· R13, Let's Encrypt, US
Status
COMPLETED
Redirect Chain (3 hops)
301https://raydentalwebsite.invizag.com/
302https://tr.superbahisle.live/
301https://up724.com/zIhwh
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Elitbahis / Süperbahis
Vendors
30/31
Status
partial
✓ chainpatrol✓ drweb✗ norton✓ polyswarm✓ sophos✓ avg✓ microsoft✓ brightcloud✓ yandex✓ isitphish✓ cisa✓ apple✓ emsisoft✓ netcraft✓ avast✓ spamhaus✓ bitdefender✓ urlquery✓ apwg✓ openphish✓ eset✓ phishreport✓ urlscan✓ virustotal✓ phishtank✓ google✓ kaspersky✓ urlabuse✓ threatyeti✓ mcafee✓ fortiguard
Registered-domain escalation
Submit invizag.com as the primary IOC, enriched with evidence from hostile subdomains like raydentalwebsite.invizag.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Elitbahis / Süperbahis
Unknowngambling | technology | finance · 7/19/2026
Summary
The page uses Süperbahis/Elitbahis branding and redirects to an external domain, with an impersonation-like landing layout shown in the screenshot. The final URL resolves to a click-tracking/maintenance domain (temporary-maintenance414.click) and includes multiple redirects, suspicious external resources, and a SPA-rendered credential capture risk indicated by dynamic forms in scripts. Although no static login form is found in HTML, the SPA likely renders credential collection via JavaScript. This suggests potential credential harvesting impersonation rather than a confirmed first-party abuse, but the branding and redirect chain strongly indicate an impersonation attempt targeting Elitbahis/Süperbahis branding.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://temporary-maintenance414.click/cdn-cgi/rum?.
▸Distinctive asset clues: v833ccba57c9e4d2798f2e76cebdd09a11778172276447, all.min.css, css2, 728x90x.gif, 300x300.gif.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 16
Hosts: 8
Domains: 8
Observed Signals (3)
Brand impersonation visuals (Elitbahis / Süperbahis) on a separate domainDynamic form rendering (SPA) with credential capture potential (no static forms in HTML but JS bundles present)Suspicious final URL and POST to CDN-redirect endpoint suggesting data exfiltration capability
Observed Indicators (3)
▸Redirect chain: raydentalwebsite.invizag.com -> tr.superbahisle.live -> up724.com/zIhwh
▸The HTML static content lacks a login form, but SPA indicates credentials could be captured via JavaScript
▸POST to https://temporary-maintenance414.click/cdn-cgi/rum? (204) — potential data polling/exfiltration beacon
Risk AssessmentUsed in abuse reports
The scan indicates a strong impersonation setup using familiar gambling brand visuals (Elitbahis/Süperbahis) on a domain that does not appear to be the official brand domain. The presence of multiple redirects to a click/maintenance domain and a SPA-based credential capture pattern suggests an attempt to harvest user data under the guise of a legitimate betting platform. The domain is hosting a visually authentic landing and uses a Cloudflare beacon, with a suspicious final URL and POST beacon to a third-party domain. This constitutes potential phishing and credential harvesting activity. Recommend aggressive action and further investigation with registrars/hosts for takedown if corroborated by abuse teams.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API