https://salla-kazan724.top/superbahis.html
104.21.53.252 · Cloudflare, Inc.
Toronto, Canada
32 days
200 · 24.2s
Valid· E8, Let's Encrypt, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
elitbahis934.com
Vendors
29/31
Status
partial
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
gambling | technology | finance | other · 6/3/2026
The scan shows a Cloudflare 403/Block page for elitbahis934.com, not the actual target page content. The final URL attempted redirects to elitbahis934.com with a path that implies an affiliates link. The page content in the visible screenshot is a Cloudflare block page, not an impersonation page, but the domain and redirect chain suggest the operator is cloaking/redirection to an affiliated betting site. Since the block page is served by Cloudflare, there is evidence of WAF-based blocking during scanning rather than definitive phishing content on the live page. Analyst flagged likely cloaking/evasion behavior for this target. Analyst context noted: Fake brand imitating, phishing users with fake information. Elibahid and Superbahis brand imitating. Analyst note: this target may cloak content or block scanners.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: Yes
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 23
Hosts: 8
Domains: 8
No specific IOCs identified in source
The domain salla-kazan724.top is a newly registered, suspicious top-level domain name that redirects to elitbahis934.com and triggers a Cloudflare block page. The block page itself confirms Cloudflare protection and an anti-bot challenge, which is commonly used by attackers to evade scanning. The observed redirect chain to an affiliated betting domain and multiple dynamic resources loaded from external hosts indicate potential abuse via cloaked redirects or affiliate schemes. While there is no direct evidence of credential harvesting in the static HTML, the combination of cloaked behavior, new domain, and redirection to a gaming/betting affiliate site constitutes suspicious activity demanding caution and monitoring. Recommend blocking or suspension actions until further verification is possible. Analyst-reported cloaking/evasion suspicion increases confidence that the operator is actively attempting to evade automated security analysis. Analyst context was provided and corroborated during this assessment (Fake brand imitating, phishing users with fake information. Elibahid and Superbahis brand imitating. Analyst note: this target may cloak content or block scanners.).
Monitor