urlscan.io logo urlscan.io
SecurityTrails logo

sb.bellezza-skin.work Open in urlscan Pro
2606:4700::6810:925d  Public Scan

Go To Rescan Add Verdict Report
URL: https://sb.bellezza-skin.work/
Submission Tags: phishingrod
Submission: On May 09 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 2606:4700::6810:925d, located in United States and belongs to CLOUDFLARENET, US. The main domain is sb.bellezza-skin.work.
TLS certificate: Issued by E1 on May 9th 2024. Valid for: 3 months.
This is the only time sb.bellezza-skin.work was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 18.172.112.119 16509 (AMAZON-02)
1 2606:4700:311... 13335 (CLOUDFLAR...)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 99.86.4.91 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 6
2    2606:4700::6810:925d (United States)

ASN13335 (CLOUDFLARENET, US)
sb.bellezza-skin.work
1    18.172.112.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-112-119.fra60.r.cloudfront.net
assets-v2.article.squadbeyond.com
1    2606:4700:3110::6812:352c (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.polyfill.io
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    99.86.4.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-91.fra6.r.cloudfront.net
production.static.squadbeyond.com
1    2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
Apex Domain
Subdomains		 Transfer
2 squadbeyond.com
assets-v2.article.squadbeyond.com
production.static.squadbeyond.com
12 KB
2 bellezza-skin.work
sb.bellezza-skin.work
2 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 804
7 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
14 KB
1 polyfill.io
cdn.polyfill.io — Cisco Umbrella Rank: 2982
529 B
7 5
Domain Requested by
2 sb.bellezza-skin.work static.cloudflareinsights.com
1 static.cloudflareinsights.com sb.bellezza-skin.work
1 production.static.squadbeyond.com sb.bellezza-skin.work
1 cdnjs.cloudflare.com sb.bellezza-skin.work
1 cdn.polyfill.io sb.bellezza-skin.work
1 assets-v2.article.squadbeyond.com
7 6

This site contains no links.

Subject Issuer Validity Valid
sb.bellezza-skin.work
E1		 2024-05-09 -
2024-08-07		 3 months crt.sh
assets-v2.article.squadbeyond.com
Amazon RSA 2048 M03		 2024-01-02 -
2025-01-30		 a year crt.sh
*.polyfill.io
Sectigo RSA Domain Validation Secure Server CA		 2024-02-20 -
2025-02-19		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
production.static.squadbeyond.com
Amazon RSA 2048 M02		 2023-06-21 -
2024-07-19		 a year crt.sh
cloudflareinsights.com
GTS CA 1P5		 2024-05-08 -
2024-08-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://sb.bellezza-skin.work/
Frame ID: 93CDEDC7BA109C10DCCF243D94FBA289
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

34 kB
Transfer

89 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
sb.bellezza-skin.work/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sb.bellezza-skin.work/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:925d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61916ae60b1cdf2acac1e5b0a97391d250fdb71a6da30c1b6b12fc916bcf1908

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
880ed5bb0ba73653-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 09 May 2024 04:09:35 GMT
link
<https://assets-v2.article.squadbeyond.com/assets/application-fca8d9efa05c78924c0cd69ac04e80463c29b4739e17719a703325084eafa398.js>; rel=preload; as=script; nopush
referrer-policy
no-referrer-when-downgrade
server
cloudflare
vary
Accept-Encoding
x-amzn-trace-id
Root=1-663c4c7f-1ae1ce1202932ef42f4338f2
x-request-id
334e2221-521a-4d02-a31f-985017fd9b5e
x-runtime
0.016787
x-sb-dist-service
legacy
application-fca8d9efa05c78924c0cd69ac04e80463c29b4739e17719a703325084eafa398.js
assets-v2.article.squadbeyond.com/assets/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets-v2.article.squadbeyond.com/assets/application-fca8d9efa05c78924c0cd69ac04e80463c29b4739e17719a703325084eafa398.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.112.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-112-119.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fca8d9efa05c78924c0cd69ac04e80463c29b4739e17719a703325084eafa398

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://sb.bellezza-skin.work/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 13 Jan 2024 02:46:05 GMT
content-encoding
gzip
via
1.1 725f43139b6c583d9defb7c5029a8928.cloudfront.net (CloudFront)
last-modified
Thu, 09 Feb 2023 07:36:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P8
age
10113810
etag
W/"ef02f1ddc2e9047e8f5261067a7c405a"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=31557600
x-amz-cf-id
ckyqnduLCMyUTdOzwnx6GkKoXgmK3pQPku0VYUNwPF4WdLt0mMdcQA==
expires
Fri, 09 Feb 2024 13:36:30 GMT
polyfill.min.js
cdn.polyfill.io/v2/ 		369 B
529 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.polyfill.io/v2/polyfill.min.js?features=es6
Requested by
Host: sb.bellezza-skin.work
URL: https://sb.bellezza-skin.work/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3110::6812:352c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86dc3ab6b39385f07ebd2aa599305640811b8fd43f12dda465d6b67c85215728

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://sb.bellezza-skin.work/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 09 May 2024 04:09:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Sat, 13 Apr 2024 03:46:01 GMT
server
cloudflare
age
2247815
vary
Accept-Encoding, User-Agent
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=14400
cf-ray
880ed5c13aa3637f-LHR
expires
Thu, 09 May 2024 08:09:36 GMT
URI.min.js
cdnjs.cloudflare.com/ajax/libs/URI.js/1.19.2/ 		46 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/URI.js/1.19.2/URI.min.js
Requested by
Host: sb.bellezza-skin.work
URL: https://sb.bellezza-skin.work/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e06e99d50dc508617c868615e336f9e0e10dc1c664b84d0d9ef6e516c25383bb
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://sb.bellezza-skin.work/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 09 May 2024 04:09:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1128239
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
13427
last-modified
Mon, 04 May 2020 16:04:03 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03cf3-b853"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wvj9Nv%2BKGrqe2LjcK1fqgAnLRNIHwRRG8xhZIDl%2FVCk3Ob9hiIhbK2E7vP0plpIkWS898WNDmjRNyDBpWge8gFGsFh1uCS33%2FfpURIUV3UzDFefTv1ss%2FqzVH9%2FFYcX5EipkSQZT"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
880ed5bf1ee91e52-FRA
expires
Tue, 29 Apr 2025 04:09:35 GMT
smooth-scroll.min.js
production.static.squadbeyond.com/smooth-scroll/16.1.3/ 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://production.static.squadbeyond.com/smooth-scroll/16.1.3/smooth-scroll.min.js
Requested by
Host: sb.bellezza-skin.work
URL: https://sb.bellezza-skin.work/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-91.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
78fb1bd09ce33d607f1c7928f1c9fe45af9ba8c2723bfea45c8be5916bbcc50c

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://sb.bellezza-skin.work/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 08 May 2024 04:41:14 GMT
via
1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
last-modified
Fri, 10 Sep 2021 03:36:49 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
84502
etag
"49a6197db65e4ce11da47e5672726e43"
x-cache
Hit from cloudfront
content-type
application/javascript
origin-agent-cluster
?0
accept-ranges
bytes
content-length
5598
x-amz-cf-id
VVex5VP2IfZb5WXbuKSq3EV6zq5D47tfVjlgG__rz3ywwZiZujGDlA==
vedd3670a3b1c4e178fdfb0cc912d969e1713874337387
static.cloudflareinsights.com/beacon.min.js/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387
Requested by
Host: sb.bellezza-skin.work
URL: https://sb.bellezza-skin.work/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2e817d2c44b9cf45f0e45cfa351abba3203af38f5aa1c8576a2db69ebd15192

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://sb.bellezza-skin.work/
Origin
https://sb.bellezza-skin.work
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 09 May 2024 04:09:36 GMT
content-encoding
gzip
last-modified
Mon, 06 May 2024 19:01:13 GMT
server
cloudflare
etag
W/"2024.4.1"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
880ed5c049c89290-FRA
rum
sb.bellezza-skin.work/cdn-cgi/ 		0
211 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sb.bellezza-skin.work/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:925d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
https://sb.bellezza-skin.work/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type
application/json

Response headers

date
Thu, 09 May 2024 04:09:36 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://sb.bellezza-skin.work
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
880ed5c1af073653-FRA

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LazyLoad object| IPv6 object| punycode object| SecondLevelDomains function| URI function| URITemplate function| SmoothScroll object| __cfBeacon

1 Cookies

Domain/Path Name / Value
.sb.bellezza-skin.work/ Name: __cf_bm
Value: 4dBU5kMQQN9ZiIxd9quql1v3uAMlOJIPbBNaJHQ7jsQ-1715227775-1.0.1.1-6u9SgvRnEQ7hbDpVhQqKzdHVBEChaa6BAcszkPI9LrHObqrTfLNzQqwzRkFt.SCHO5jzCXBTGlm9qBhhEWwPRQ