squad-beta.com Open in urlscan Pro
2606:4700:3033::ac43:a52d Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://squad-beta.com/
Effective URL:
http://squad-beta.com/hypesquad.html
Submission: On May 23 via automatic, source openphish (May 23rd 2022, 1:13:40 am UTC) — Scanned from DE

Summary HTTP 37 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 37 HTTP transactions. The main IP is 2606:4700:3033::ac43:a52d, located in United States and belongs to CLOUDFLARENET, US. The main domain is squad-beta.com.

This is the only time squad-beta.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3033::ac43:a52d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	104.21.11.53 104.21.11.53	() ()
37	4

9 2606:4700:3033::ac43:a52d (United States)

ASN13335 (CLOUDFLARENET, US)

squad-beta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.11.53 (None, )

ASN- ()

squad-beta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	squad-beta.com squad-beta.com	512 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	2 KB
37	2

	Domain	Requested by
10	squad-beta.com	squad-beta.com
2	fonts.googleapis.com	squad-beta.com
37	2

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://squad-beta.com/hypesquad.html
Frame ID: B76E586C85FD7603EE6727591E7EA670
Requests: 37 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://squad-beta.com/ Page URL
http://squad-beta.com/hypesquad.html Page URL

Detected technologies

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Page Statistics

37
Requests

5 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

514 kB
Transfer

970 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://squad-beta.com/ Page URL
http://squad-beta.com/hypesquad.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
squad-beta.com/ 2 KB
2 KB 543ms
513ms Document
text/html 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c641cdc69cb25682255312ebaf0517c7de9b5d8a5b2a770d359a325a367d898

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 70f9ee0e0fff9199-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 23 May 2022 01:13:36 GMT
Last-Modified: Fri, 13 May 2022 22:02:37 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glI3yjR%2Fpkwg7lcFdS7f86IXIemxPXCdomkclxc3cMDsfmZ5NK5tv2hD%2Ft%2BNN2JeT%2BmgGDhZvZcHxsVpmWdfVzfcIHwhvgqGep%2FeDpLObs3ElifFMnSKDMCJ6YDEfDxaEBidHl%2F24JEwwj%2BG5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK 0.dc7ef3e8da077677312a.css
squad-beta.com/assets/ 255 KB
49 KB 514ms
514ms Stylesheet
text/css 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd99b03b792d0ef63a32533a1b39e3b47bb4dcaef17a0b6d1f6d83eeb902c16d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:36 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Sat, 26 Feb 2022 22:39:46 GMT
Server: cloudflare
ETag: W/"3fc9c-5d8f37e025268"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bN3u0jGp%2B192CcC2Z%2FvK7hWZV1Xv2FritzhM7cfWxhEpbGdNnqXylyYUmX2gvu5ZIShaVPZpv6dgaY8EZ7PGUteB%2FN9mnlilEWCdnj6QbdNzkMbyn0cRYPTl5j%2BDpGYkoSkLAZJYdd9a2j1h5A%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 70f9ee11597b9199-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H2 200 css
fonts.googleapis.com/ 2 KB
988 B 81ms
30ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Press+Start+2P

Requested by

Host: squad-beta.com
URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6a84bd93f8fa39e4a265fa973b1c79adb09e1f532b51f2b8677f63c20c11a72e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:16:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 23 May 2022 01:13:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 May 2022 01:13:36 GMT

GET
H/1.1 200
OK Primary Request hypesquad.html Show response
squad-beta.com/ 46 KB
11 KB 725ms
724ms Document
text/html 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/hypesquad.html
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 446002b35ffdc68c11e667af50f4f3c13a8d45f6e396f46b7d5d3b3d60776fc2

Request headers

Referer: http://squad-beta.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 70f9ee249b209199-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 23 May 2022 01:13:39 GMT
Last-Modified: Thu, 19 May 2022 19:07:12 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zCTq77ORhw4yMZDmxa1ebI3zmHFABeFMteofAb0HCcR%2FYKdFqxH5fevwRmExjPVCQ6%2BdxC2znf55UqtufvJgs4k7FsAQhupYxCf5et1iZ3gavwF7I5guO%2BhMTJpspbVOfyStUXXwY2w4OnMRHw%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK 0.dc7ef3e8da077677312a.css
squad-beta.com/assets/ 255 KB
49 KB 780ms
755ms Stylesheet
text/css 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/hypesquad.html
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd99b03b792d0ef63a32533a1b39e3b47bb4dcaef17a0b6d1f6d83eeb902c16d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/hypesquad.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:40 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Sat, 26 Feb 2022 22:39:46 GMT
Server: cloudflare
ETag: W/"3fc9c-5d8f37e025268"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZBiw8Y%2BnecVWAAZQfZj9NYUzw2oMtu4OwrKjFeXvslVeq7FfiaoLu2hZ7BSnG8D2%2FyB%2F9ga74rRHhbomHov0xEm914uAKDFY96tz1cFU9ZJ0sAnZpzo2ZyCIJfRzPU7z1i%2FQ%2FOvCUFK%2BUcjO2A%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 70f9ee282c6a68fe-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK otSDKStub.js Show response
squad-beta.com/assets/oneTrust/v2/scripttemplates/ 17 KB
6 KB 1193ms
867ms Script
application/javascript 104.21.11.53

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/oneTrust/v2/scripttemplates/otSDKStub.js
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/hypesquad.html
Protocol: HTTP/1.1
Server: 104.21.11.53 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e409af4e2cd960258ebce74a7af470632e2fa44a18cbc2e49da7f098a3c572c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/hypesquad.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:40 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Wed, 12 May 2021 23:35:01 GMT
Server: cloudflare
ETag: W/"420f-5c22a759a1340"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rp%2Fi4kvWuXNC1tvhvAOF1QYo4Lsq2AKPTRHe7kNwl9HRVSVIQ6r7YLduDpvzBA%2FTFeIfLyMBhF19gu87iCwuE0ur%2BpO4q6Rzposdw3Q4RCZ3Ij%2Bnz4JxMejvTwuUtMC8ww%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 70f9ee289a826d91-MUC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK api.js Show response
squad-beta.com/cdn-cgi/bm/cv/669835187/ 0
527 B 29ms
29ms Script
text/plain 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/cdn-cgi/bm/cv/669835187/api.js
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/hypesquad.html
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/hypesquad.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:40 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q10m1%2FopsJynpELiwwnOFGlbDypuCbGswnHRZfCM9sKvIp5J5bimnNkpKFgfCmorJOivr15pEz1TAoSxPUmNmz0ntRv1COCLXKKGUTox1NPOmU30OaODxPIKSMSEs%2FYJRl0LeUa4eLGUWGjuOw%3D%3D"}],"group":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 70f9ee2b7f1668fe-FRA

GET
H/1.1 200
OK human.png
squad-beta.com/assets/ 236 KB
237 KB 731ms
731ms Image
image/png 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://squad-beta.com/assets/human.png
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/hypesquad.html
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ee7eb3becab8cd3bf3cf095211f4d35041e9009bb1755771a3fa66aa3a75897

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/hypesquad.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:41 GMT
CF-Cache-Status: REVALIDATED
Last-Modified: Sat, 26 Feb 2022 22:38:41 GMT
Server: cloudflare
ETag: "3b0d7-5d8f37a2418cf"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KfRC7KzDKWSSfgkUKc7tAvHOf1mKvmSYQ8jLrh4E4%2F5pGyG6FTozRpBWCaSg7Ljqni2%2BJbAi6ZlHsDEwtS4LysTa%2BlSzSc0BRbY03IxfodW6bgqjpQBYI0N3PUGI5fIpmupy1%2BZEOcYlcSpMEg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 70f9ee2d18ee68fe-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 241879

GET boy.png
squad-beta.com/assets/ 0
0

GET e6d6b255259ac878d00819a9555072ad.png
squad-beta.com/assets/ 0
0

GET 1172c239f4359bbd3888.js
squad-beta.com/assets/ 0
0

GET 5d45977a17cea7d7fd04.js
squad-beta.com/assets/ 0
0

GET a78ff4dc1da0d0d91a9f.js
squad-beta.com/assets/ 0
0

GET b72a84b0cd56c98da9c2.js
squad-beta.com/assets/ 0
0

GET f10356a94a9ff71c95e2.js
squad-beta.com/assets/ 0
0

GET 260231abb8264ee24d10.js
squad-beta.com/assets/ 0
0

GET 7dcaa84f892b2636a01f.js
squad-beta.com/assets/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 2 KB
582 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Press+Start+2P

Requested by

Host: squad-beta.com
URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6a84bd93f8fa39e4a265fa973b1c79adb09e1f532b51f2b8677f63c20c11a72e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:13:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 23 May 2022 01:13:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 May 2022 01:13:40 GMT

GET
H/1.1 404
Not Found 04da1d72-0626-4fff-b3c6-150c719cc115.json Show response
squad-beta.com/assets/oneTrust/v2/consent/04da1d72-0626-4fff-b3c6-150c719cc115/ 301 B
928 B 278ms
277ms XHR
text/html 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/oneTrust/v2/consent/04da1d72-0626-4fff-b3c6-150c719cc115/04da1d72-0626-4fff-b3c6-150c719cc115.json
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/assets/oneTrust/v2/scripttemplates/otSDKStub.js
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a409eba2ae21f3665d568f6131212a88e362dfdcdf2bdbf284efdbe3efb24732

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://squad-beta.com/hypesquad.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:41 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=crBcxPLXBduKlUMhZ3px9Q%2FOa9PnXmKaOiepgzIkwJiHxwv0WbS0177W5uIXN4n3qVLU8amRJbze6uqr%2FVZpUU3Xc06zriOcHPHIs2ihNQtNwAjIghtnFFg1M3FnjqUdV%2FinDB3Nm%2F7G7r7G4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive
CF-RAY: 70f9ee2e080b9199-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET gtm5445.html
squad-beta.com/www.googletagmanager.com/ 0
0

GET fbevents.js
squad-beta.com/connect.facebook.net/en_US/ 0
0

GET 909c987e9e8c30d8509752464753e7f6.svg
squad-beta.com/assets/ 0
0

GET
H/1.1 200
OK be0060dafb7a0e31d2a1ca17c0708636.woff
squad-beta.com/assets/ 81 KB
81 KB 538ms
525ms Font
font/woff 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/be0060dafb7a0e31d2a1ca17c0708636.woff
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Origin: http://squad-beta.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:41 GMT
CF-Cache-Status: REVALIDATED
Last-Modified: Wed, 26 Jun 2019 04:16:05 GMT
Server: cloudflare
ETag: "14300-58c324dcbab40"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6eKD2YunVzxHq5Nw%2B9tHwX4feCtDI3dYGwQXfQxZNssNenU%2B5ihCP4JuCFrFQZKuvM06je3gF2B7LPpWQurl9E0I3vUFOhUOZ30aAlpewLgpB892c%2B0KFjCSNNXE%2BBRdiIMQCMjGGGe0Pr3mYg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: font/woff
Cache-Control: max-age=14400
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 70f9ee2e3dfc920e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 82688

GET
H/1.1 200
OK 3bdef1251a424500c1b3a78dea9b7e57.woff
squad-beta.com/assets/ 75 KB
76 KB 535ms
521ms Font
font/woff 2606:4700:3033::ac43:a52d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://squad-beta.com/assets/3bdef1251a424500c1b3a78dea9b7e57.woff
Requested by: Host: squad-beta.com
URL: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Protocol: HTTP/1.1
Server: 2606:4700:3033::ac43:a52d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: http://squad-beta.com/assets/0.dc7ef3e8da077677312a.css
Origin: http://squad-beta.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 01:13:41 GMT
CF-Cache-Status: REVALIDATED
Last-Modified: Wed, 26 Jun 2019 04:16:17 GMT
Server: cloudflare
ETag: "12bc8-58c324e82c640"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9S3vDNDiY6WTh1RUKuztTWeXDSvpkC0cMGQzRyzRVDcFiiOL6gUG3Ofi2forl37qICmVNzPl9r%2Fp%2Bz19aX450o1fjBdMkFO8XSEBGtgAF7JU7BhOp4wOrWTC5UptTwrWh%2F5gRn8TDt0z6xLl3A%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: font/woff
Cache-Control: max-age=14400
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 70f9ee2e380b9235-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 76744

GET 8e12fb4f14d9c4592eb8ec9f22337b04.woff
squad-beta.com/assets/ 0
0

GET e8acd7d9bf6207f99350ca9f9e23b168.woff
squad-beta.com/assets/ 0
0

GET 8a6fb04a7de46f908adbb18c2b4b776b.svg
squad-beta.com/assets/ 0
0

GET 008e2c37d3b89c444d451cd305fb3e14.svg
squad-beta.com/assets/ 0
0

GET 19654c38399b0e75c351d6fc960fe0ca.svg
squad-beta.com/assets/ 0
0

GET 84d4951c6eb1f90d3cc51c8a696cc1a0.png
squad-beta.com/assets/ 0
0

GET 1fd30dc5922029b453afe4c78e10873b.svg
squad-beta.com/assets/ 0
0

GET 104aed05aa971c3f6ec263c6d0314927.png
squad-beta.com/assets/ 0
0

GET 2e972c97c3483bf0bee8fc011a77044d.png
squad-beta.com/assets/ 0
0

GET 2402224b8957788a59a1bed474d77d6e.png
squad-beta.com/assets/ 0
0

GET 5d0876ba7f8b081321655a7fc5c60aa2.png
squad-beta.com/assets/ 0
0

GET 610918cd61367c50cb80bb1b56032cd4.svg
squad-beta.com/assets/ 0
0

GET ae7c84783ad48b6d1c8e2bfbe707e0d4.woff2
squad-beta.com/assets/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: squad-beta.com
URL: http://squad-beta.com/assets/boy.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/e6d6b255259ac878d00819a9555072ad.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/1172c239f4359bbd3888.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/5d45977a17cea7d7fd04.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/a78ff4dc1da0d0d91a9f.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/b72a84b0cd56c98da9c2.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/f10356a94a9ff71c95e2.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/260231abb8264ee24d10.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/7dcaa84f892b2636a01f.js

Domain: squad-beta.com
URL: http://squad-beta.com/www.googletagmanager.com/gtm5445.html?id=GTM-N7BVC2W&gtm_auth=GI0g9O-54_SitcgmxQKxlA&gtm_preview=env-2&gtm_cookies_win=x

Domain: squad-beta.com
URL: http://squad-beta.com/connect.facebook.net/en_US/fbevents.js

Domain: squad-beta.com
URL: http://squad-beta.com/assets/909c987e9e8c30d8509752464753e7f6.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/8e12fb4f14d9c4592eb8ec9f22337b04.woff

Domain: squad-beta.com
URL: http://squad-beta.com/assets/e8acd7d9bf6207f99350ca9f9e23b168.woff

Domain: squad-beta.com
URL: http://squad-beta.com/assets/8a6fb04a7de46f908adbb18c2b4b776b.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/008e2c37d3b89c444d451cd305fb3e14.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/19654c38399b0e75c351d6fc960fe0ca.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/84d4951c6eb1f90d3cc51c8a696cc1a0.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/1fd30dc5922029b453afe4c78e10873b.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/104aed05aa971c3f6ec263c6d0314927.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/2e972c97c3483bf0bee8fc011a77044d.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/2402224b8957788a59a1bed474d77d6e.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/5d0876ba7f8b081321655a7fc5c60aa2.png

Domain: squad-beta.com
URL: http://squad-beta.com/assets/610918cd61367c50cb80bb1b56032cd4.svg

Domain: squad-beta.com
URL: http://squad-beta.com/assets/ae7c84783ad48b6d1c8e2bfbe707e0d4.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://squad-beta.com/assets/oneTrust/v2/consent/04da1d72-0626-4fff-b3c6-150c719cc115/04da1d72-0626-4fff-b3c6-150c719cc115.json Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
squad-beta.com
squad-beta.com
104.21.11.53
2606:4700:3033::ac43:a52d
2a00:1450:4001:810::200a
2e409af4e2cd960258ebce74a7af470632e2fa44a18cbc2e49da7f098a3c572c
446002b35ffdc68c11e667af50f4f3c13a8d45f6e396f46b7d5d3b3d60776fc2
5ee7eb3becab8cd3bf3cf095211f4d35041e9009bb1755771a3fa66aa3a75897
6a84bd93f8fa39e4a265fa973b1c79adb09e1f532b51f2b8677f63c20c11a72e
6c641cdc69cb25682255312ebaf0517c7de9b5d8a5b2a770d359a325a367d898
a409eba2ae21f3665d568f6131212a88e362dfdcdf2bdbf284efdbe3efb24732
dd99b03b792d0ef63a32533a1b39e3b47bb4dcaef17a0b6d1f6d83eeb902c16d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

squad-beta.com Open in urlscan Pro 2606:4700:3033::ac43:a52d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

5 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

4 IPs

2 Countries

514 kBTransfer

970 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

squad-beta.com Open in urlscan Pro
2606:4700:3033::ac43:a52d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

5 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

514 kB
Transfer

970 kB
Size

0
Cookies

37 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!