beautyfrench.com Open in urlscan Pro
145.239.64.186  Malicious Activity! Public Scan

Submitted URL: https://itsssl.com/HSjNn
Effective URL: https://beautyfrench.com/CR/client/login.php
Submission: On March 25 via manual from ES — Scanned from NL

Summary

This website contacted 7 IPs in 5 countries across 9 domains to perform 18 HTTP transactions. The main IP is 145.239.64.186, located in France and belongs to OVH, FR. The main domain is beautyfrench.com.
TLS certificate: Issued by R3 on March 12th 2023. Valid for: 3 months.
This is the only time beautyfrench.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Grupo Caja Rural (Banking)

Domain & IP information

Apex Domain
Subdomains
Transfer
13 beautyfrench.com
beautyfrench.com
221 KB
2 google-analytics.com
www.google-analytics.com Failed
ssl.google-analytics.com — Cisco Umbrella Rank: 404
17 KB
1 google.nl
www.google.nl — Cisco Umbrella Rank: 9237
408 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
487 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 70
381 B
1 gstatic.com
fonts.gstatic.com
44 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
1 ruralvia.com
www.ruralvia.com
2 KB
1 itsssl.com
itsssl.com
636 B
18 9
Domain Requested by
13 beautyfrench.com 1 redirects beautyfrench.com
2 ssl.google-analytics.com 1 redirects beautyfrench.com
1 www.google.nl beautyfrench.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com beautyfrench.com
1 www.ruralvia.com beautyfrench.com
1 itsssl.com 1 redirects
0 www.google-analytics.com Failed beautyfrench.com
18 10

This site contains no links.

Subject Issuer Validity Valid
beautyfrench.com
R3
2023-03-12 -
2023-06-10
3 months crt.sh
www.ruralvia.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-03-06 -
2023-05-29
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-03-06 -
2023-05-29
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-03-06 -
2023-05-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://beautyfrench.com/CR/client/login.php
Frame ID: F38291C67C9CB90694DA50E7AD37CC7C
Requests: 18 HTTP requests in this frame

Screenshot

Page Title

Caja Rural

Page URL History Show full URLs

  1. https://itsssl.com/HSjNn HTTP 301
    https://beautyfrench.com/CR/ HTTP 302
    https://beautyfrench.com/CR/client/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

18
Requests

89 %
HTTPS

78 %
IPv6

9
Domains

10
Subdomains

7
IPs

5
Countries

287 kB
Transfer

548 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://itsssl.com/HSjNn HTTP 301
    https://beautyfrench.com/CR/ HTTP 302
    https://beautyfrench.com/CR/client/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1812749955&utmhn=beautyfrench.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=1768443640&utmr=-&utmp=%2FCR%2Fclient%2Flogin.php&utmht=1679767864340&utmac=UA-12835961-1&utmcc=__utma%3D234032397.2136395696.1679767864.1679767864.1679767864.1%3B%2B__utmz%3D234032397.1679767864.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1198385848&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955 HTTP 302
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955&slf_rd=1&random=1698337936

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
beautyfrench.com/CR/client/
Redirect Chain
  • https://itsssl.com/HSjNn
  • https://beautyfrench.com/CR/
  • https://beautyfrench.com/CR/client/login.php
13 KB
4 KB
Document
General
Full URL
https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
f143f88d3952e78a275a6bbe19574c90508dc1e74c10e0b51ed8f0f9f9bb34c4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
3881
Content-Type
text/html; charset=UTF-8
Date
Sat, 25 Mar 2023 18:11:03 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sat, 25 Mar 2023 18:11:03 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
location
client/login.php
rviaLogin.css
beautyfrench.com/CR/client/res/
17 KB
4 KB
Stylesheet
General
Full URL
https://beautyfrench.com/CR/client/res/rviaLogin.css
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
246c037026a7a16b204b4688fbcf320b35d95b17423082d9cee36b312a0c368b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
3697
Expires
Sat, 01 Apr 2023 18:11:04 GMT
info_psd2.svg
beautyfrench.com/CR/client/res/
47 KB
47 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/info_psd2.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
47772
Expires
Sun, 24 Mar 2024 18:11:04 GMT
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/
2 KB
2 KB
Image
General
Full URL
https://www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/telefono.jpg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.53.82.162 Terrassa, Spain, ASN57117 (RSI, ES),
Reverse DNS
162.red-195-53-82.customer.static.ccgg.telefonica.net
Software
/
Resource Hash
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Mon, 05 Nov 2018 02:20:38 GMT
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=89
Content-Length
1833
Content-Type
image/jpeg
loading.gif
beautyfrench.com/CR/client/res/
56 KB
56 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/loading.gif
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
923e03262d1069a5e8a5071a04359e6e356756d5116c4ed3a496861095c894da

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
57241
Expires
Mon, 24 Apr 2023 18:11:04 GMT
jq.js
beautyfrench.com/CR/client/res/cdns/
287 KB
85 KB
Script
General
Full URL
https://beautyfrench.com/CR/client/res/cdns/jq.js
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Expires
Sat, 01 Apr 2023 18:11:04 GMT
ga.js
www.google-analytics.com/
0
0

css
fonts.googleapis.com/
16 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400italic,600italic,700italic,400,700,600
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a125f56731750f15001719ac3c2b9ee3beec5bc37c3c21b46eef08c53c7fa07f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 25 Mar 2023 18:11:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 25 Mar 2023 17:49:28 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 25 Mar 2023 18:11:04 GMT
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 25 Mar 2023 18:05:11 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
353
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17168
expires
Sat, 25 Mar 2023 20:05:11 GMT
logo-ruralvia-mantenimiento.svg
beautyfrench.com/CR/client/res/
12 KB
12 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/logo-ruralvia-mantenimiento.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
12062
Expires
Sun, 24 Mar 2024 18:11:04 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/
44 KB
44 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400italic,600italic,700italic,400,700,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://beautyfrench.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 21 Mar 2023 08:37:39 GMT
x-content-type-options
nosniff
age
380005
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44856
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:20:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 20 Mar 2024 08:37:39 GMT
eye-view-mantenimiento.svg
beautyfrench.com/CR/client/res/
2 KB
3 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/eye-view-mantenimiento.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2239
Expires
Sun, 24 Mar 2024 18:11:04 GMT
arrow-mantenimiento.svg
beautyfrench.com/CR/client/res/
964 B
1 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/arrow-mantenimiento.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
964
Expires
Sun, 24 Mar 2024 18:11:04 GMT
icon-info.svg
beautyfrench.com/CR/client/res/
683 B
1 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/icon-info.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f

Request headers

Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
Origin
https://beautyfrench.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
683
Expires
Sun, 24 Mar 2024 18:11:04 GMT
ico-warning-mantenimiento.svg
beautyfrench.com/CR/client/res/
2 KB
2 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/ico-warning-mantenimiento.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1890
Expires
Sun, 24 Mar 2024 18:11:04 GMT
aviso.svg
beautyfrench.com/CR/client/res/
2 KB
2 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/aviso.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Last-Modified
Tue, 07 Mar 2023 20:12:00 GMT
Server
Apache
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
2119
Expires
Sun, 24 Mar 2024 18:11:04 GMT
contacto.svg
beautyfrench.com/CR/client/res/
3 KB
3 KB
Image
General
Full URL
https://beautyfrench.com/CR/client/res/contacto.svg
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/res/rviaLogin.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
145.239.64.186 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3081215.ip-145-239-64.eu
Software
Apache /
Resource Hash
8034234d8d9abf6f2997c7c5bf9fa0311e3a99b1d9add9890ffb8e9b3f7c8e84

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/CR/client/res/rviaLogin.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Sat, 25 Mar 2023 18:11:04 GMT
Server
Apache
Transfer-Encoding
chunked
P3P
CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Status
404 Not Found
Content-Type
text/html; charset=utf-8
Connection
Keep-Alive
Powered-By
PrestaShop
Keep-Alive
timeout=5, max=95
ga-audiences
www.google.nl/ads/
Redirect Chain
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1812749955&utmhn=beautyfrench.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caj...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955&slf_rd=1&random=1698337936
42 B
408 B
Image
General
Full URL
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955&slf_rd=1&random=1698337936
Requested by
Host: beautyfrench.com
URL: https://beautyfrench.com/CR/client/login.php
Protocol
H2
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://beautyfrench.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 25 Mar 2023 18:11:04 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 25 Mar 2023 18:11:04 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2136395696.1679767864&jid=1198385848&_v=5.7.2&z=1812749955&slf_rd=1&random=1698337936
content-type
text/html; charset=UTF-8
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google-analytics.com
URL
http://www.google-analytics.com/ga.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Grupo Caja Rural (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| _gaq function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility function| $ function| jQuery function| sendLogin object| _gat object| gaGlobal

10 Cookies

Domain/Path Name / Value
itsssl.com/ Name: PHPSESSID
Value: 5770c62ca0746980e96a4ec1814b3347
itsssl.com/ Name: short_HSjNn
Value: 1
beautyfrench.com/ Name: PHPSESSID
Value: rsp67ojhvfvgvhe6r052p6b5sn
.beautyfrench.com/ Name: __utma
Value: 234032397.2136395696.1679767864.1679767864.1679767864.1
.beautyfrench.com/ Name: __utmc
Value: 234032397
.beautyfrench.com/ Name: __utmz
Value: 234032397.1679767864.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.beautyfrench.com/ Name: __utmt
Value: 1
.beautyfrench.com/ Name: __utmb
Value: 234032397.1.10.1679767864
.beautyfrench.com/ Name: PrestaShop-8d0e7b10dfe395c15e55ceb0f43fe4de
Value: gkyNSxfb%2BQG%2Bp4pMzaLjFr4aW6qk%2BGB8GOeD2Khcao1SG4SbfJhFQHdpdBn5Ch1r%2Bx45dwSS3Y2fqHLFbO%2FTg9SUBq8svU4wH8RATKz1gtct42otHBSxHVBhrIxkDzACQg1TmRWkbqGwf2WfejDJKXF2Jx3dHdKjOGnU4j4EEqaXNF8iu8Hqkt2psr%2BotAtioJtYjP6rHYCc3b19bFKEXbG0L%2FJdfTSda56LuLvJTME%3D000170
.beautyfrench.com/ Name: PrestaShop-75ea9b83ebb45eedc461c67aee6b38a3
Value: gkyNSxfb%2BQG%2Bp4pMzaLjFr4aW6qk%2BGB8GOeD2Khcao0TPEoAxMhF%2BdlQAm%2FCbVn1NKAOoMI8m1mW%2F4wSypLjGl0xXOh21%2BEx43eYN3FTkUk%3D000078

2 Console Messages

Source Level URL
Text
security error URL: https://beautyfrench.com/CR/client/login.php
Message:
Mixed Content: The page at 'https://beautyfrench.com/CR/client/login.php' was loaded over HTTPS, but requested an insecure script 'http://www.google-analytics.com/ga.js'. This request has been blocked; the content must be served over HTTPS.
network error URL: https://beautyfrench.com/CR/client/res/contacto.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beautyfrench.com
fonts.googleapis.com
fonts.gstatic.com
itsssl.com
ssl.google-analytics.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.nl
www.ruralvia.com
www.google-analytics.com
145.239.64.186
195.53.82.162
2a00:1450:4001:806::2003
2a00:1450:4001:812::2003
2a00:1450:4001:828::200a
2a00:1450:4001:82f::2008
2a00:1450:4001:830::2004
2a00:1450:400c:c06::9a
2a06:98c1:3121::3
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
246c037026a7a16b204b4688fbcf320b35d95b17423082d9cee36b312a0c368b
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
8034234d8d9abf6f2997c7c5bf9fa0311e3a99b1d9add9890ffb8e9b3f7c8e84
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
923e03262d1069a5e8a5071a04359e6e356756d5116c4ed3a496861095c894da
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a125f56731750f15001719ac3c2b9ee3beec5bc37c3c21b46eef08c53c7fa07f
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f143f88d3952e78a275a6bbe19574c90508dc1e74c10e0b51ed8f0f9f9bb34c4