{"report_id":"737b60bd-373f-41f9-9e91-df31616eef3f","version":0,"status":"done","tags":[],"date":"2026-06-13T17:07:53Z","url":{"schema":"http","addr":"backstagecosmetix.com/","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"ip":{"addr":"23.227.38.65","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"final":{"url":{"schema":"https","addr":"backstagecosmetix.com/password","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"title":"Something went wrong","dom":{"size":12032,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9ff37f679211918d533d4f3175380001","sha1":"627bab400fee5611e5f261cb03bfb2d7fa8207d3","sha256":"fb4a998d6f9b6ab6662dc3720fb39bfc12cba8936b30778b06a0f5a1305ad961","sha512":"99e8615a12109d9ebe0dd8d0c03e11d5ce0def5e1fcb693f5e775ac41a977da6bb36a0d664fa2774e0c310c475701711764d001d9fa78fb0ec38768f7f13cc4e","ssdeep":"192:ZPEgFeZI+mYcIqvs1SepAeUaJ7h/ftfzXVo3WX0lVvuaivsUyczfoKEloVcH7wD0:KHhhXVP0lRuaUsUyczfR9y8GwM","tlshash":"08426265cab20947128621587be2767571184127cf8eb8dc3a8de30c0fcde8e96f579e","dom_hash":"domhash4eccbb7e6b858696e30e3f26ac70fac0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"backstagecosmetix.com/","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"ip":{"addr":"23.227.38.65","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-18T17:07:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-13","alert":"Sinkholed","trigger":"backstagecosmetix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"backstagecosmetix.com","ip":{"addr":"23.227.38.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"domain_registered":"2024-10-19","domain_rank":0,"first_seen":"2026-06-13T17:07:53.570705Z","last_seen":"2026-06-13T17:07:53.570705Z","alert_count":3,"request_count":3,"received_data":15857,"sent_data":2271,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"backstagecosmetix.com/","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"ip":{"addr":"23.227.38.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-13T17:07:30.561Z","timestamp":1781370450561,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"backstagecosmetix.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 15:55:34 GMT","end":"Sun, 30 Aug 2026 15:55:33 GMT"},"fingerprint":{"sha1":"27:E7:3C:06:4A:47:32:EC:DE:71:FB:D9:7B:2E:CB:E5:22:35:6E:D7","sha256":"9E:92:70:1A:26:4B:70:12:67:89:4A:62:8C:38:51:7C:D3:29:B9:8A:24:9B:14:87:3A:76:87:69:BF:3F:EC:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: backstagecosmetix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Sat, 13 Jun 2026 17:07:30 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 0\r\nlocation: https://backstagecosmetix.com/password\r\nx-permitted-cross-domain-policies: none\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nshopify-complexity-score: 480\r\nshopify-complexity-score-v2: 48\r\nset-cookie: _shopify_essential=:AZ7B8_MqAAEA4pkURYrmjDYacmeSjvU13TGwjAGwBNP0lKp6lbtkSqFaBk3yCsC9__RRbZpOlOuV4nARTzW_wNSLlhDMMWa656PL6EQWQTdtQgIIZ5YcZbkhQizV9T20M5vrgvV9zJrX9ouSPC9_cmv3WKJbCjfWnbm40Hc9-Kb4dH3YHzMImW9V2rcFka6zGUGJAWYVSBQ84e318miSJV7UEW2UCsnWA7U6sLfoHsiZTRUEzk-y9l941VRNuE4BHz8llN5llFqWaiCvNoLOwb0MNlwtadg_RQfPGs6urb1xXfmLGCAhww3fyh96mK4wJ2sJZzQKb8XD-zp8ER6GFeD4C8UbOBweKgHYKVK0y6jlQmCD6ZVx:; Max-Age=31536000; Path=/; HttpOnly; Secure; Priority=High; SameSite=Lax\r\nx-frame-options: DENY\r\ncontent-security-policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=7889238\r\nvary: Accept\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: private, no-store\r\npowered-by: Shopify\r\nserver-timing: processing;dur=52;desc=\"gc:1\", db;dur=20, asn;desc=\"50304\", edge;desc=\"OSL\", country;desc=\"NO\", theme;desc=\"127834062981\", pageType;desc=\"index\", servedBy;desc=\"dkqf\", requestID;desc=\"80115ca9-8f60-418e-9a19-77e287eb9b94-1781370450\", _y;desc=\"b750ed2d-fc94-4c58-b4c3-8207faace4bc\", _s;desc=\"fefc791a-7b78-409a-bdbe-27aa8ddec090\", _cmp;desc=\"3s.AMP_NO02_f_f_DZoaCqe*RhqVpSG00-bV0g\"\r\nx-download-options: noopen\r\nx-dc: gcp-europe-west4,gcp-europe-west1,gcp-europe-west1\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bl2NHjWy6txF0OT5HFNBEOitXXroyJuQV5H0sBLBg4dGOIAstz5q7hP3%2FSPRD2e18JUfhHQ9fCrZz4kHGMIjgAbaFBWUhP5TkbqhaAxJoJq1yJ0ur1G4RBN2HobXLklFYG3zXCrTXg%3D%3D\"}]}\r\nx-content-type-options: nosniff\r\nx-request-id: 80115ca9-8f60-418e-9a19-77e287eb9b94-1781370450\r\ncf-ray: a0b2b1246cc156bd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-13T19:33:38.803897Z","times_seen":16394044,"resource_available":true,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":42,"connect":1,"send":0,"wait":179,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-13","alert":"Sinkholed","trigger":"backstagecosmetix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"backstagecosmetix.com/password","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"ip":{"addr":"23.227.38.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-13T17:07:30.852Z","timestamp":1781370450852,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"backstagecosmetix.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 15:55:34 GMT","end":"Sun, 30 Aug 2026 15:55:33 GMT"},"fingerprint":{"sha1":"27:E7:3C:06:4A:47:32:EC:DE:71:FB:D9:7B:2E:CB:E5:22:35:6E:D7","sha256":"9E:92:70:1A:26:4B:70:12:67:89:4A:62:8C:38:51:7C:D3:29:B9:8A:24:9B:14:87:3A:76:87:69:BF:3F:EC:50"}}},"request":{"raw":"GET /password HTTP/1.1\r\nHost: backstagecosmetix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: _shopify_essential=:AZ7B8_MqAAEA4pkURYrmjDYacmeSjvU13TGwjAGwBNP0lKp6lbtkSqFaBk3yCsC9__RRbZpOlOuV4nARTzW_wNSLlhDMMWa656PL6EQWQTdtQgIIZ5YcZbkhQizV9T20M5vrgvV9zJrX9ouSPC9_cmv3WKJbCjfWnbm40Hc9-Kb4dH3YHzMImW9V2rcFka6zGUGJAWYVSBQ84e318miSJV7UEW2UCsnWA7U6sLfoHsiZTRUEzk-y9l941VRNuE4BHz8llN5llFqWaiCvNoLOwb0MNlwtadg_RQfPGs6urb1xXfmLGCAhww3fyh96mK4wJ2sJZzQKb8XD-zp8ER6GFeD4C8UbOBweKgHYKVK0y6jlQmCD6ZVx:\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 503 \r\ndate: Sat, 13 Jun 2026 17:07:31 GMT\r\ncontent-type: text/html\r\nx-permitted-cross-domain-policies: none\r\nretry-after: 130\r\nx-xss-protection: 1; mode=block\r\nx-download-options: noopen\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0J2KJsjka7AB0wrXc1wLc6aMaQE5%2FNVt4tRbXuLClviuPFwd4DNdFR2DRbSkia3kZTMv4BcE5xt9dPK%2F6og%2BW31O%2Bw3oVpzbgPjRKDWFeyEk3jNijkxdlS6ru8lnhBOYBgL0v4TRXg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nx-dc: gcp-europe-west4,gcp-us-central1\r\nx-request-id: 8d57c6e5-197d-410b-99ed-c2d8c9f4e4be-1781370450\r\nserver: cloudflare\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0b2b125de3a56bd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12194,"size_decoded":12989,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"137eb29dccad9ca79a3d5b6533324c04","sha1":"b7a36273fdb14bc13b5d09a127896983e880897b","sha256":"894aee4267a8466fbaca6966e7d9f70d77eb25ba4ad253172a91bb8144e943ab","sha512":"7567f8a681463a924e6d53bf1ebc16582f1c4bf9399988e62c280c3fa0a85c8a9232fab4429a176163a3aacc14804556b01b8ee0ff7b5c32d41f78d8c232b824","ssdeep":"192:5PEgFeZI+mYcIqvs1SepAeUaJ7h/ftfzXVo3WX0lVvuaivsUyczfoKEloVcH7wD0:qHhhXVP0lRuaUsUyczfR9y8GwM","tlshash":"2e426365cab20947118611487be276757118412bdf8eb8dc3a8de30c0fcce9e96f569e","first_seen":"2023-05-16T07:20:02Z","last_seen":"2026-06-13T17:07:55.140774Z","times_seen":181,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-13","alert":"Sinkholed","trigger":"backstagecosmetix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"backstagecosmetix.com/favicon.ico","fqdn":"backstagecosmetix.com","domain":"backstagecosmetix.com","tld":"com"},"ip":{"addr":"23.227.38.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://backstagecosmetix.com/password","date":"2026-06-13T17:07:31.517Z","timestamp":1781370451517,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"backstagecosmetix.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 01 Jun 2026 15:55:34 GMT","end":"Sun, 30 Aug 2026 15:55:33 GMT"},"fingerprint":{"sha1":"27:E7:3C:06:4A:47:32:EC:DE:71:FB:D9:7B:2E:CB:E5:22:35:6E:D7","sha256":"9E:92:70:1A:26:4B:70:12:67:89:4A:62:8C:38:51:7C:D3:29:B9:8A:24:9B:14:87:3A:76:87:69:BF:3F:EC:50"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: backstagecosmetix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: _shopify_essential=:AZ7B8_MqAAEA4pkURYrmjDYacmeSjvU13TGwjAGwBNP0lKp6lbtkSqFaBk3yCsC9__RRbZpOlOuV4nARTzW_wNSLlhDMMWa656PL6EQWQTdtQgIIZ5YcZbkhQizV9T20M5vrgvV9zJrX9ouSPC9_cmv3WKJbCjfWnbm40Hc9-Kb4dH3YHzMImW9V2rcFka6zGUGJAWYVSBQ84e318miSJV7UEW2UCsnWA7U6sLfoHsiZTRUEzk-y9l941VRNuE4BHz8llN5llFqWaiCvNoLOwb0MNlwtadg_RQfPGs6urb1xXfmLGCAhww3fyh96mK4wJ2sJZzQKb8XD-zp8ER6GFeD4C8UbOBweKgHYKVK0y6jlQmCD6ZVx:\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ndate: Sat, 13 Jun 2026 17:07:31 GMT\r\ncontent-length: 0\r\nx-xss-protection: 1; mode=block\r\nx-permitted-cross-domain-policies: none\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nx-download-options: noopen\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T5962yQaJrtEBW5qwRTpb19TNls21%2FJOy7hnn994QgXOxl%2BnM9gRlH9nlb%2FFIfr08Ev8LhWYbFYaDEppPReRWe0kn7e%2FK%2BRtpHCErs8CoipAzDQ6CmmOCZLrwd0nAsYzTvsldXvluQ%3D%3D\"}]}\r\nx-dc: gcp-europe-west4,gcp-europe-west1,gcp-europe-west1\r\nx-request-id: ab325629-3678-4779-be87-560f27a6a279-1781370451\r\nserver: cloudflare\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a0b2b129fa4a0b55-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":816,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-13T19:33:38.803897Z","times_seen":16394044,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-13","alert":"Sinkholed","trigger":"backstagecosmetix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}