bellina.pl - URL scan, 24 Aug 2026

MalwareAnalyzer by Cyble scanned bellina.pl and returned a unknown verdict (score -2), categorised as credential-harvest. The page resolved to 77.79.227.242 on ATMAN Network ECO-Servers in PL. The domain was registered 309 days ago through DD sp. z o.o.. 4 domains and 1 IP were contacted. 6 malware samples communicate with this URL (Phishing). The request followed 2 redirects before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.

Scan result

• Verdict: unknown (score -2) · Confidence 8%
• Scanned URL: http://bellina.pl/userfiles/file/430101152.pdf
• Domain: bellina.pl · IP: 77.79.227.242 · AS57367 · PL
• Server: Caddy
• Page title: Oferta domeny bellina.pl
• HTTP status: 200 · text/html; charset=utf-8
• Registrar: DD sp. z o.o. · domain age 309 days · created 2025-10-18
• Registrant country: PL
• TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Nov 10 01: · subject CN=bellina.pl
• Evidenced operator: DD sp. z o. o.
• Scan tier: standard · observed 2026-08-24 04:11:19 UTC

Redirect chain

1. http://bellina.pl/userfiles/file/430101152.pdf
2. https://bellina.pl/userfiles/file/430101152.pdf
3. https://bellina.pl/

Malware communicating with this URL (6)

These samples were observed contacting or being served from bellina.pl. Each links to its full analysis.

• Phishing - referenced · fc2e5e515ba14e071033c783c2f45e8c · first seen 2026-08-23
• Phishing - referenced · 739c3141f591fa0fd90b2ba86c98dc75 · first seen 2026-08-21
• Phishing - referenced · 03f566be3c3f10d64a2af528fa7899cb · first seen 2026-08-17
• Phishing - referenced · 1935192f7c55ae8617be95424644bb24 · first seen 2026-08-16
• Phishing - referenced · 7cf940f56680805da4b9344c422a6fce · first seen 2026-08-14
• Phishing - referenced · f7be6768c396ca4a313d413fcaf1d3e4 · first seen 2026-08-13

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Categories

• credential-harvest

Why this verdict

• Valid TLS, no impersonation or off-origin credential post
• Credential-harvesting form

Detected technologies

• Caddy

Contacted infrastructure

• 77.79.227.242 - AS57367 ATMAN Network ECO-Servers (Poland)

Observed indicators

• bellina.pl
• fonts.googleapis.com
• fonts.gstatic.com
• ddregistrar.pl
• 77.79.227.242
• https://bellina.pl/
• https://fonts.googleapis.com/
• https://fonts.gstatic.com/
• https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap
• https://bellina.pl/static/fav/favicon.ico
• https://bellina.pl/static/fav/favicon-32x32.png
• https://bellina.pl/static/fav/favicon-16x16.png
• https://bellina.pl/static/fav/apple-touch-icon.png
• https://bellina.pl/static/fav/android-chrome-192x192.png
• https://bellina.pl/static/fav/android-chrome-512x512.png
• https://ddregistrar.pl/regulamin/polityka-prywatnosci/
• https://ddregistrar.pl/

Other scans of bellina.pl (2)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 23 Aug 2026 - unknown
• 17 Aug 2026 - unknown

Questions about bellina.pl

Is bellina.pl safe?

The scan of bellina.pl on 24 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with bellina.pl?

6 analysed samples communicate with this URL, including Phishing.

How was bellina.pl checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of bellina.pl

Scanned on MalwareAnalyzer by Cyble · Open interactive scan