urlscan.io logo urlscan.io
SecurityTrails logo

hsso.helcim.com Open in urlscan Pro
172.64.145.234  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://dashboard.helcim.com/?t=savings-block
Effective URL: https://hsso.helcim.com/login
Submission Tags: 0xscam
Submission: On January 05 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 172.64.145.234, located in United States and belongs to CLOUDFLARENET, US. The main domain is hsso.helcim.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 1st 2023. Valid for: a year.
This is the only time hsso.helcim.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 172.64.145.234 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.18.42.22 13335 (CLOUDFLAR...)
6 4
Apex Domain
Subdomains		 Transfer
4 helcim.com
dashboard.helcim.com
hsso.helcim.com
96 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 4701
12 KB
6 2
Domain Requested by
3 hsso.helcim.com hsso.helcim.com
2 challenges.cloudflare.com hsso.helcim.com
challenges.cloudflare.com
1 dashboard.helcim.com 1 redirects
6 3

This site contains no links.

Subject Issuer Validity Valid
helcim.com
Cloudflare Inc ECC CA-3		 2023-04-01 -
2024-03-31		 a year crt.sh
challenges.cloudflare.com
Cloudflare Inc ECC CA-3		 2023-08-18 -
2024-08-17		 a year crt.sh

This page contains 2 frames:

Primary Page: https://hsso.helcim.com/login
Frame ID: 8F484479DDB13614FEA4D93E366C55AF
Requests: 6 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ftxk0/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: E3DED434D32E40873170161B76FE2509
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Cloudflare Notice

Page URL History Show full URLs

  1. https://dashboard.helcim.com/?t=savings-block HTTP 302
    https://hsso.helcim.com/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

116 kB
Transfer

267 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dashboard.helcim.com/?t=savings-block HTTP 302
    https://hsso.helcim.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
hsso.helcim.com/
Redirect Chain
  • https://dashboard.helcim.com/?t=savings-block
  • https://hsso.helcim.com/login
43 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hsso.helcim.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.145.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca6006e52609a94cc3ae2bc88f8f1e2e4363c78e2e0426439037eb2fbe1fd407
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated
challenge
cf-ray
84082fab687e5d6d-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Fri, 05 Jan 2024 02:10:40 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
84082fa90fd75d6d-FRA
content-security-policy
script-src 'self' 'self' 'unsafe-eval' 'sha256-xAgUcM2RDtrgpEOdaKbfqMyCTwF2x9OCBP/qxtr0xyQ=' 'sha256-NstOaPoADQfZzy6WS4karM4cq7paMKkv0vNsX8JshE4=' 'sha256-rwMOiOeVICH7/Cjy5SkreID3OOi5HTrit357k22hUDQ=' 'sha256-+fTB7ndyp8AJVLIVku5Gipchzyx0UZr4O5+ET0qpFCc=' 'sha256-UWJlMLNRnSkHMjjUCjCuXIPfIBiZ/ZYEgi0qJ06zujc=' 'sha256-Ve0jpyGuaMUNty0N/ahsgjJxVd1XLtOraIDCaY1fZTA=' 'sha256-VIp6YHjmxtlZTGJNGGrA9s4xbXYkneKi6YRlIjDBQ0A=' 'sha256-GK5lswmmGzsOFFLNV1mv7DA9e+A/5fYToHsFEpv4+Pw=' 'sha256-O54ofw+GT0llr7Stt8/ICH/2tWUzm7YKv4Y/4GwwnY8=' 'sha256-dAMs3/Yp2SSUrhzjwbwLmPPB0soj/thHemUrM4u00O8=' https://www.googleadservices.com https://www.google-analytics.com https://www.google.com https://googleads.g.doubleclick.net https://www.googletagmanager.com https://analytics.google.com https://static.hotjar.com https://script.hotjar.com https://player.vimeo.com/api/player.js https://s.adroll.com https://d.adroll.com https://bat.bing.com https://*.clarity.ms https://connect.facebook.net https://snap.licdn.com https://static-exp1.licdn.com https://content.linkedin.com https://platform.linkedin.com https://www.redditstatic.com/ads/pixel.js https://analytics.twitter.com https://static.ads-twitter.com/uwt.js https://ads.nextdoor.com/public/pixel/ndp.js https://analytics.tiktok.com/i18n/pixel/ http://assets.kochava.com/kochava.js/v2.2/kochava.min.js https://*.taboola.com https://*.mountain.com https://cdn.pendo.io https://app.pendo.io/in-app-designer/latest/plugin.js 'sha256-1e5RR2OpHhuX2h0Bat19DsNTmqbo4M3T1pqfeTXCHaA=' 'nonce-zRKqgVELdAXzhvihD6YT3g=='; connect-src 'self' https://hub.helcim.com https://hsso.helcim.com https://unleash-proxy-d-bvu5heyaya-pd.a.run.app/proxy https://www.google-analytics.com https://stats.g.doubleclick.net https://cm.g.doubleclick.net https://ssl.google-analytics.com https://analytics.google.com *.google-analytics.com *.analytics.google.com https://google.com https://*.hotjar.com:* https://vc.hotjar.io:* https://surveystats.hotjar.io wss://*.hotjar.com https://d.adroll.com https://bat.bing.com https://*.clarity.ms *.linkedin.com *.licdn.com https://cdn.linkedin.oribi.io/ https://analytics.tiktok.com/api/v2/monitor https://analytics.tiktok.com/api/v2/pixel https://analytics.tiktok.com http://web-sdk.control.kochava.com/track/json https://*.taboola.com/ https://*.mountain.com 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 https://data.pendo.io https://cdn.pendo.io; form-action 'self' https://growth.helcim.com https://hub.helcim.com *.myhelcim.com https://hsso.helcim.com https://chargebacks.helcim.com; img-src 'self' data: https://cloud-files.helcim.com https://cloud-files.qa.helcim.com https://www.google-analytics.com https://googleads.g.doubleclick.net https://www.google.com https://www.googletagmanager.com https://www.google.ca/pagead/ https://www.google.ca/ads/ https://fonts.gstatic.com *.google-analytics.com *.analytics.google.com https://script.hotjar.com https://i.vimeocdn.com https://d.adroll.com https://ipv4.d.adroll.com https://x.bidswitch.net https://ups.analytics.yahoo.com https://sync.outbrain.com https://pixel.rubiconproject.com https://image2.pubmatic.com https://dsum-sec.casalemedia.com https://ib.adnxs.com https://eb2.3lift.com https://*.clarity.ms https://c.bing.com https://bat.bing.com https://www.facebook.com/tr/ *.linkedin.com p.adsymptotic.com https://alb.reddit.com https://analytics.twitter.com/i/adsct https://t.co/ https://flask.nextdoor.com/pixel https://q.quora.com/_/ad/136cded19f7e4d36a147c97be4b1c4aa/pixel https://*.taboola.com; frame-ancestors 'self' https://vars.hotjar.com;
content-type
text/html; charset=UTF-8
date
Fri, 05 Jan 2024 02:10:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
host
dashboard.helcim.com
location
https://hsso.helcim.com/login
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-forwarded-host
dashboard.helcim.com
x-frame-options
SAMEORIGIN
v1
hsso.helcim.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 		165 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hsso.helcim.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=84082fab687e5d6d
Requested by
Host: hsso.helcim.com
URL: https://hsso.helcim.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.145.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
329626b14a0d4d542d2c08608aebd807d49b9ccfe92baf15c06351b2a7928677
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hsso.helcim.com/login?__cf_chl_rt_tk=xmWcKRMaqQjdmwQ9cKbz_BtvlR1gTxyilldm.24g2v4-1704420640-0-gaNycGzNCyU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 02:10:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
cloudflare
content-type
application/javascript; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
84082faba88e5d6d-FRA
alt-svc
h3=":443"; ma=86400
truncated
/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c9fda06ac642e4a361bde5b5559252af5173221265e9f0f8ba43e11fd56c89e8

Request headers

Referer
Origin
https://hsso.helcim.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
font/woff2
api.js
challenges.cloudflare.com/turnstile/v0/g/74bd6362/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/74bd6362/api.js?onload=AudPIu1&render=explicit
Requested by
Host: hsso.helcim.com
URL: https://hsso.helcim.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=84082fab687e5d6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd9ac3177195b3d9537e0cf71222057ec70de67715715b570a80287ba78c8d3d

Request headers

Referer
Origin
https://hsso.helcim.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 02:10:40 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
84082fac78a5bb95-FRA
alt-svc
h3=":443"; ma=86400
3dd48c85-9947-4d8d-b713-d7504e1038e3
https://hsso.helcim.com/ 		13 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://hsso.helcim.com/3dd48c85-9947-4d8d-b713-d7504e1038e3
Requested by
Host: hsso.helcim.com
URL: https://hsso.helcim.com/login
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hsso.helcim.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Length
13
Content-Type
text/javascript
96a5df22c415c18
hsso.helcim.com/cdn-cgi/challenge-platform/h/g/flow/ov1/210613555:1704417794:TYC57qy07HXwZ34Heorv3cxfHdU9-ii__5WwbqFrckc/84082fab687e5d6d/ 		13 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hsso.helcim.com/cdn-cgi/challenge-platform/h/g/flow/ov1/210613555:1704417794:TYC57qy07HXwZ34Heorv3cxfHdU9-ii__5WwbqFrckc/84082fab687e5d6d/96a5df22c415c18
Requested by
Host: hsso.helcim.com
URL: https://hsso.helcim.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=84082fab687e5d6d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.42.22 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67b2eb33247dae430e79b4581740e84b442a89111b06711a22434f9f2aa46e7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://hsso.helcim.com/login
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
CF-Challenge
96a5df22c415c18
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 05 Jan 2024 02:10:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
server
cloudflare
content-type
text/plain; charset=UTF-8
cf-ray
84082fac89a54d7c-FRA
alt-svc
h3=":443"; ma=86400
cf-chl-gen
9fRi7eQwi5HASC/a2cFhwCMLNsNbJwQGaUG+tFbCdogAOnT2rI05e2T2aOBCkgsA$7lGYhuudlFoQlhwrcBxA3g==
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ftxk0/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame E3DE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ftxk0/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/74bd6362/api.js?onload=AudPIu1&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
84082facec753600-FRA
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Fri, 05 Jan 2024 02:10:40 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture object| _cf_chl_opt function| xhdnH2 function| uyerU4 function| mFRV5 object| slYiJ6 function| AudPIu1 boolean| OicSkZ8 function| CvPaDC3 function| YnUCnReuQm function| BzDe8 object| HrzfxP9 object| turnstile boolean| dYet6 string| kaBRYy1

2 Cookies

Domain/Path Name / Value
dashboard.helcim.com/ Name: PHPSESSID
Value: br3nkudebtjh902vstvcmpop01
.helcim.com/ Name: __cf_bm
Value: W1xhq01XHqYKyEqN389V.Rgz2alL5c3BOnQjEZCu3W0-1704420640-1-AUAo/29IaFoy4SZW4ZSUMPM20jXCwg0XLodNJg83bhUxXiG5XkXSF75xAHy14wm8+lmDqDmOiCjmKQkFe3Myt36WMJJrczo/o83EmvfVA9a4

3 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://hsso.helcim.com/login
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN