![](/screenshots/6d2d7bcb-d1e4-4508-902e-0e8485b4e605.png)
veryhelpful.info
Open in
urlscan Pro
104.24.106.24
Malicious Activity!
Public Scan
Effective URL: https://veryhelpful.info/c0nfm0d3lscad/access.php
Submission: On January 22 via manual from CA
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 16th 2018. Valid for: 6 months.
This is the only time veryhelpful.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.31.87.133 104.31.87.133 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 13 | 104.24.106.24 104.24.106.24 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
13 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
hollanews.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
veryhelpful.info |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
veryhelpful.info
1 redirects
veryhelpful.info |
91 KB |
1 |
hollanews.com
hollanews.com |
479 B |
13 | 2 |
Domain | Requested by | |
---|---|---|
13 | veryhelpful.info |
1 redirects
veryhelpful.info
|
1 | hollanews.com | |
13 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
apps4.ams-sga.cra-arc.gc.ca |
www.cra-arc.gc.ca |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni812574.cloudflaressl.com GlobalSign CloudSSL CA - SHA256 - G3 |
2018-01-10 - 2018-03-31 |
3 months | crt.sh |
sni174702.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-01-16 - 2018-07-25 |
6 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://veryhelpful.info/c0nfm0d3lscad/access.php
Frame ID: (3CCFFCC361AA933034855C85B0B09C06)
Requests: 11 HTTP requests in this frame
Frame:
https://veryhelpful.info/c0nfm0d3lscad/assets/sig-en.svg
Frame ID: (9AB93C657E58222049546EB4DC3DC409)
Requests: 1 HTTP requests in this frame
Frame:
https://veryhelpful.info/c0nfm0d3lscad/assets/wmms.svg
Frame ID: (F51973A88998DA4EADB10280CFDC9663)
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/6d2d7bcb-d1e4-4508-902e-0e8485b4e605.png)
Page URL History Show full URLs
- https://hollanews.com/r3dyf0rCaD/ Page URL
-
https://veryhelpful.info/c0nfm0d3lscad/
HTTP 302
https://veryhelpful.info/c0nfm0d3lscad/access.php Page URL
Detected technologies
Detected patterns
- headers server /cloudflare/i
Detected patterns
- script /jquery.*\.js/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Fran�ais
Search URL Search Domain Scan URL
Title: Terms and conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://hollanews.com/r3dyf0rCaD/ Page URL
-
https://veryhelpful.info/c0nfm0d3lscad/
HTTP 302
https://veryhelpful.info/c0nfm0d3lscad/access.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
hollanews.com/r3dyf0rCaD/ |
145 B 479 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
access.php
veryhelpful.info/c0nfm0d3lscad/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wet-boew.css
veryhelpful.info/c0nfm0d3lscad/assets/ |
182 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.css
veryhelpful.info/c0nfm0d3lscad/assets/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
veryhelpful.info/c0nfm0d3lscad/assets/ |
2 KB 1005 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
veryhelpful.info/c0nfm0d3lscad/assets/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timeout.css
veryhelpful.info/c0nfm0d3lscad/assets/ |
428 B 394 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-leaf.jpg
veryhelpful.info/c0nfm0d3lscad/assets/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-bg.jpg
veryhelpful.info/c0nfm0d3lscad/assets/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sft-deco.gif
veryhelpful.info/c0nfm0d3lscad/assets/ |
80 B 184 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sft-deco-leaf.gif
veryhelpful.info/c0nfm0d3lscad/assets/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sig-en.svg
veryhelpful.info/c0nfm0d3lscad/assets/ Frame (9AB |
11 KB 11 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmms.svg
veryhelpful.info/c0nfm0d3lscad/assets/ Frame (F51 |
5 KB 5 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| checkLuhn function| checkSin2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
veryhelpful.info/ | Name: PHPSESSID Value: u9cq7jkjgdkgbs0lchne5s1u30 |
|
.veryhelpful.info/ | Name: __cfduid Value: d51c2e8735850923a76e199c266780c3d1516636245 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
hollanews.com
veryhelpful.info
104.24.106.24
104.31.87.133
23e9b9b1a670cb39c7f6e7bedad520d51704986e543fb9ccbcce219966d9e927
352e74be133b2633ede15ab1d9f60703978fe5c748571d79df4eb5b78cc11bdd
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
447a4a6c6d785d6fc009367d1fd835b3245114e3162a5dafe288ea54ffd7e0c7
4abb822643a858c9b438cad647548f83e2212ae25f714b11a436360bb507dcac
508d1167367486f2f605cdd5f2c5ff7ace65576343c9b492622b61abf160e266
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
546cf8ce8330bb243f37c8be0f73230a352d0aae0e911982471fca8d84c74eaf
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
79dd1a03ecd39468cdcd0f1b60cef4b717a0f9270392ff14b95f28b4025e9e2b
8f977a0316128ef82012696dd5c0e2325fe894451eff1e54b9677e66efcf539d
93c11c985807fa11dee8e93dabece88c3b74c1e945fa8911c032e75ddd2a6f2d