urlscan.io logo urlscan.io
SecurityTrails logo

helpid2849238459203423.com Open in urlscan Pro
104.21.5.85  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://is.gd/7GqUT1
Effective URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Submission: On March 31 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 14 HTTP transactions. The main IP is 104.21.5.85, located in and belongs to CLOUDFLARENET, US. The main domain is helpid2849238459203423.com.
TLS certificate: Issued by R3 on March 30th 2023. Valid for: 3 months.
This is the only time helpid2849238459203423.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 1 104.25.233.53 13335 (CLOUDFLAR...)
6 104.21.5.85 13335 (CLOUDFLAR...)
1 151.101.1.229 54113 (FASTLY)
1 104.18.23.52 13335 (CLOUDFLAR...)
1 74.125.68.95 15169 (GOOGLE)
5 172.64.168.22 13335 (CLOUDFLAR...)
14 5
1    104.25.233.53 (United States)

ASN13335 (CLOUDFLARENET, US)
is.gd
6    104.21.5.85 (None, )

ASN13335 (CLOUDFLARENET, US)
helpid2849238459203423.com
1    151.101.1.229 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    104.18.23.52 (None, )

ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com
1    74.125.68.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f95.1e100.net
ajax.googleapis.com
5    172.64.168.22 (United States)

ASN13335 (CLOUDFLARENET, US)
ka-f.fontawesome.com
Apex Domain
Subdomains		 Transfer
6 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1666
ka-f.fontawesome.com — Cisco Umbrella Rank: 3207
182 KB
6 helpid2849238459203423.com
helpid2849238459203423.com
68 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 357
31 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374
26 KB
1 is.gd
is.gd — Cisco Umbrella Rank: 50270
157 B
14 5
Domain Requested by
6 helpid2849238459203423.com helpid2849238459203423.com
5 ka-f.fontawesome.com kit.fontawesome.com
helpid2849238459203423.com
1 ajax.googleapis.com helpid2849238459203423.com
1 kit.fontawesome.com helpid2849238459203423.com
1 cdn.jsdelivr.net helpid2849238459203423.com
1 is.gd 1 redirects
14 6

This site contains no links.

Subject Issuer Validity Valid
*.helpid2849238459203423.com
R3		 2023-03-30 -
2023-06-28		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-22 -
2023-12-23		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-13 -
2023-06-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-12 -
2023-08-12		 a year crt.sh

This page contains 2 frames:

Primary Page: https://helpid2849238459203423.com/pageclid=79456210094198555/
Frame ID: 9F04BE5F05AD49BD281C3729202564ED
Requests: 11 HTTP requests in this frame

Frame: https://helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680220800
Frame ID: 68148EAE2B3E63A177C612FF28C99854
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meta

Page URL History Show full URLs

  1. https://is.gd/7GqUT1 HTTP 301
    https://helpid2849238459203423.com/pageclid=79456210094198555/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

306 kB
Transfer

870 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://is.gd/7GqUT1 HTTP 301
    https://helpid2849238459203423.com/pageclid=79456210094198555/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
helpid2849238459203423.com/pageclid=79456210094198555/
Redirect Chain
  • https://is.gd/7GqUT1
  • https://helpid2849238459203423.com/pageclid=79456210094198555/
286 KB
34 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.0.28
Resource Hash
3699a0c5dfe18cfd1240441194b2776e96e168035ef9345c6095ee55b76fee3e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7b04c9580b12a835-SYD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 31 Mar 2023 01:23:22 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SPjlTdHavhhgee6y1F4DjDxZjxOSaRgCmckvYynXbRrUvfc%2BcMBIU0VbkgJgyNsXsbR23ua8i1FzPCzpnbUpRYCh0sc0%2Fs3B7nHHo8Fa490VmWoh52jDcIc%2Fq%2FF5CRpY%2BmQUqBLVlfcr%2Fy5sCA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/8.0.28
x-turbo-charged-by
LiteSpeed

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
7b04c9533a876a4b-SYD
content-type
text/html; charset=UTF-8
date
Fri, 31 Mar 2023 01:23:20 GMT
location
https://helpid2849238459203423.com/pageclid=79456210094198555/
server
cloudflare
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.4.1/dist/css/ 		156 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@4.4.1/dist/css/bootstrap.min.css
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://helpid2849238459203423.com/
Origin
https://helpid2849238459203423.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 31 Mar 2023 01:23:22 GMT
x-content-type-options
nosniff
content-encoding
br
age
1189402
x-jsd-version
4.4.1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
26116
x-served-by
cache-fra-eddf8230099-FRA, cache-syd10172-SYD
x-jsd-version-type
version
etag
W/"26f1b-0wURD7eRE6lhOUtDPYUaNBA0K4w"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
83fd8385f7.js
kit.fontawesome.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/83fd8385f7.js
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.23.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36da8ad26974d552b901a75e671363718cb8f7ae80ca5d5674fe83444e0fdbc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://helpid2849238459203423.com/
Origin
https://helpid2849238459203423.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
strict-transport-security
max-age=31536000; preload
content-encoding
gzip
cf-cache-status
REVALIDATED
server
cloudflare
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=60, public, must-revalidate
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-ray
7b04c960db5eaae7-SYD
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
F1FUCJNKIPk1EfAtwuoB
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.68.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sc-in-f95.1e100.net
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 27 Mar 2023 06:50:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
325997
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Mar 2024 06:50:05 GMT
newlogo.jpg
helpid2849238459203423.com/pageclid=79456210094198555/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://helpid2849238459203423.com/pageclid=79456210094198555/newlogo.jpg
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91902273fcd34c1dc745a12fa2f41a840e8b37949bfef4de0abb1013951986c0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/pageclid=79456210094198555/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
9264
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
11042
last-modified
Wed, 08 Mar 2023 18:07:40 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CF9jpL0g2rOLL02cbBgzNgUUwgJmCvhvbEFk5Q%2BAKn4JHUZtBClkDCxMJ%2FBd8OQRwdxlf6BEyRhoRZsrT3rLlVQtZjAfQx5IDNHayU%2Bwff6bJP0vnt6aHWsnMVbBsQs5akNbPgSRt46atJe%2FVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7b04c961adb7a835-SYD
expires
Thu, 06 Apr 2023 22:48:58 GMT
newlogo1.png
helpid2849238459203423.com/pageclid=79456210094198555/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://helpid2849238459203423.com/pageclid=79456210094198555/newlogo1.png
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
096988abc603ffc3519d70d6dcb0475bb60b72f2e490c804f03fbf111074deab

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/pageclid=79456210094198555/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
9217
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
4645
last-modified
Wed, 08 Mar 2023 18:07:40 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXcGYS6k1A8ldoyBJt3eNYPj4Z2qSjdik6pNLYgK4GVwduHHNIdKzMaFnYtST8PZHWIwL%2Bk7gqdVjoYbB%2Bfan06Wzok5yMj%2FEzDeABSzUjeOSP7f6xReZpJoaci0Ucd5db4jI%2FR1KAeaemRzMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7b04c96269aeaabb-SYD
expires
Thu, 06 Apr 2023 22:49:45 GMT
free.min.css
ka-f.fontawesome.com/releases/v6.4.0/css/ 		100 KB
23 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.4.0/css/free.min.css?token=83fd8385f7
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/83fd8385f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.168.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
via
1.1 d0df64d562de4c38403b4237a12e579a.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
SIN52-C3
age
9264
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 23 Mar 2023 21:29:21 GMT
server
cloudflare
etag
W/"5febfb939e2fc4ddf14fffae53b72cf0"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FG%2BRL2AhZhuNSkLKguW4zVadEc3ema1lRlNJJYdbkY2TYWy3Dlreckpj%2FIZNbLERJmdzwt5wG5%2BfkUBlN6IiRtVaBzZQsayEvvK12uhfceXHjnaqPF3A50i1V1Vpt%2BTkQufQAsMEqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7b04c9648d0f4ca7-SIN
access-control-allow-headers
fa-kit-token
x-amz-cf-id
iuJMwtBWNdEkD5PGNVD3b_a1exHhv5dhNGpjPIPTxzxWaO6HBiSYNQ==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.4.0/css/ 		27 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-shims.min.css?token=83fd8385f7
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/83fd8385f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.168.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
via
1.1 d0df64d562de4c38403b4237a12e579a.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
SIN52-C3
age
9264
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 23 Mar 2023 21:29:20 GMT
server
cloudflare
etag
W/"5193a6de5225940ae4ef5f7c82126be9"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pvfFX6QCFEcnEqPhqvrCU%2B2zgtfW0DNK7B7IoUbTo8UzaaVcc3aKGT%2Fnm7WtgcyqbIKMBidsj%2BoMir7nVZgnLjihtKlq%2BA8tgFioneBizpMrSSQT8CEMhQenGGgRlu3lkLJON0K5yg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7b04c9648d114ca7-SIN
access-control-allow-headers
fa-kit-token
x-amz-cf-id
vFhjQxox628S5CUHhcZX9dywN-Ncmb2AbhlOceciVBBAXLxBsaC4FQ==
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.4.0/css/ 		823 B
714 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v5-font-face.min.css?token=83fd8385f7
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/83fd8385f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.168.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
via
1.1 ce37b125bad795f4918cd50b3f95260a.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
SIN52-C3
age
9264
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 23 Mar 2023 21:29:20 GMT
server
cloudflare
etag
W/"5856e3f07fbc36fc4d430a95a577a87f"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDRqL7faGlLr488hFia%2BTkgsOAGagDNMuKTRLto%2FQ%2B5bcvJupknu9r5Eq7exrDqj7Ae6w0Xig8XBcHQgewEubmXJt%2FW5MDg%2F9GkEDVvqxZ8AVGTxlkBMFmYgFzCSIeXqQDHvbPD1Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7b04c9648d124ca7-SIN
access-control-allow-headers
fa-kit-token
x-amz-cf-id
rH6W__p1muxQmaPUsVYxUvjnpZqoyMhHWJeJDd5IvP_9ORoASAyUjQ==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.4.0/css/ 		2 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-font-face.min.css?token=83fd8385f7
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/83fd8385f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.168.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://helpid2849238459203423.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:22 GMT
via
1.1 55c8386ba54fbe8ac7d89b90344d4344.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
SIN52-C3
age
9264
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 23 Mar 2023 21:29:20 GMT
server
cloudflare
etag
W/"9e7f9f634ace089bcdacc3fcc5f23ce5"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGD0khUPTSVkx1lCREQHqgnbn3I534PJ4KefROAVGNkU4kwYjKDH%2FB7zO1sRFiAG9avRtgvc5C8JkLbjkpKO4p%2Fgwv2T%2BuqScbHWr%2Bq%2BRZC3mdsJYoeqWsx%2BGZmi9Ia2ZfMhdn6R9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7b04c9648d134ca7-SIN
access-control-allow-headers
fa-kit-token
x-amz-cf-id
xE6894_L1JdTd1sb_5fJA5rpEmUnSG8TK6FOYS-xkRXhMbQSL8wCUw==
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.2.1/webfonts/ 		147 KB
148 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v6.2.1/webfonts/free-fa-solid-900.woff2
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.168.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1494e2691e1c13a3f35cbc3e1b56c5187c10ffe220d1fdc58d99494a666244d4

Request headers

Referer
https://helpid2849238459203423.com/
Origin
https://helpid2849238459203423.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:23 GMT
via
1.1 c2e4ac979e01c116ae8349b7d6d1489a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
SIN52-C3
age
9243
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
150500
last-modified
Mon, 14 Nov 2022 15:15:23 GMT
server
cloudflare
etag
"69a76555beae5c43a59559396c1aeb54"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z4OAdKlKYmZgdl4r5ENvIlg46ofzkYGEoCcNtmeKlO3zfnWIGsPCL7azt%2B3sb9wQPJ08evbWWM3O0344JAQvyo4GzdEoEdnHqf7i7POb7cmWXuBd%2Fo9IJBlsgCeDyU1qt7Ff1%2F%2B%2BXA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
accept-ranges
bytes
cf-ray
7b04c9666e4b4ca7-SIN
access-control-allow-headers
fa-kit-token
x-amz-cf-id
19y_i0mkkNu5vseOawEsER-6n-mcQNCx0UVDd7rFS0ENC5Rg4vbhZg==
invisible.js
helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 6814 		32 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680220800
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0331283191a92929d949571b63981812c490e4e3730533da110ff81f3877cda9

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:23 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oTSJIL0wy8ZFzBbrP2wD0gXpVGXRE93uI46gPYovc79vJjz6UlhAvhgwc5msDFYxnqK%2Bd6R%2BE9st0dkXfjZX8qfNWu456RI%2BGQnfLK5j6kcQ96DHApGm%2BwWQii4ErgMP0YTfYC%2BcXcDcEGlPLg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7b04c9663f5daabb-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 6814 		7 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/pageclid=79456210094198555/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b7717257921366fe675a5b6522c89ca347a13bc1b303917b1aa0e5efe12e0d7

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 01:23:23 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nZxHBFKyxw3443S4xQOESaFnppl%2FNvQTrnulYeOX7mNtemmosQnMa96dZQi4s1eT23m2fUb4jls1Li1Zf%2Fs%2Fu9qqI%2F%2B0P0Lva%2BHzyFxuScdmvvfyhtLAyEhTN3I6MUNIqE5li1xObfDjg2H%2B9g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7b04c9679979aabb-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
7b04c9580b12a835
helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 6814 		2 B
675 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/cv/result/7b04c9580b12a835
Requested by
Host: helpid2849238459203423.com
URL: https://helpid2849238459203423.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680220800
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.5.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 31 Mar 2023 01:23:23 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UgqMWdMUN5EklvpJT9Hv7zOtqjV%2B0iAaMCE%2BVoMBAhAPjRyyWvyHLDQTIbexjW5%2BY06v9PGujUCG9PUV60lhetAJRzhHBz2mZ2pBw6NiHvuk%2F32Qtk4xzZF6LZddFVYx2DJe6hK%2BsLVw1hD5JQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
7b04c969abf6aabb-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless object| FontAwesomeKitConfig function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
helpid2849238459203423.com/ Name: PHPSESSID
Value: ts01uh3rel1dq2coupm9o68f71
.helpid2849238459203423.com/ Name: __cf_bm
Value: snKjA5DIbz4fybSox6JwUvh5ZFXJRwEXZVWuSb22fyY-1680225803-0-Abq1vDrAEIvLBOYr4+eJVQIADLF+L0xoAJn03/nODNPv/N+jE+or1IfqAYA/1jKWbwvfMCfaNs/MNFz7+aNQDR2jRmKc17XGHWCv/KjeIhAh0Nij+oKn15GQfegJX9pW1Q==