helda.by
Open in
urlscan Pro
80.94.225.42
Malicious Activity!
Public Scan
URL:
http://helda.by/wp-content/utah/
Submission: On April 23 via automatic, source openphish
Submission: On April 23 via automatic, source openphish
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 15 HTTP transactions.
The main IP is 80.94.225.42, located in
Belarus and
belongs to IPTEL-AS, BY.
The main domain is helda.by.
This is the only time helda.by was scanned on urlscan.io!
This is the only time helda.by was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: US Universities (Education)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 80.94.225.42 80.94.225.42 | 21305 (IPTEL-AS) (IPTEL-AS) | |
| 1 | 155.97.137.30 155.97.137.30 | 17055 (UTAH) (UTAH) | |
| 15 | 3 |
1
155.97.137.30
(Salt Lake City, United States)
ASN17055 (UTAH, US)
PTR: www.umail.utah.edu
ASN17055 (UTAH, US)
PTR: www.umail.utah.edu
| www.umail.utah.edu |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
helda.by
helda.by |
88 KB |
| 1 |
utah.edu
www.umail.utah.edu |
532 B |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 15 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | helda.by |
helda.by
|
| 1 | www.umail.utah.edu |
helda.by
|
| 0 | hhojmcideegachlhfgfdhailpfhgknjm Failed |
helda.by
|
| 15 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| uofu.service-now.com |
| webtools.umail.utah.edu |
| www.umail.utah.edu |
| office.com |
| www.it.utah.edu |
| www.utah.edu |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.umail.utah.edu InCommon RSA Server CA |
2018-11-16 - 2020-11-15 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://helda.by/wp-content/utah/
Frame ID: 7F904E87B4BF76209AFDDF6EEFFDC2D3
Requests: 15 HTTP requests in this frame
8 Outgoing links
These are links going to different origins than the main page.
URL: https://uofu.service-now.com/it?id=uu_kb_article&sys_id=cbc3f8ae13fceec0ae6d53228144b075
Title: UMail Help
Title: UMail Help
Search URL Search Domain Scan URL
URL: https://webtools.umail.utah.edu/
Title: WebTools
Title: WebTools
Search URL Search Domain Scan URL
URL: https://www.umail.utah.edu/owa/auth/logon.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fwww.umail.utah.edu%2fowa
Title: What is this?
Title: What is this?
Search URL Search Domain Scan URL
URL: http://office.com/redir/HA102824601.aspx
Title: click here.
Title: click here.
Search URL Search Domain Scan URL
URL: http://www.it.utah.edu/
Title: University Information Technology
Title: University Information Technology
Search URL Search Domain Scan URL
URL: http://www.utah.edu/
Title: The University of Utah
Title: The University of Utah
Search URL Search Domain Scan URL
URL: http://www.utah.edu/disclaimer/index.html
Title: Disclaimer
Title: Disclaimer
Search URL Search Domain Scan URL
URL: http://www.utah.edu/privacy/
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
helda.by/wp-content/utah/ |
67 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logon.css
helda.by/wp-content/utah/index_files/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
owafont.css
helda.by/wp-content/utah/index_files/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flogon.js.download
helda.by/wp-content/utah/index_files/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgntopl.gif
helda.by/wp-content/utah/index_files/ |
9 KB 9 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgntopr.gif
helda.by/wp-content/utah/index_files/ |
738 B 976 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgnexlogo.gif
helda.by/wp-content/utah/index_files/ |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgnbotl.gif
helda.by/wp-content/utah/index_files/ |
180 B 417 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgnbotr.gif
helda.by/wp-content/utah/index_files/ |
76 B 312 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
index.js
hhojmcideegachlhfgfdhailpfhgknjm/web_accessible_resources/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
page-bg.gif
www.umail.utah.edu/owa/auth/2010resources/ |
47 B 532 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgntopm.gif
helda.by/owa/auth/2010resources/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgnleft.gif
helda.by/owa/auth/2010resources/ |
5 KB 5 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lgnbotm.gif
helda.by/owa/auth/2010resources/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
clm10
helda.by/ |
10 KB 10 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- hhojmcideegachlhfgfdhailpfhgknjm
- URL
- chrome-extension://hhojmcideegachlhfgfdhailpfhgknjm/web_accessible_resources/index.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: US Universities (Education)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| secureCookie function| isHttps function| clkSecExp function| kdSecExp function| checkSubmit number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr number| NS_CSM_td number| NS_CSM_pd string| NS_CSM_u string| NS_CSM_an function| sendTimingInfoInit function| sendTimingInfo1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| helda.by/wp-content/utah | Name: cookieTest Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
helda.by
hhojmcideegachlhfgfdhailpfhgknjm
www.umail.utah.edu
hhojmcideegachlhfgfdhailpfhgknjm
155.97.137.30
80.94.225.42
082ec41ad08138ac984a5b04a99595c8b08b727d5c5582cdf8dd8409bac9f4a1
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060
24cd119d64e5c7bdb4d08ab2464daeca89d270f0b27f3d13f30394e8322a8de5
3c11c3147a6748095b23c5c6919d43670137a99b36a2832d5a26ce3ffd02742e
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
669037b6b4531fa3465fe22f20b35c9c18cc866fd0e3862390ad4d9dee138db2
68735edb4b81bf80b20746699995d801b7d98941ed3a6e9eebe931fea734a6a3
68834e3814ea5115f611421c8756e3ef73391ab00dedc5a541b78b1ee89b085e
bab4372565d9faf99e6aec22c54a095d5ced7d47e7a946692e9ae3b5e6d83ce2
d123408d2ddb3f3383ac3fe59434ac36637ae186803a2f00e919188ae97dc4bf
d43b54099a9b1b387857da97e98ec0e3fb06c1476e17cd1839f1e87da5da7f9f
d9a847e157c07d64faa94862f40d5800f57f20addd3cf0d9fbf28fb06ea285d1
e6b41c8774f6be10407c96c65e786f45a71343591ecf6d73acb6011124490c02