urlscan.io logo urlscan.io
SecurityTrails logo

help1800.org Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://help1800.org/
Effective URL: https://help1800.org/
Submission: On March 04 via manual from CA — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is help1800.org.
TLS certificate: Issued by GTS CA 1P5 on February 25th 2024. Valid for: 3 months.
This is the only time help1800.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
14 88.214.26.64 209132 (AS209132)
19 4
Apex Domain
Subdomains		 Transfer
14 hp1800.ru
sup2.hp1800.ru
256 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228
60 KB
2 help1800.org
help1800.org
2 KB
19 3
Domain Requested by
14 sup2.hp1800.ru help1800.org
sup2.hp1800.ru
3 cdnjs.cloudflare.com help1800.org
2 help1800.org 1 redirects
19 3

This site contains no links.

Subject Issuer Validity Valid
help1800.org
GTS CA 1P5		 2024-02-25 -
2024-05-25		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
sup2.hp1800.ru
R3		 2024-03-03 -
2024-06-01		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://help1800.org/
Frame ID: A084EAD61BBD325100C8441674E7C54D
Requests: 4 HTTP requests in this frame

Frame: https://sup2.hp1800.ru/guest.aspx
Frame ID: 7FD434D868F4F941C7BFC0717F16D79D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Support

Page URL History Show full URLs

  1. http://help1800.org/ HTTP 301
    https://help1800.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

95 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

317 kB
Transfer

1373 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://help1800.org/ HTTP 301
    https://help1800.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
help1800.org/
Redirect Chain
  • http://help1800.org/
  • https://help1800.org/
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://help1800.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0000533480d0b0a43988ed9961774075355985524d92d5fcfe3d923170012586

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

age
96432
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
85f4bc549de266bb-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 04 Mar 2024 20:49:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K3IXwkPB09Utr8tHU%2FQYGza1H8YfPtvpMFvrX0DX%2BU658Mp%2B43rmkUWGvhDeuhvvbA5TbSPJbGbfq4IT3MB9nkhkj7jGxBrVLNdZqsntJaxBisbQjfvG84JpSlcscDngV%2FFhqdlMwq6wVV8%3D"}],"group":"cf-nel","max_age":604800}
response-time
2ms
server
cloudflare
surge-cache
HIT
surge-stamp
25510::1709488436984-cdefff987aa181888ed5500173b6dfa4
vary
Accept-Encoding

Redirect headers

CF-RAY
85f4bc542c5c6715-AMS
Cache-Control
max-age=3600
Connection
keep-alive
Date
Mon, 04 Mar 2024 20:49:55 GMT
Expires
Mon, 04 Mar 2024 21:49:55 GMT
Location
https://help1800.org/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gXR5EWl2fq7eyQAL52E1S%2B29HvIVlFA26WTu2eCxCK6emHDe%2Ftu67plLEObcZch8pQEN26wbyNjQKNntN1R%2B1DMe1PfPlDZ4cbjFpxxGMYZ3gTA5BUFhhDpryjTu08XfGkFKqgxwZZpz1TY%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/css/ 		160 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/css/bootstrap.min.css
Requested by
Host: help1800.org
URL: https://help1800.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://help1800.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
3895403
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
17404
last-modified
Sat, 09 Oct 2021 18:30:59 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"6161dfe3-43fc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F8Ev8Z6TQ2%2Buj5XMOrlmVBtSvPCsJxWQ%2BPptMUenAGGiGa5L%2F10u84E761oU5G9Cwn5379pXH5Fk2MJNMNP7zeh496gdAB3eNq45EoUcw24OLqPCloO9YuDCJjUMu21YxGbC7pcPwW81sqK%2BrWIuTW40"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85f4bc569d6e669f-AMS
expires
Sat, 22 Feb 2025 20:49:56 GMT
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/js/ 		58 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/js/bootstrap.min.js
Requested by
Host: help1800.org
URL: https://help1800.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70c3d690bdc5ce3b9a1527c46044989a3176e610882fa99f4523e75bc395bcce
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://help1800.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
355647
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
14584
last-modified
Sat, 09 Oct 2021 18:30:59 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"6161dfe3-38f8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aj5fUDKkIfAuAMT9eOSv3uW95OIKw%2F1WYfqRoGM8bRPEGffpZmbWrcPxe3bcGK%2FadLvzs6RgE5jAM98oGy%2BI92qm6%2FYOTQ7HVo4%2BGP0xtKjkJSzNGd7IQ3TIQZVTWVWi2ZQwY3LziasKuM8m9Y%2F1RBIu"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85f4bc569d77669f-AMS
expires
Sat, 22 Feb 2025 20:49:56 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: help1800.org
URL: https://help1800.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://help1800.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4509358
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27938
last-modified
Tue, 02 Mar 2021 18:58:36 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"603e8adc-15d9d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jBdDlwH%2BMF8UigYA%2Bf0l2X1G%2Bgmb%2BDv4WXMBdWEFiVOs6bZsJlPR8TjuIhtCKaCsN91l4mwtsefAdCSCcx1UJ5jj5Xrh4YClnoC%2FO2UV9sabwn4pVDMcFYkiNm56dgl27BLZ6wYVX9AjAuVoxOrAm3pZ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85f4bc569d74669f-AMS
expires
Sat, 22 Feb 2025 20:49:56 GMT
guest.aspx
sup2.hp1800.ru/ Frame 7FD4 		69 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/guest.aspx
Requested by
Host: help1800.org
URL: https://help1800.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
10b5a6b2c0a614d3b9c976f62f7118896908f03953f94c999b2ac7626285bd1c

Request headers

Referer
https://help1800.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
private
content-encoding
gzip
content-length
15971
content-type
text/html; charset=utf-8
date
Mon, 04 Mar 2024 20:49:56 GMT
p3p
CP="NON CUR OUR STP STA PRE"
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
Script.ashx
sup2.hp1800.ru/ Frame 7FD4 		514 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/guest.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
fd604a3b17b7b2afe51acd323420d4724f1dd162af7a9b8868fb3c0afef93351

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/guest.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
content-encoding
gzip
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
vary
Accept-Encoding, Accept-Language, Host, X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=3600
content-length
96017
expires
Mon, 04 Mar 2024 21:49:56 GMT
Default.css
sup2.hp1800.ru/App_Themes/LightWithBlue/ Frame 7FD4 		453 KB
116 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/App_Themes/LightWithBlue/Default.css?__Cache=f16c317a-4af1-43ab-9fd4-9e8f0b8e8c8b
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/guest.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
2c09b17f6d95dfa5d1144b0fb34f60863801518c23f94511cf5d1ca0cc01798f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/guest.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
content-encoding
gzip
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
public, max-age=3600
content-length
118316
expires
Mon, 04 Mar 2024 21:49:56 GMT
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
306 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
d7e8d35b168dba6a65a52b28f8236a056e04237eadb4c75efd285d12735f2bdf

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:49:56 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
truncated
/ Frame 7FD4 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b8114896f78c810e4d181fcfd01955ddb9bcace2d56743a7cbb228927b9d8f57

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
image/png
ActivityIndicator.gif
sup2.hp1800.ru/Images/ Frame 7FD4 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sup2.hp1800.ru/Images/ActivityIndicator.gif
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/App_Themes/LightWithBlue/Default.css?__Cache=f16c317a-4af1-43ab-9fd4-9e8f0b8e8c8b
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
9d070c98f02f1d6287952256b47f7cd72eda89bda25ef99782325214a042f01a

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/App_Themes/LightWithBlue/Default.css?__Cache=f16c317a-4af1-43ab-9fd4-9e8f0b8e8c8b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
last-modified
Sun, 19 Nov 2023 14:29:56 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
etag
"1DA1AF4DE040A00"
content-type
image/gif
cache-control
public
accept-ranges
bytes
content-length
27503
expires
Tue, 05 Mar 2024 20:49:57 GMT
Extras.svg
sup2.hp1800.ru/Images/ Frame 7FD4 		322 B
398 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sup2.hp1800.ru/Images/Extras.svg
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/guest.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
8fce4aad3b04f9b76a08bad9b2459e355bbf16a470486d689fa801b9a30e3061

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/guest.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
last-modified
Sun, 19 Nov 2023 14:29:56 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
etag
"1DA1AF4DE040A00"
content-type
image/svg+xml
cache-control
public
accept-ranges
bytes
content-length
322
expires
Tue, 05 Mar 2024 20:49:57 GMT
ActionCenter.svg
sup2.hp1800.ru/Images/ Frame 7FD4 		346 B
411 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sup2.hp1800.ru/Images/ActionCenter.svg
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/guest.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
81fce97d96268840367d7f9119333c8bfccf3a633a68006a87240288a085b0b1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/guest.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
last-modified
Thu, 22 Feb 2024 03:13:48 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
etag
"1DA653D26D8BE00"
content-type
image/svg+xml
cache-control
public
accept-ranges
bytes
content-length
346
expires
Tue, 05 Mar 2024 20:49:57 GMT
Applications.svg
sup2.hp1800.ru/Images/ Frame 7FD4 		821 B
923 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sup2.hp1800.ru/Images/Applications.svg
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/guest.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
5bf4f707f250958980d313203989f1fca55b9446f34d667e7256f853d52e494d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://sup2.hp1800.ru/guest.aspx
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 20:49:56 GMT
last-modified
Thu, 22 Feb 2024 03:13:48 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
etag
"1DA653D26D8BE00"
content-type
image/svg+xml
cache-control
public
accept-ranges
bytes
content-length
821
expires
Tue, 05 Mar 2024 20:49:57 GMT
truncated
/ Frame 7FD4 		241 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f65d4472eab3ae1671e14b2d09ccfc0345458929a18f797afd82dcf7cd3e1628

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
image/svg+xml
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
ca35849d1e35106dac853d3b5b311fa9eaee8fbf28aa47504da7fd409f4070fc

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:49:57 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
e471320b4934cf4e45b20f3c5c4ed37cc252f3f0843470b8835892b4daa7717d

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:50:00 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
37e47f2a8932a31a1cd334f8185c00a94ed6151a6dd48fa4c909083ad812d88d

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:50:01 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
82088cc077af6a1602167f7e6cea37c045eda667d30688abcaa821ccdbefec50

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:50:05 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
7a18a0a3b4b355b616f98f3996b16eb01450b0f7fddb12d29684e12efadb059f

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:50:06 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		144 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData
Requested by
Host: sup2.hp1800.ru
URL: https://sup2.hp1800.ru/Script.ashx?__Cache=3c6aba8e-1e4b-4884-809c-fafa45d43e28
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.214.26.64 , Germany, ASN209132 (AS209132, SC),
Reverse DNS
Software
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0 /
Resource Hash
3a9e091e86fb03f9ffebffaef7b1a455ffd482b55b07c1b7b2654a39aaf9df0a

Request headers

Referer
https://sup2.hp1800.ru/guest.aspx
X-Anti-Forgery-Token
ksCvDwHdLPWFvSFTSrzlilhIRd+Cw7KrcAlW4OT664oBAACvlOlV8LotQg==
accept-language
nl-NL,nl;q=0.9
X-Unauthorized-Status-Code
403
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 20:50:07 GMT
server
ScreenConnect/23.9.10.8817-627516845 Microsoft-HTTPAPI/2.0
content-type
application/json; charset=utf-8
access-control-allow-origin
https://sup2.hp1800.ru
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
144
expires
-1
GetLiveData
sup2.hp1800.ru/Services/PageService.ashx/ Frame 7FD4 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sup2.hp1800.ru
URL
https://sup2.hp1800.ru/Services/PageService.ashx/GetLiveData

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on March 4th 2024, 8:52:24 pm UTC — From Canada

Threats: Tech Support Scam
Brands: Asurion US ConnectWise US
Comment: Tech support scam, on code entry as requested in phone call, autodownloads from a .ru site and attempts to open a copy of ScreenConnect from ConnectWise.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 number| uidEvent object| bootstrap function| $ function| jQuery

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
help1800.org
sup2.hp1800.ru
sup2.hp1800.ru
2606:4700::6811:190e
2a06:98c1:3120::3
2a06:98c1:3121::3
88.214.26.64
0000533480d0b0a43988ed9961774075355985524d92d5fcfe3d923170012586
10b5a6b2c0a614d3b9c976f62f7118896908f03953f94c999b2ac7626285bd1c
2c09b17f6d95dfa5d1144b0fb34f60863801518c23f94511cf5d1ca0cc01798f
37e47f2a8932a31a1cd334f8185c00a94ed6151a6dd48fa4c909083ad812d88d
3a9e091e86fb03f9ffebffaef7b1a455ffd482b55b07c1b7b2654a39aaf9df0a
5bf4f707f250958980d313203989f1fca55b9446f34d667e7256f853d52e494d
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
70c3d690bdc5ce3b9a1527c46044989a3176e610882fa99f4523e75bc395bcce
7a18a0a3b4b355b616f98f3996b16eb01450b0f7fddb12d29684e12efadb059f
81fce97d96268840367d7f9119333c8bfccf3a633a68006a87240288a085b0b1
82088cc077af6a1602167f7e6cea37c045eda667d30688abcaa821ccdbefec50
8fce4aad3b04f9b76a08bad9b2459e355bbf16a470486d689fa801b9a30e3061
9d070c98f02f1d6287952256b47f7cd72eda89bda25ef99782325214a042f01a
b8114896f78c810e4d181fcfd01955ddb9bcace2d56743a7cbb228927b9d8f57
ca35849d1e35106dac853d3b5b311fa9eaee8fbf28aa47504da7fd409f4070fc
d7e8d35b168dba6a65a52b28f8236a056e04237eadb4c75efd285d12735f2bdf
e471320b4934cf4e45b20f3c5c4ed37cc252f3f0843470b8835892b4daa7717d
f65d4472eab3ae1671e14b2d09ccfc0345458929a18f797afd82dcf7cd3e1628
fd604a3b17b7b2afe51acd323420d4724f1dd162af7a9b8868fb3c0afef93351
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e