security-helpdesk.top Open in urlscan Pro
94.242.202.180  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://security-helpdesk.top/ Page URL
2. https://security-helpdesk.top/D00MachdsfgdsffdRV/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response security-helpdesk.top/	1 KB 625 B	521ms 70ms	Document text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / PHP/7.3.15 Resource Hash eb50b16c611dc62d2c161f19f6c169324396d7890db1acf502d1a522b0262766 Request headers :method GET :authority security-helpdesk.top :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server nginx content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/7.3.15 date Mon, 24 Aug 2020 03:28:04 GMT x-page-speed 1.13.35.2-0 cache-control max-age=0, no-cache content-encoding br
GET H2	200	Primary Request / Show response security-helpdesk.top/D00MachdsfgdsffdRV/	12 KB 4 KB	72ms 71ms	Document text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/ Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash ebce2c57aae1e8dbcc6ea832280840ab8f424535bf9f73ffc89b637f06d76810 Request headers :method GET :authority security-helpdesk.top :scheme https :path /D00MachdsfgdsffdRV/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://security-helpdesk.top/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://security-helpdesk.top/ Response headers status 200 server nginx content-type text/html vary Accept-Encoding date Mon, 24 Aug 2020 03:28:05 GMT x-page-speed 1.13.35.2-0 cache-control max-age=0, no-cache content-encoding br
GET H2	200	A.style.css.pagespeed.cf.IxulGH-83h.css security-helpdesk.top/D00MachdsfgdsffdRV/	1 KB 734 B	69ms 68ms	Stylesheet text/css	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/A.style.css.pagespeed.cf.IxulGH-83h.css Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash cd8fe997ff7c1246a7dec5e430bc4bc0e626c67fab4fbe88acdefc6a6bfa7916 Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-page-speed 1.13.35.2-0 date Fri, 21 Aug 2020 22:36:10 GMT content-encoding gzip x-original-content-length 1656 server nginx etag W/"0" vary Accept-Encoding content-type text/css status 200 cache-control max-age=31536000, public last-modified Fri, 21 Aug 2020 22:36:10 GMT content-length 467 expires Sat, 21 Aug 2021 22:36:10 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	89 KB 35 KB	21ms 20ms	Script application/javascript	2a00:1450:4001:820::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-xxx-x Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 94e464dda6c5ed56b1df169515fecbb3d820562436ce5503be7f10d73dc9ad3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 24 Aug 2020 03:28:08 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35729 x-xss-protection 0 last-modified Mon, 24 Aug 2020 03:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 24 Aug 2020 03:28:08 GMT
GET H2	404	jquery-1.js security-helpdesk.top/D00MachdsfgdsffdRV/	0 0	69ms 69ms	Script text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/jquery-1.js Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Mon, 24 Aug 2020 03:28:05 GMT content-encoding br server nginx cache-control s-maxage=10 vary Accept-Encoding content-type text/html
GET H2	200	mac.png security-helpdesk.top/D00MachdsfgdsffdRV/	128 KB 128 KB	103ms 103ms	Image image/png	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Show image Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/mac.png Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash e84afe8a9e7c481deb801c0461a8dd8107470628fb90069d156b5d04390b4fcd Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 21 Aug 2020 22:32:30 GMT server nginx etag "5f403649-1ff73" content-type image/png status 200 cache-control max-age=31536000, public accept-ranges bytes content-length 130931 expires Sat, 21 Aug 2021 22:32:30 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-xxx-x Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 04 Jun 2020 23:38:14 GMT server Golfe2 age 3267 date Mon, 24 Aug 2020 02:33:41 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18469 expires Mon, 24 Aug 2020 04:33:41 GMT
GET H2	404	jquery-1.js security-helpdesk.top/D00MachdsfgdsffdRV/	0 0	169ms 169ms	Script text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/jquery-1.js Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Mon, 24 Aug 2020 03:28:05 GMT content-encoding br server nginx cache-control s-maxage=10 vary Accept-Encoding content-type text/html
GET H/2+Q/46	200	collect www.google-analytics.com/r/	35 B 365 B	33ms 20ms	Image image/gif	2a00:1450:4001:801::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j83&a=4611838&t=pageview&_s=1&dl=https%3A%2F%2Fsecurity-helpdesk.top%2FD00MachdsfgdsffdRV%2F&ul=en-us&de=UTF-8&dt=Official%20Apple%20support&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1925402020&gjid=2005382921&cid=1361969765.1598239688&tid=UA-xxx-x&_gid=777078848.1598239688&_r=1&gtm=2ou8c0&z=852657083 Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol HTTP/2+QUIC/46 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 24 Aug 2020 03:28:08 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	beep.mp3 Show response security-helpdesk.top/D00MachdsfgdsffdRV/ Frame B1F4	8 KB 8 KB	69ms 69ms	Document text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/beep.mp3 Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash ca48040dcb83760af8c45574bf97ef86f9728e53f2d0e02d3ffbb85940743dc3 Request headers :method GET :authority security-helpdesk.top :scheme https :path /D00MachdsfgdsffdRV/beep.mp3 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest iframe referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ accept-encoding gzip, deflate, br accept-language en-US cookie _ga=GA1.2.1361969765.1598239688; _gid=GA1.2.777078848.1598239688; _gat_gtag_UA_xxx_x=1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ Response headers status 200 server nginx date Mon, 24 Aug 2020 03:28:05 GMT content-type audio/mpeg text/html content-length 8405 last-modified Fri, 21 Aug 2020 21:01:40 GMT etag "5f403634-20d5" cache-control s-maxage=10 accept-ranges bytes
GET DATA	200 OK	truncated /	239 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	206	err.mp3 security-helpdesk.top/D00MachdsfgdsffdRV/	196 KB 197 KB	71ms 70ms	Media text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/err.mp3 Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash 40f8335dfa7d99558775dd5ed650303eb5187c033e273bd66fbc16a961595eb0 Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Range bytes=0- Response headers date Mon, 24 Aug 2020 03:28:05 GMT last-modified Fri, 21 Aug 2020 21:01:46 GMT server nginx etag "5f40363a-31080" status 206 content-type audio/mpeg, text/html Content-Range bytes 0-200831/200832 cache-control s-maxage=10 Content-Length 200832
GET H2	206	beep.mp3 security-helpdesk.top/D00MachdsfgdsffdRV/	8 KB 8 KB	114ms 113ms	Media text/html	94.242.202.180 ROOT
General Check archive.org Show headers Download Go to Full URL https://security-helpdesk.top/D00MachdsfgdsffdRV/beep.mp3 Requested by Host: security-helpdesk.top URL: https://security-helpdesk.top/D00MachdsfgdsffdRV/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.242.202.180 , Luxembourg, ASN5577 (ROOT, LU), Reverse DNS ip-static-94-242-202-180.server.lu Software nginx / Resource Hash ca48040dcb83760af8c45574bf97ef86f9728e53f2d0e02d3ffbb85940743dc3 Request headers Referer https://security-helpdesk.top/D00MachdsfgdsffdRV/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Range bytes=0- Response headers date Mon, 24 Aug 2020 03:28:05 GMT last-modified Fri, 21 Aug 2020 21:01:40 GMT server nginx etag "5f403634-20d5" status 206 content-type audio/mpeg, text/html Content-Range bytes 0-8404/8405 cache-control s-maxage=10 Content-Length 8405

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Tech Support Scam (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| google_tag_manager object| dataLayer function| gtag object| google_tag_data string| GoogleAnalyticsObject function| ga object| el function| rfs undefined| wscript number| full function| toggleFullScreen object| gaplugins object| gaGlobal object| gaData object| msgAudioEl number| playMsgInt object| modal object| btn undefined| span function| addEvent

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.security-helpdesk.top/	1970-01-19 11:57:19	Name: _gat_gtag_UA_xxx_x Value: 1
			.security-helpdesk.top/	1970-01-19 11:58:46	Name: _gid Value: GA1.2.777078848.1598239688
			.security-helpdesk.top/	1970-01-20 05:28:31	Name: _ga Value: GA1.2.1361969765.1598239688

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

security-helpdesk.top
www.google-analytics.com
www.googletagmanager.com
2a00:1450:4001:801::200e
2a00:1450:4001:802::200e
2a00:1450:4001:820::2008
94.242.202.180
40f8335dfa7d99558775dd5ed650303eb5187c033e273bd66fbc16a961595eb0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
94e464dda6c5ed56b1df169515fecbb3d820562436ce5503be7f10d73dc9ad3b
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
ca48040dcb83760af8c45574bf97ef86f9728e53f2d0e02d3ffbb85940743dc3
cd8fe997ff7c1246a7dec5e430bc4bc0e626c67fab4fbe88acdefc6a6bfa7916
e84afe8a9e7c481deb801c0461a8dd8107470628fb90069d156b5d04390b4fcd
eb50b16c611dc62d2c161f19f6c169324396d7890db1acf502d1a522b0262766
ebce2c57aae1e8dbcc6ea832280840ab8f424535bf9f73ffc89b637f06d76810
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955