helpid96655723849185962813.com Open in urlscan Pro
2606:4700:3037::ac43:8621  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://helpid966557238491859623444.web.app/ Page URL
2. https://helpid96655723849185962813.com/business=7578203945274524/?step=1 Page URL
3. https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response helpid966557238491859623444.web.app/	191 B 478 B	163ms 39ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://helpid966557238491859623444.web.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c0bc7415078f5371b381c3ca41f6c8e01082721fc98525a5af3aa958cc01ef93 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 113 content-type text/html; charset=utf-8 date Sat, 06 May 2023 10:57:45 GMT etag "6102614cf6e6c0fb9239b18f53d40ea8b4f74d3fae65f0b1c93e05638f3a8f38-br" last-modified Fri, 05 May 2023 18:05:47 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache HIT x-cache-hits 1 x-served-by cache-ams21023-AMS x-timer S1683370666.543467,VS0,VE1
GET H2	200	/ helpid96655723849185962813.com/business=7578203945274524/	15 KB 6 KB	1755ms 1646ms	Document text/html	2606:4700:3037::ac43:8621 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://helpid96655723849185962813.com/business=7578203945274524/?step=1 Requested by Host: helpid966557238491859623444.web.app URL: https://helpid966557238491859623444.web.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8621 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.34 Resource Hash Request headers Referer https://helpid966557238491859623444.web.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7c30b44afe48695e-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 06 May 2023 10:57:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9zGa%2Bc%2BfGRtsHlZ6MAmpSzHUFiNOXRUcHL1iDW7Nt1CgZ7WDfYBedxLXv2Fs9P6iliAEJmudKtfADi%2F8ynRP2FNQwtEsUjXC4U%2FxTLJGv0R8hR8AewJSfH01UxRuBNtDtjozmh%2FtwA9ZZAj2ioJ3PL%2Bthn82b8qoh2EuRWY%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/7.2.34 x-turbo-charged-by LiteSpeed
POST H2	200	Primary Request index.php Show response helpid96655723849185962813.com/business=7578203945274524/	116 KB 17 KB	431ms 430ms	Document text/html	2606:4700:3037::ac43:8621 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:8621 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.34 Resource Hash d28afdaa0677cc861dab29f4fb55b005a7e02cbb2b07d50da7067e5f895b5523 Request headers Content-Type application/x-www-form-urlencoded Origin https://helpid96655723849185962813.com Referer https://helpid96655723849185962813.com/?zoneid=JtW2uZHBKVWVtjots8I5QQEVmp9DpbV8qFvkRajMxTTTTknI5BeEGIL8b5NpN9QYpfCn1nv59XZ5GG899kiRMewFW3OM0tUzBkItp6ewZ4yLqcv1qj6OoLtsaUB5QwBWQSPjBfCHMWn808NjgNLldaeunNZlLjGQsWsRbwEJ0mTx5Z1YfnzMhyugDlm6MGQarbFRgrzK&rid=JtW2uZHBKVWVtjots8I5QQEVmp9DpbV8qFvkRajMxTTTTknI5BeEGIL8b5NpN9QYpfCn1nv59XZ5GG899kiRMewFW3OM0tUzBkItp6ewZ4yLqcv1qj6OoLtsaUB5QwBWQSPjBfCHMWn808NjgNLldaeunNZlLjGQsWsRbwEJ0mTx5Z1YfnzMhyugDlm6MGQarbFRgrzK Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7c30b455a8d5695e-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 06 May 2023 10:57:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FuK7eMyA0OVO5yCEI2GNrZbBHbB%2F7DqA6g6IrJKt7CfV%2FvkEfHqUsFo0wPLN1M7%2B9MeNSy8DCwFCeWNTM4jml1ql4rDom%2FCHE0b6AlXXaJyFZgxZiGTLZtOBJdey92W5T7bOalgfsJE98wMT08Ax%2FH9vmUAHSXg%2FokIdlc0%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/7.2.34 x-turbo-charged-by LiteSpeed
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.4.1/dist/css/	156 KB 26 KB	141ms 40ms	Stylesheet text/css	2a04:4e42:200::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.4.1/dist/css/bootstrap.min.css Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://helpid96655723849185962813.com/ Origin https://helpid96655723849185962813.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Sat, 06 May 2023 10:57:48 GMT x-content-type-options nosniff content-encoding br age 1499581 x-jsd-version 4.4.1 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 26116 x-served-by cache-fra-eddf8230099-FRA, cache-ams21080-AMS x-jsd-version-type version etag W/"26f1b-0wURD7eRE6lhOUtDPYUaNBA0K4w" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	83fd8385f7.js Show response kit.fontawesome.com/	11 KB 4 KB	146ms 62ms	Script text/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/83fd8385f7.js Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36da8ad26974d552b901a75e671363718cb8f7ae80ca5d5674fe83444e0fdbc1 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer https://helpid96655723849185962813.com/ Origin https://helpid96655723849185962813.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:48 GMT strict-transport-security max-age=31536000; preload content-encoding gzip cf-cache-status REVALIDATED server cloudflare access-control-max-age 3000 access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control max-age=60, public, must-revalidate vary origin, accept-encoding, access-control-request-headers, access-control-request-method cf-ray 7c30b458f8a33683-FRA access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id F1xEOdsWgUMAZRzRfqLh
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	129ms 41ms	Script text/javascript	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 02 May 2023 18:07:00 GMT content-encoding gzip x-content-type-options nosniff age 319848 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 01 May 2024 18:07:00 GMT
GET H3	200	Ejy2hGWRKKtIIlqeyAtWxu.css helpid96655723849185962813.com/business=7578203945274524/img/	537 KB 152 KB	60ms 59ms	Stylesheet text/css	2606:4700:3037::ac43:8621 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://helpid96655723849185962813.com/business=7578203945274524/img/Ejy2hGWRKKtIIlqeyAtWxu.css Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:8621 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 301dc102e02fc407b1a2c21c0cd45565dd956f8e1f99bec2e9f880b2b0f2005e Request headers Referer https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Origin https://helpid96655723849185962813.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:48 GMT content-encoding br cf-cache-status HIT last-modified Sat, 08 Apr 2023 20:59:16 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 117440 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=On7Y2vY7NAbFM74767Xjk7Kr7lh8Li4Dek1Ss1hgmw%2FEcqsUYixwzPcK91g494FQD3ejEQPDz8Qpn%2B10QFm8UwT3Q2eao3AMCSnLLIHFhpGNl2Egf12aXgEe9oWVS0kItgIEfNSF6opukD7YsvxCWbHTvDwFmdez49ggLk4%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7c30b45878d91c9f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 12 May 2023 02:20:28 GMT
GET H3	200	278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.svg helpid96655723849185962813.com/business=7578203945274524/img/	4 KB 2 KB	49ms 49ms	Image image/svg+xml	2606:4700:3037::ac43:8621 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://helpid96655723849185962813.com/business=7578203945274524/img/278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.svg Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:8621 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c038058600a811b8a96de485a224bcc30eb673972fe39954075bcf70ce74e04 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT content-encoding br cf-cache-status HIT last-modified Sat, 08 Apr 2023 21:00:08 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 105824 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Txl%2FhQS0dWO1q9o04uNNPJ8TYfLqddg0z46Yg5Tz1Nn6y2IhmOMdgmnzp4L3Q%2BRodd7ihratGYT5ld4hQFknjRyOLB3OyBWfpj1nl5csLr8%2BXwGaZ%2BvzmLrmrrK61n2S25ZvAo6waIgm6kqyNn2XMmT5KJRF9xXkE5q7GM%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7c30b4599a3c1c9f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 12 May 2023 05:34:05 GMT
GET H3	200	search-13-64.a9254a55959a7da573f4.ico helpid96655723849185962813.com/business=7578203945274524/img/	17 KB 2 KB	48ms 47ms	Image image/x-icon	2606:4700:3037::ac43:8621 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://helpid96655723849185962813.com/business=7578203945274524/img/search-13-64.a9254a55959a7da573f4.ico Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:8621 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 55717da5f0bc7b97c87e7abdc4e097054048bc1c23998d5cc4b83a960d691062 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT content-encoding br cf-cache-status HIT last-modified Thu, 20 Apr 2023 18:39:51 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 117441 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M8y6xw0xNvHMfr2JDQewrx50hhjYS1FLTfHdhA5LcMZseIhqJ7u5jrI1dfVDg8n6a06oQp9caPXTCcfhHL0tbaaZDLg%2BzA5lewRcFiK9DNzorCZi%2FAc4wOsCqrTX9ICUUYfMBusqNInrSmkgA37%2FVY32Eansi1fsxfkXBho%3D"}],"group":"cf-nel","max_age":604800} content-type image/x-icon cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7c30b459ba7b1c9f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 12 May 2023 02:20:05 GMT
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	100 KB 23 KB	172ms 51ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 e502901885892afe656ee1a0e9f33d48.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:21 GMT server cloudflare etag W/"5febfb939e2fc4ddf14fffae53b72cf0" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sKS6iLUAJc4QnFN5aIsM485YC7pA13EUwEm9hExvyYxa7xpl7Jqn%2FRqdlEritZ%2FQ53%2ByiLk4qSLbmXZ%2FvhO9guwtLuzDBqcVytYCasKAL6coMSPCIiFJi1%2F7zW02gEN%2FrUhNA2KFAQybXZsSrt6uZFB0RQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49a39b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id mb5RDKH31MngCQuuq0DPOcc3zP7r4fc7sWVClMJ1ga3Bk02JttlG0g==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	27 KB 5 KB	168ms 48ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-shims.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 f3af529e1cd5e36acd18d2e16d2a96c6.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"5193a6de5225940ae4ef5f7c82126be9" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9So1S3NkEM6qbnII%2BYrUpx2arHVTpmq4PyysP2JFSh8SZ4Je%2F6%2FgwZ2VkgTK%2BO8X%2FNfEwYJARkSQvBl6kXHlbjROg85vrDKh4ilmezn2%2BzvcX5Ae5P0lXa91cHy4EPTi9PK40HUfIocXk2sYUIU3LxFKew%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49a49b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id gk89v9CoILVY12MxHsQtIEp8_TMSfZLbp1flWTYBtmdgnQXILJoS2Q==
GET H2	200	free-v5-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	823 B 1 KB	167ms 47ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v5-font-face.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 66a3254753daef98131e391b49752390.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"5856e3f07fbc36fc4d430a95a577a87f" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eJ5LZ2AmuheOCIcpcz1YZ9BwhmirStSCO5c79SjB1csANmNk9PhZpgoWwQrEAP4TNbIogi3%2BaiXbFctPifK%2FTPPl%2BxnFxubpB7RUwvpRiKFntK54yQAbLl%2FsI6NBaTVX2TLObhEmoHIZG06l%2BhlgKBJU9w%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49a69b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id QuinZloMq8kgxpMxpQ-LjJm5EDsoMQ5ipV0u2wvAVA5hmaNKd_pt2w==
GET H2	200	free-v4-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	2 KB 1 KB	167ms 47ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-font-face.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 3adede23987e8394f5ea9efa0347562e.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"9e7f9f634ace089bcdacc3fcc5f23ce5" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BhZ3rwLayVludgAGSBnbK%2BRYlp9W950zeB20WrtSLd%2FZb9vz2CO3AJgb5TTgbzseHqatPlG%2BFT6c1FZzyyJ3nbdOIdVti9FdgOuCj%2BdLE0MKdYmqWcO0yKVeRK8vqE%2BFYPrtf6vIs8rBZQsU%2BBJVzP16hw%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49a79b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id JZaJ8e3c5DAFbCUEpH-MlmwCgi_JTNEdwveBiXcoHWxNP7vhq-sCIw==
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	100 KB 23 KB	186ms 87ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 e502901885892afe656ee1a0e9f33d48.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:21 GMT server cloudflare etag W/"5febfb939e2fc4ddf14fffae53b72cf0" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zBFOzs1KoWB%2BaY4ppdwRa3PQY1j5MeBZ6aZLmNPEX7EgDu79VNLlFeJl8Zz6sSH5PMFm4Cj2rQRPtjZRYFl7RY2vpjmzlTiZbVnSm0CmkVRP16jxyJXfXqPBQa3Lo3M7%2BvreLqpKrNYZPyhj6rEX8n8ATQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49a99b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id mb5RDKH31MngCQuuq0DPOcc3zP7r4fc7sWVClMJ1ga3Bk02JttlG0g==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	27 KB 5 KB	148ms 49ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-shims.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 f3af529e1cd5e36acd18d2e16d2a96c6.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"5193a6de5225940ae4ef5f7c82126be9" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fhohrAwgDZymlxjAL4M1mxaR7Wt8UrL3UAqDIOujkxYChn0GB%2FG9PU5sSx84FQ73LQUdMIlGnzsmviOXjPrAZ3nrRLc%2Bjvdql9XpRjNjgQ9FP48okGl3%2FqDuuy6%2FDRhE9SrI5LHyA1yeJJ%2FZdYSEpxGw6g%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49ad9b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id gk89v9CoILVY12MxHsQtIEp8_TMSfZLbp1flWTYBtmdgnQXILJoS2Q==
GET H2	200	free-v5-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	823 B 599 B	147ms 48ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v5-font-face.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 66a3254753daef98131e391b49752390.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"5856e3f07fbc36fc4d430a95a577a87f" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KnXozYTFjJGEu%2FSWKSS2%2FnEj8UQdk1vmQ%2BP9aL7SnvwSUwYeNkUtL%2BBt4fuwb20mRCGKufscGi2UwoFOnEwHfcnQv62MlcaoIE6clu9sAQf0TBy4bLZJVabWUAZPlwgYpNJFQzk2Eavuj0jXqX2POw8d1Q%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49b09b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id QuinZloMq8kgxpMxpQ-LjJm5EDsoMQ5ipV0u2wvAVA5hmaNKd_pt2w==
GET H2	200	free-v4-font-face.min.css Show response ka-f.fontawesome.com/releases/v6.4.0/css/	2 KB 1 KB	185ms 86ms	Fetch text/css	2606:4700:e0::ac40:650a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-font-face.min.css?token=83fd8385f7 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/83fd8385f7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76 Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT via 1.1 3adede23987e8394f5ea9efa0347562e.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-P1 age 117461 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 23 Mar 2023 21:29:20 GMT server cloudflare etag W/"9e7f9f634ace089bcdacc3fcc5f23ce5" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kwpWPDXOVIcz2DjHHUoLtRvhdPneFdzTDtsntrmHsaYDuBEcan0R60nfm4cy9y1xnm%2BCE%2FgKi3i9OUi8FN3pSe%2BtlNG9YFhQunzL4OGdUicakX3N3KwhE7i2JWf7UbVoH%2BwZHb61R%2BrPBx02v5G1zRBJ0A%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7c30b45a49af9b74-FRA access-control-allow-headers fa-kit-token x-amz-cf-id JZaJ8e3c5DAFbCUEpH-MlmwCgi_JTNEdwveBiXcoHWxNP7vhq-sCIw==
GET H2	200	0i7zpYwtqDi.png static.xx.fbcdn.net/rsrc.php/v3/yL/r/	2 KB 2 KB	133ms 41ms	Image image/png	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/0i7zpYwtqDi.png Requested by Host: helpid96655723849185962813.com URL: https://helpid96655723849185962813.com/business=7578203945274524/index.php?step=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 245c721a63c81542db21ec64ed6fd7f6d1edbd7423a53bcc06cf8703ce9ec85e Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://helpid96655723849185962813.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 06 May 2023 10:57:49 GMT x-content-type-options nosniff content-md5 w0JSPyw0c4DavBcVAAODrw== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1696 x-fb-rlafr 0 x-fb-debug zr6WnYOwAwo8JPk1zFKDuudx3PRT/pVFohWJEt5aZy5PTxO7j8NcJ4VVJNHBp+Ged/diSjPBUWzJMvv9yNWdPw== x-fb-trip-id 1679558926 last-modified Mon, 01 Jan 2001 08:00:00 GMT content-type image/png access-control-allow-origin * origin-agent-cluster ?0 cache-control public,max-age=31536000,immutable timing-allow-origin * expires Tue, 23 Apr 2024 21:34:30 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| FontAwesomeKitConfig function| $ function| jQuery function| _0x2dae function| _0x1ef2b8 function| _0x319a

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
helpid966557238491859623444.web.app
helpid96655723849185962813.com
ka-f.fontawesome.com
kit.fontawesome.com
static.xx.fbcdn.net
2606:4700:3037::ac43:8621
2606:4700::6812:1634
2606:4700:e0::ac40:650a
2620:0:890::100
2a00:1450:4001:828::200a
2a03:2880:f083:9:face:b00c:0:3
2a04:4e42:200::485
0c038058600a811b8a96de485a224bcc30eb673972fe39954075bcf70ce74e04
245c721a63c81542db21ec64ed6fd7f6d1edbd7423a53bcc06cf8703ce9ec85e
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
301dc102e02fc407b1a2c21c0cd45565dd956f8e1f99bec2e9f880b2b0f2005e
36da8ad26974d552b901a75e671363718cb8f7ae80ca5d5674fe83444e0fdbc1
425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575
55717da5f0bc7b97c87e7abdc4e097054048bc1c23998d5cc4b83a960d691062
af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76
c0bc7415078f5371b381c3ca41f6c8e01082721fc98525a5af3aa958cc01ef93
d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd
d28afdaa0677cc861dab29f4fb55b005a7e02cbb2b07d50da7067e5f895b5523
fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e