Keamanan domain dan intelijen ancaman

hellpdesk.net

Name: hellpdesk.net — PhishDestroy evidence record
Published: 2026-10-26
License: https://creativecommons.org/licenses/by/4.0/

Ringkasnya

hellpdesk.net: Peniruan Phishingtest, terdeteksi oleh PhishDestroy pada 2026-10-26.

“Microsoft SSO Sign In”

Tinjau bukti

Registrar: GoDaddy
Resolved IP: 103.214.5.132
Terdaftar: 13/10/2016

Penilaian PhishDestroy Kritis

100/100

Skor bukti

Ketersediaan Kesalahan server Respons tersimpan terbaru tidak meyakinkan Teramati 26 Okt 2026 · 16:31 UTCPemeriksaan HTTP

Sinyal risiko

Deteksi Total Virus: 5/92 Spamhaus DBL: domain phishing Daftar blokir yang disimpan cocok: 1 Label merek otomatis: Phishingtest Jenis penipuan: Peniruan

VirusTotal

5 / 92

deteksi mesin · 2026-10-26

OTX

referensi komunitas

Cloudflare Radar

bersih

putusan sumber

Tangkapan halaman

buka galeri

Usia domain

3665 days

Laporan terkirim

lihat lini masa

Ringkasan laporan

Peniruan Phishingtest: hellpdesk.net — Kesalahan server. Ringkasan bukti: VirusTotal 5/92 (alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue…

Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.

Analisis

Laporan Ancaman PhishDestroy2026-10-26 17:42:18 UTC

Overview

The captured screenshot dated 2026-10-26 shows a plain server error page headed Not Found with the line The requested URL was not found on this server, while collected page metadata recorded the title Microsoft SSO Sign In. PhishDestroy listed the domain after VirusTotal flagged it and it was first seen on 2026-10-26.

How the scam works

The recorded sign-in title points to a page built to imitate a Microsoft single sign-on prompt, so a visitor would be invited to type a username, password or second factor into attacker-controlled fields. Anyone who submitted credentials could hand over access to their genuine account, which is the standard credential harvesting risk in this category.

Bukti

The screenshot itself shows only an error message with no form fields visible on 2026-10-26. urlscan.io returned a malicious overall verdict with a score of 100 and a phishing category on 2026-10-26, while its ML engine scored -68. VirusTotal reported 5 detections from 92 engines with each flagging vendor labelling it phishing, and OpenPhish plus PhishDestroy's internal lists carried it on 2026-10-26. Google Safe Browsing was not flagged and 12 DNS resolvers reported no blocking on 2026-10-26.

Infrastruktur

The domain was registered on 2016-10-13 through GoDaddy.com, LLC, with DNS delegated to nameservers tied to a landing-page routing service. Hosting was recorded on a HostSlim network address in the Netherlands, with CloudFront appearing in the response headers on 2026-10-26. A Let's Encrypt certificate issued to the domain was valid from 2026-09-28 to 2026-12-27.

What to do

If you submitted credentials, change your password on the genuine Microsoft service, enable two-factor authentication, and review recent sign-in activity for unexpected access. Treat any link or message directing you to hellpdesk.net as malicious and do not enter information there. Security teams should block hellpdesk.net in proxies, DNS filters and email gateways, and correlate sightings against the recorded certificate and DNS delegation.

Bukti sumberVirusTotal 5 / 92 · OTX 32 references 9 sumber

VirusTotal

5 / 92 deteksi mesin · ringkasan yang tersimpan

2026-10-26 17:39 UTC

Buka laporan

VirusTotalCatatan asli sumberTeramati: 2026-10-26 13:59:09 UTC12 kolom

Teramati: 2026-10-26T13:59:09Z · Diambil: 2026-10-26T17:39:22Z

Jumlah hasil vendor

Waktu habis: 0
Tidak berbahaya: 54
Berbahaya: 5
Mencurigakan: 0
Tidak terdeteksi: 33

Label pemasok

SOCRadar: phishing
LevelBlue: phishing
Gridinsoft: phishing
alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

Skor reputasi

Peringkat popularitas

Alexa: 319973
Statvoo: 319973
Cisco Umbrella: 946552
Cloudflare Radar: 1000000

Dibuat

2016-10-13 00:00:00 UTC

Diperbarui

2026-02-22 00:00:00 UTC

Pertama terlihat

2023-10-12 16:45:07 UTC

Catatan DNS

TTL, detik
300
Jenis
A
Nilai
103.214.5.132
TTL, detik
3600
Jenis
NS
Nilai
ns2.landingpagerouter.com
TTL, detik
3600
Jenis
NS
Nilai
ns1.landingpagerouter.com
TTL, detik
3600
Jenis
SOA
Alamat penanggung jawab
certificates.usecure.io
Nilai
ns1.landingpagerouter.com
TTL, detik
60
Jenis
TXT
Nilai
v=spf1 a mx include:spf.mail.user-training.com ~all

Waktu pengambilan catatan DNS

2026-10-26 14:04:34 UTC

Sidik jari JARM

29d29d00000000000042d42d000000dd5c266caaa8baaf93008418f7774284

Sertifikat

Nama alternatif subjek (SAN): hellpdesk.net
Penerbit: Let's Encrypt / YR2
Nomor seri: 5d83e9ea90364caea5c5b581a713c5b4ccd
SHA-256: 24c3a54f6606544d8bdf9d460a802d73a15e5c6194a6674344722e1e27ecbf80
Subjek: hellpdesk.net
Berlaku hingga: 2026-12-27 13:34:52 UTC
Berlaku sejak: 2026-09-28 13:34:53 UTC

Data registri (RDAP)

Status

client delete prohibited
client renew prohibited
client transfer prohibited
client update prohibited

Peristiwa registri

Berakhirnya pendaftaran: 2027-10-13 16:03:45 UTC
Terakhir diubah: 2026-10-14 21:10:43 UTC
Pendaftaran: 2016-10-13 16:03:45 UTC
Pembaruan terakhir basis data RDAP: 2026-10-21 15:08:50 UTC

Registrar

GoDaddy.com, LLC

ID IANA registrar

146

Kolom asli sumber · JSON

Jumlah hasil vendor	{ "timeout": 0, "harmless": 54, "malicious": 5, "suspicious": 0, "undetected": 33 }
Label pemasok	{ "SOCRadar": "phishing", "LevelBlue": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputasi	0
Popularity	{ "Alexa": 319973, "Statvoo": 319973, "Cisco Umbrella": 946552, "Cloudflare Radar": 1000000 }
Dibuat	2016-10-13T00:00:00Z
Diperbarui	2026-02-22T00:00:00Z
Pertama terlihat	2023-10-12T16:45:07Z
Catatan DNS	[ { "ttl": 300, "type": "A", "value": "103.214.5.132" }, { "ttl": 3600, "type": "NS", "value": "ns2.landingpagerouter.com" }, { "ttl": 3600, "type": "NS", "value": "ns1.landingpagerouter.com" }, { "ttl": 3600, "type": "SOA", "rname": "certificates.usecure.io", "value": "ns1.landingpagerouter.com" }, { "ttl": 60, "type": "TXT", "value": "v=spf1 a mx include:spf.mail.user-training.com ~all" } ]
Dns at	2026-10-26T14:04:34Z
Jarm	29d29d00000000000042d42d000000dd5c266caaa8baaf93008418f7774284
Sertifikat	{ "san": [ "hellpdesk.net" ], "issuer": "Let's Encrypt / YR2", "serial": "5d83e9ea90364caea5c5b581a713c5b4ccd", "sha256": "24c3a54f6606544d8bdf9d460a802d73a15e5c6194a6674344722e1e27ecbf80", "subject": "hellpdesk.net", "valid_to": "2026-12-27T13:34:52Z", "valid_from": "2026-09-28T13:34:53Z" }
Data registri	{ "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-10-13T16:03:45Z", "last changed": "2026-10-14T21:10:43Z", "registration": "2016-10-13T16:03:45Z", "last update of RDAP database": "2026-10-21T15:08:50Z" }, "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146" }

Catatan sumber terpisah · 5 malicious + 0 suspicious / 92 · 2026-10-26 13:59:09 UTC

Ringkasan di atas dan catatan penyedia ini dikumpulkan pada waktu yang berbeda. Keduanya tetap tersedia; klasifikasi berbahaya dan mencurigakan ditampilkan secara terpisah.

record_source: collected_observations.vt
analysis_at: 2026-10-26T13:59:09Z
fetched_at: 2026-10-26T17:39:22Z
stats: {"timeout":0,"harmless":54,"malicious":5,"suspicious":0,"undetected":33}

Spamhaus DBL

domain phishing

2026-10-26 19:30 UTC

URLScan

Berbahaya

SHA-256 c7627e83a793f4f5c4953d5074b7dca93a42c31cdf9697c250a8f3f5ddf7e49e

2026-10-26 16:30 UTC

Buka laporan

URLScanCatatan asli sumberTeramati: 2026-10-26 16:30:46 UTC23 kolom

Teramati: 2026-10-26T16:30:46Z · Diambil: 2026-10-26T17:09:55Z

ID laporan

01a1790b-5659-734f-8eec-4ad59acc1313

URL Akhir

https://hellpdesk.net/

Respons HTTP

200

Jenis pengalihan

https-only

Pengalihan

Ke
https://hellpdesk.net/
Dari
http://hellpdesk.net/
Status
307

Alamat IP

103.214.5.132

Domain yang dihubungi

usecure.s3.eu-west-1.amazonaws.com
fonts.googleapis.com
fonts.gstatic.com

Alamat IP yang dihubungi

142.251.14.94
3.5.72.95
2a00:1450:4001:c15::5f
103.214.5.132

Sistem otonom (ASN)

15169
16509
207083

Negara server

Hash dokumen

07a6e92d6b57607aed8409b29baf0f759ac0a252fc3973982dbeb33d34972096

Hash skrip

6bbbd733c0417ff85ee13757607a771cc0f04256d3ed8f8c96723a7fa451ddbc

Variabel global JavaScript

clearImmediate
setImmediate
usecure

Cookie

AWSALB
AWSALBCORS

Sesi TLS dan sertifikat

Nama alternatif subjek (SAN): hellpdesk.net
Cipher suite: AES_256_GCM
Penerbit: YR2
Subjek: hellpdesk.net
Protokol: TLS 1.3
Berlaku hingga: 2026-12-27 13:34:52 UTC
Berlaku sejak: 2026-09-28 13:34:53 UTC

Usia domain, hari

3663

Usia domain terdaftar, hari

3663

Usia sertifikat, hari

Masa berlaku sertifikat, hari

Peringkat Cisco Umbrella

946552

Permintaan halaman

Keputusan penyedia layanan

Putusan mesin

Tag: urlscan-ml
urlscan-ml-60c5e22
Skor: -68
Berbahaya: Tidak

Putusan keseluruhan

Tag: phishing
Skor: 100
Merek: phishingtest
Berbahaya: Ya
Kategori: phishing

Putusan URLScan

Tag: phishing
Skor: 100
Merek: Phishing Simulation
Berbahaya: Ya
Kategori: phishing

Header HTTP

Server: CloudFront
Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31536000; includeSubDomains; preload
Content-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https:;form-action 'self';frame-ancestors 'self' https://*.usecure.io https://*.user-training.com;img-src 'self' data: https://*.amazonaws.com
X-frame-options: SAMEORIGIN
X-content-type-options: nosniff
Referrer-policy: no-referrer
Cross-origin-opener-policy: same-origin
Cross-origin-resource-policy: same-origin

Kolom asli sumber · JSON

Uuid	01a1790b-5659-734f-8eec-4ad59acc1313
Final url	https://hellpdesk.net/
Status	200
Dialihkan	https-only
Pengalihan	[ { "to": "https://hellpdesk.net/", "from": "http://hellpdesk.net/", "status": 307 } ]
Ip	103.214.5.132
Domain yang dihubungi	[ "usecure.s3.eu-west-1.amazonaws.com", "fonts.googleapis.com", "fonts.gstatic.com" ]
Alamat IP yang dihubungi	[ "142.251.14.94", "3.5.72.95", "2a00:1450:4001:c15::5f", "103.214.5.132" ]
Asns	[ "15169", "16509", "207083" ]
Countries	[ "US", "IE", "DE", "NL" ]
Hash dokumen	07a6e92d6b57607aed8409b29baf0f759ac0a252fc3973982dbeb33d34972096
Hash skrip	[ "6bbbd733c0417ff85ee13757607a771cc0f04256d3ed8f8c96723a7fa451ddbc" ]
Globals	[ "clearImmediate", "setImmediate", "usecure" ]
Cookie	[ "AWSALB", "AWSALBCORS" ]
Tls	{ "san": [ "hellpdesk.net" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "hellpdesk.net", "protocol": "TLS 1.3", "valid_to": "2026-12-27T13:34:52Z", "valid_from": "2026-09-28T13:34:53Z" }
Usia domain (hari)	3663
Apex age days	3663
Tls age days	28
Masa berlaku TLS (hari)	89
Umbrella rank	946552
Permintaan	18
Keputusan penyedia layanan	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -68, "malicious": false }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "phishingtest" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Phishing Simulation" ], "malicious": true, "categories": [ "phishing" ] } }
Header HTTP	{ "server": "CloudFront", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "default-src 'self';base-uri 'self';font-src 'self' data: https:;form-action 'self';frame-ancestors 'self' https://.usecure.io https://.user-training.com;img-src 'self' data: https://*.amazonaws.com", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin" }

Catatan monitor terpisah · 2026-10-26 17:41 UTC

Cuplikan monitor yang disimpan secara terpisah; tidak menggantikan catatan laporan utama atau menentukan ketersediaan saat ini.

record_source: domain_monitor.urlscan
uuid: 01a1790b-5659-734f-8eec-4ad59acc1313
report_url: https://urlscan.io/result/01a1790b-5659-734f-8eec-4ad59acc1313/
skor: 100
malicious: true
result_at: 2026-10-26T17:41:11Z
enriched_at: null
source_timestamps: {"urlscan_result_at":"2026-10-26 18:41:11","urlscan_enriched_at":null}
timestamp_basis: Eropa/Berlin, sebagaimana digunakan dalam laporan yang ada; cap waktu sumber dipertahankan apa adanya

URLQuery

Laporan pemindaian

Buka laporan

OTX

32 community references

2026-10-26 17:39 UTC

Buka laporan

Cloudflare Radar

provider verdict: clean

Buka laporan

Cloudflare RadarCatatan asli sumberTeramati: 2026-10-26 17:09:02 UTC11 kolom

Teramati: 2026-10-26T17:09:02Z · Diambil: 2026-10-26T17:09:57Z

ID laporan

fe286905-3227-4070-8a9f-2d8c4700a0b7

URL Akhir

https://hellpdesk.net/

Respons HTTP

404

Riwayat navigasi

URL
https://hellpdesk.net/
Status
404

Hash struktur DOM

42065dba3b8a7b2130dd66fe299c26c1aa681d7c7f2893f8410bbcd2d2e1770d

Hash dokumen

9dcc361cf979ea9471e1076ab30724c665229614d2d7432dfe9127c8b6d3a443