域安全和威胁情报

hellpdesk.net

Name: hellpdesk.net — PhishDestroy evidence record
Published: 2026-10-26
License: https://creativecommons.org/licenses/by/4.0/

简要

hellpdesk.net：冒充 Phishingtest，PhishDestroy 于 2026-10-26 检测到。风险：关键（100/100）。注册商：GoDaddy。状态：服务器错误。托管：HOSTSLIM OU。PhishDestroy 已发送1 份滥用举报。VirusTotal：5/92 个引擎标记。已列入 Spamhaus DBL。请勿输入登录凭据，也不要连接钱包。

“Microsoft SSO Sign In”

查看证据

注册商: GoDaddy
Resolved IP: 103.214.5.132
注册时间: 2016年10月13日

PhishDestroy评估关键

100/100

证据评分

可用性 服务器错误 最新存储的响应不确定观测时间 2026年10月26日 · 16:31 UTCHTTP 探测

风险信号

病毒检测总数：5/92 Spamhaus DBL: 网络钓鱼域名存储的阻止列表匹配项：1 自动品牌标签：Phishingtest 诈骗类型：仿冒

VirusTotal

5 / 92

发动机检测 · 2026-10-26

OTX

社区参考资料

Cloudflare Radar

无异常

源代码判定

页面快照

打开图库

域名年龄

3665 days

已发送举报

查看时间线

报告概览

冒充 Phishingtest: hellpdesk.net — 服务器错误. 证据摘要: VirusTotal 5/92 (alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue, SOCRadar); URLScan malicious…

为保留原始取证记录，下方的 PhishDestroy AI 详细分析仍使用英文。

分析

PhishDestroy威胁报告2026-10-26 17:42:18 UTC

Overview

The captured screenshot dated 2026-10-26 shows a plain server error page headed Not Found with the line The requested URL was not found on this server, while collected page metadata recorded the title Microsoft SSO Sign In. PhishDestroy listed the domain after VirusTotal flagged it and it was first seen on 2026-10-26.

How the scam works

The recorded sign-in title points to a page built to imitate a Microsoft single sign-on prompt, so a visitor would be invited to type a username, password or second factor into attacker-controlled fields. Anyone who submitted credentials could hand over access to their genuine account, which is the standard credential harvesting risk in this category.

证据

The screenshot itself shows only an error message with no form fields visible on 2026-10-26. urlscan.io returned a malicious overall verdict with a score of 100 and a phishing category on 2026-10-26, while its ML engine scored -68. VirusTotal reported 5 detections from 92 engines with each flagging vendor labelling it phishing, and OpenPhish plus PhishDestroy's internal lists carried it on 2026-10-26. Google Safe Browsing was not flagged and 12 DNS resolvers reported no blocking on 2026-10-26.

基础设施

The domain was registered on 2016-10-13 through GoDaddy.com, LLC, with DNS delegated to nameservers tied to a landing-page routing service. Hosting was recorded on a HostSlim network address in the Netherlands, with CloudFront appearing in the response headers on 2026-10-26. A Let's Encrypt certificate issued to the domain was valid from 2026-09-28 to 2026-12-27.

What to do

If you submitted credentials, change your password on the genuine Microsoft service, enable two-factor authentication, and review recent sign-in activity for unexpected access. Treat any link or message directing you to hellpdesk.net as malicious and do not enter information there. Security teams should block hellpdesk.net in proxies, DNS filters and email gateways, and correlate sightings against the recorded certificate and DNS delegation.

来源证据VirusTotal 5 / 92 · OTX 32 references 9 个来源

VirusTotal

5 / 92 发动机检测 · 存储的摘要

2026-10-26 17:39 UTC

打开报告

VirusTotal来源原始记录观测时间: 2026-10-26 13:59:09 UTC12 个字段

观测时间: 2026-10-26T13:59:09Z · 检索到: 2026-10-26T17:39:22Z

供应商结果计数

超时: 0
无害: 54
恶意: 5
可疑的: 0
未检测到: 33

供应商标签

SOCRadar: phishing
LevelBlue: phishing
Gridinsoft: phishing
alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

信誉评分

流行度排名

Alexa: 319973
Statvoo: 319973
Cisco Umbrella: 946552
Cloudflare Radar: 1000000

创建

2016-10-13 00:00:00 UTC

已更新

2026-02-22 00:00:00 UTC

首次发现

2023-10-12 16:45:07 UTC

DNS 记录

TTL（秒）
300
类型
A
值
103.214.5.132
TTL（秒）
3600
类型
NS
值
ns2.landingpagerouter.com
TTL（秒）
3600
类型
NS
值
ns1.landingpagerouter.com
TTL（秒）
3600
类型
SOA
负责人邮箱
certificates.usecure.io
值
ns1.landingpagerouter.com
TTL（秒）
60
类型
TXT
值
v=spf1 a mx include:spf.mail.user-training.com ~all

DNS 记录获取时间

2026-10-26 14:04:34 UTC

JARM 指纹

29d29d00000000000042d42d000000dd5c266caaa8baaf93008418f7774284

证书

使用者备用名称（SAN）: hellpdesk.net
签发者: Let's Encrypt / YR2
序列号: 5d83e9ea90364caea5c5b581a713c5b4ccd
SHA-256: 24c3a54f6606544d8bdf9d460a802d73a15e5c6194a6674344722e1e27ecbf80
使用者（Subject）: hellpdesk.net
到期时间: 2026-12-27 13:34:52 UTC
生效时间: 2026-09-28 13:34:53 UTC

注册局数据（RDAP）

状态

client delete prohibited
client renew prohibited
client transfer prohibited
client update prohibited

注册局事件

注册到期: 2027-10-13 16:03:45 UTC
最后更改: 2026-10-14 21:10:43 UTC
注册信息: 2016-10-13 16:03:45 UTC
RDAP 数据库最近更新: 2026-10-21 15:08:50 UTC

注册商

GoDaddy.com, LLC

注册商 IANA ID

146

来源原始字段 · JSON

供应商结果计数	{ "timeout": 0, "harmless": 54, "malicious": 5, "suspicious": 0, "undetected": 33 }
供应商标签	{ "SOCRadar": "phishing", "LevelBlue": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
声誉	0
Popularity	{ "Alexa": 319973, "Statvoo": 319973, "Cisco Umbrella": 946552, "Cloudflare Radar": 1000000 }
创建	2016-10-13T00:00:00Z
已更新	2026-02-22T00:00:00Z
首次发现	2023-10-12T16:45:07Z
DNS 记录	[ { "ttl": 300, "type": "A", "value": "103.214.5.132" }, { "ttl": 3600, "type": "NS", "value": "ns2.landingpagerouter.com" }, { "ttl": 3600, "type": "NS", "value": "ns1.landingpagerouter.com" }, { "ttl": 3600, "type": "SOA", "rname": "certificates.usecure.io", "value": "ns1.landingpagerouter.com" }, { "ttl": 60, "type": "TXT", "value": "v=spf1 a mx include:spf.mail.user-training.com ~all" } ]
Dns at	2026-10-26T14:04:34Z
Jarm	29d29d00000000000042d42d000000dd5c266caaa8baaf93008418f7774284
证书	{ "san": [ "hellpdesk.net" ], "issuer": "Let's Encrypt / YR2", "serial": "5d83e9ea90364caea5c5b581a713c5b4ccd", "sha256": "24c3a54f6606544d8bdf9d460a802d73a15e5c6194a6674344722e1e27ecbf80", "subject": "hellpdesk.net", "valid_to": "2026-12-27T13:34:52Z", "valid_from": "2026-09-28T13:34:53Z" }
注册表数据	{ "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-10-13T16:03:45Z", "last changed": "2026-10-14T21:10:43Z", "registration": "2016-10-13T16:03:45Z", "last update of RDAP database": "2026-10-21T15:08:50Z" }, "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146" }

单独的源记录 · 5 malicious + 0 suspicious / 92 · 2026-10-26 13:59:09 UTC

上述摘要和此服务提供商记录是在不同时间收集的。两者均仍可查阅；恶意和可疑的分类结果分别显示。

record_source: collected_observations.vt
analysis_at: 2026-10-26T13:59:09Z
fetched_at: 2026-10-26T17:39:22Z
stats: {"timeout":0,"harmless":54,"malicious":5,"suspicious":0,"undetected":33}

Spamhaus DBL

网络钓鱼域名

2026-10-26 19:30 UTC

URLScan

恶意

SHA-256 c7627e83a793f4f5c4953d5074b7dca93a42c31cdf9697c250a8f3f5ddf7e49e

2026-10-26 16:30 UTC

打开报告

URLScan来源原始记录观测时间: 2026-10-26 16:30:46 UTC23 个字段

观测时间: 2026-10-26T16:30:46Z · 检索到: 2026-10-26T17:09:55Z

报告 ID

01a1790b-5659-734f-8eec-4ad59acc1313

最终 URL

https://hellpdesk.net/

HTTP 响应

200

重定向类型

https-only

重定向

目标
https://hellpdesk.net/
来源
http://hellpdesk.net/
状态
307

IP 地址

103.214.5.132

已联系的域名

usecure.s3.eu-west-1.amazonaws.com
fonts.googleapis.com
fonts.gstatic.com

已联系的 IP 地址

142.251.14.94
3.5.72.95
2a00:1450:4001:c15::5f
103.214.5.132

自治系统（ASN）

15169
16509
207083

服务器所在国家/地区

文档哈希值

07a6e92d6b57607aed8409b29baf0f759ac0a252fc3973982dbeb33d34972096

脚本哈希值

6bbbd733c0417ff85ee13757607a771cc0f04256d3ed8f8c96723a7fa451ddbc

JavaScript 全局变量

clearImmediate
setImmediate
usecure

Cookie

AWSALB
AWSALBCORS

TLS 会话与证书

使用者备用名称（SAN）: hellpdesk.net
加密套件: AES_256_GCM
签发者: YR2
使用者（Subject）: hellpdesk.net
协议: TLS 1.3
到期时间: 2026-12-27 13:34:52 UTC
生效时间: 2026-09-28 13:34:53 UTC

域名年龄（天）

3663

注册域名年龄（天）

3663

证书年龄（天）

证书有效期（天）

Cisco Umbrella 排名

946552

页面请求数

服务提供商评定结果

引擎判定

标签: urlscan-ml
urlscan-ml-60c5e22
评分: -68
恶意: 否

总体判定

标签: phishing
评分: 100
品牌: phishingtest
恶意: 是
分类: phishing

URLScan 判定

标签: phishing
评分: 100
品牌: Phishing Simulation
恶意: 是
分类: phishing

HTTP 头

服务器: CloudFront
Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31536000; includeSubDomains; preload
Content-security-policy: default-src 'self';base-uri 'self';font-src 'self' data: https:;form-action 'self';frame-ancestors 'self' https://*.usecure.io https://*.user-training.com;img-src 'self' data: https://*.amazonaws.com
X-frame-options: SAMEORIGIN
X-content-type-options: nosniff
Referrer-policy: no-referrer
Cross-origin-opener-policy: same-origin
Cross-origin-resource-policy: same-origin

来源原始字段 · JSON

Uuid	01a1790b-5659-734f-8eec-4ad59acc1313
Final url	https://hellpdesk.net/
状态	200
已重定向	https-only
重定向	[ { "to": "https://hellpdesk.net/", "from": "http://hellpdesk.net/", "status": 307 } ]
Ip	103.214.5.132
已联系的域名	[ "usecure.s3.eu-west-1.amazonaws.com", "fonts.googleapis.com", "fonts.gstatic.com" ]
已联系的 IP 地址	[ "142.251.14.94", "3.5.72.95", "2a00:1450:4001:c15::5f", "103.214.5.132" ]
Asns	[ "15169", "16509", "207083" ]
Countries	[ "US", "IE", "DE", "NL" ]
文档哈希值	07a6e92d6b57607aed8409b29baf0f759ac0a252fc3973982dbeb33d34972096
脚本哈希值	[ "6bbbd733c0417ff85ee13757607a771cc0f04256d3ed8f8c96723a7fa451ddbc" ]
Globals	[ "clearImmediate", "setImmediate", "usecure" ]
Cookie	[ "AWSALB", "AWSALBCORS" ]
Tls	{ "san": [ "hellpdesk.net" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "hellpdesk.net", "protocol": "TLS 1.3", "valid_to": "2026-12-27T13:34:52Z", "valid_from": "2026-09-28T13:34:53Z" }
域名年龄（天）	3663
Apex age days	3663
Tls age days	28
TLS 有效天数	89
Umbrella rank	946552
请求	18
服务提供商评定结果	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -68, "malicious": false }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "phishingtest" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Phishing Simulation" ], "malicious": true, "categories": [ "phishing" ] } }
HTTP 头	{ "server": "CloudFront", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "default-src 'self';base-uri 'self';font-src 'self' data: https:;form-action 'self';frame-ancestors 'self' https://.usecure.io https://.user-training.com;img-src 'self' data: https://*.amazonaws.com", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin" }

单独的监视器记录 · 2026-10-26 17:41 UTC

单独存储的监控快照；不会替换主报告记录，也不会确定当前的可用性。

record_source: domain_monitor.urlscan
uuid: 01a1790b-5659-734f-8eec-4ad59acc1313
report_url: https://urlscan.io/result/01a1790b-5659-734f-8eec-4ad59acc1313/
评分: 100
malicious: true
result_at: 2026-10-26T17:41:11Z
enriched_at: null
source_timestamps: {"urlscan_result_at":"2026-10-26 18:41:11","urlscan_enriched_at":null}
timestamp_basis: Europe/Berlin，与现有报告中使用的格式一致；源时间戳按原样保留

URLQuery

扫描报告

打开报告

OTX

32 community references

2026-10-26 17:39 UTC

打开报告

Cloudflare Radar

provider verdict: clean

打开报告

Cloudflare Radar来源原始记录观测时间: 2026-10-26 17:09:02 UTC11 个字段

观测时间: 2026-10-26T17:09:02Z · 检索到: 2026-10-26T17:09:57Z

报告 ID

fe286905-3227-4070-8a9f-2d8c4700a0b7

最终 URL

https://hellpdesk.net/

HTTP 响应

404

跳转记录

URL
https://hellpdesk.net/
状态
404

DOM 结构哈希

42065dba3b8a7b2130dd66fe299c26c1aa681d7c7f2893f8410bbcd2d2e1770d

文档哈希值

9dcc361cf979ea9471e1076ab30724c665229614d2d7432dfe9127c8b6d3a443