https://helsana.club
172.67.166.153 · Cloudflare, Inc.
Toronto, Canada
19 days
200 · 21.3s
Valid· E8, Let's Encrypt, US
COMPLETED
Domain Intelligence: helsana.club
Scanned 2 times since Mar 15, 2026, 12:19 PM UTC
No KB/IOK detections were recorded for this scan.
finance | technology | ecommerce | cryptocurrency | other · 4/5/2026
The page at helsana.club presents a 404 Page Not Found in static HTML but loads a Cloudflare beacon script and performs a POST to /cdn-cgi/rum? with no visible login form in the HTML. The SSL cert is from Let's Encrypt and the domain is newly registered (19 days old). Visual indicators in the attached screenshot show no recognizable brand logos, suggesting the page is either a bare, non-functional placeholder or a minimal shell used to stage credential capture via dynamically rendered content. The domain does not match any known major brand from the scanned signals, indicating possible brand impersonation via SPA content loaded at runtime, but no explicit brand identification is present in the static HTML or network IOCs beyond generic Cloudflare assets.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 4
Hosts: 2
Domains: 2
This site is actively hosting a suspicious page likely intended for credential collection or data exfiltration, yet the static HTML shows no login form and no brand identifiers. The presence of a dynamic SPA and a Cloudflare beacon suggests evasion of static scanners while still attempting to intercept user input. The domain age and new SSL cert add to the risk profile. The lack of visible brand branding in the HTML, combined with the 404-like static content, strongly indicates a behind-the-scenes credential capture mechanism targeting unaware visitors. This warrants immediate action to suspend the domain and investigate potential hosting infrastructure links to credential harvesting operations.
Suspend Domain