Hello, today I saw helpd connecting to his servers (like help.apple.com and helposx.apple.com) but suddently I saw the same helpd connecting to this ssl.kundenserver.de. This happen when I try to open the help menu from various applications (even the Finder). I'm almost sure that I haven't installed nothing strange, also I have Sophos antivirus. It seems that kundenserver.de is something linked to spam. Someone has an idea what might be? I attached the window from Little Snitch (a good firewall) Edit: resolved I checked the ~/Library/Caches/com.apple.helpd/HelpCache.plist data and I found the "culprit" (iNet website is hosted here). It seems legit.