training.knowbe4.com Open in urlscan Pro
2600:9000:200d:2a00:5:dd1f:dcc0:93a1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPW...
Effective URL:
https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3R...
Submission: On October 17 via manual (October 17th 2018, 12:41:18 pm UTC) from US

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 2600:9000:200d:2a00:5:dd1f:dcc0:93a1, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is training.knowbe4.com.
TLS certificate: Issued by Amazon on October 8th 2018. Valid for: a year.

This is the only time training.knowbe4.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
1	18.204.160.228 18.204.160.228		14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
4	2600:9000:200... 2600:9000:200d:2a00:5:dd1f:dcc0:93a1		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3		32934 (FACEBOOK) (FACEBOOK - Facebook)
7	4

1 18.204.160.228 (Cambridge, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-204-160-228.compute-1.amazonaws.com

messaging-security.comano.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:200d:2a00:5:dd1f:dcc0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

training.knowbe4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	knowbe4.com training.knowbe4.com	865 KB
1	fbcdn.net static.xx.fbcdn.net	313 B
1	comano.us messaging-security.comano.us	683 B
0	googleapis.com Failed ajax.googleapis.com Failed
7	4

	Domain	Requested by
4	training.knowbe4.com	messaging-security.comano.us training.knowbe4.com
1	static.xx.fbcdn.net	training.knowbe4.com
1	messaging-security.comano.us
0	ajax.googleapis.com Failed	training.knowbe4.com
7	4

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
training.knowbe4.com Amazon	`2018-10-08` - `2019-11-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2017-12-15` - `2019-03-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Frame ID: 689315EEF3B5E20F26EBBBB883718047
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3... Page URL
https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5f... Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

7
Requests

71 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

866 kB
Transfer

3634 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/
Title: Sign Up

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey Page URL
https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey Show response
messaging-security.comano.us/ 341 B
683 B 386ms
171ms Document
text/html 18.204.160.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Protocol: HTTP/1.1
Server: 18.204.160.228 Cambridge, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-18-204-160-228.compute-1.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: f363580f9d114b58f1e1a1ac55dda8012e51f48e839e7c52d02e05df644e130d

Request headers

Host: messaging-security.comano.us
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 17 Oct 2018 12:41:06 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.4.6 (Ubuntu)
Vary: Accept-Encoding
Referrer-Policy: no-referrer-when-downgrade
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: 0fe48b72-4b42-490f-9b08-e5f955c19528
X-Runtime: 0.069432
Content-Encoding: gzip

GET
H2 200 Primary Request XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey Show response
training.knowbe4.com/pages/5959255657a2/ 6 KB
3 KB 313ms
293ms Document
text/html 2600:9000:200d:2a00:5:dd1f:dcc0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Requested by: Host: messaging-security.comano.us
URL: http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:2a00:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: c53c4e9000ebc11d28d94803771bb6927ada8418f75aef02b6a6caf4ed6c8070

Request headers

:method: GET
:authority: training.knowbe4.com
:scheme: https
:path: /pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://messaging-security.comano.us/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey

Response headers

status: 200
content-type: text/html; charset=utf-8
date: Wed, 17 Oct 2018 12:41:07 GMT
server: nginx/1.4.6 (Ubuntu)
vary: Accept-Encoding
referrer-policy: no-referrer-when-downgrade
cache-control: max-age=0, private, must-revalidate
x-request-id: ad202a79-dcff-49a8-8014-da07ab71d4e4
x-runtime: 0.023180
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
x-amz-cf-id: LEMy7-JqQUT9loSgmj5Do0tvyBFAiVKth9A7tnP4hby8j1Cs7PuXEg==

GET
H2 200 application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js Show response
training.knowbe4.com/assets/ 3 MB
846 KB 364ms
363ms Script
application/x-javascript 2600:9000:200d:2a00:5:dd1f:dcc0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://training.knowbe4.com/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
Requested by: Host: training.knowbe4.com
URL: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:2a00:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b

Request headers

:path: /assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: training.knowbe4.com
referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
:scheme: https
:method: GET
Referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 12:41:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Oct 2018 21:50:59 GMT
server: nginx/1.4.6 (Ubuntu)
etag: "5bc65d43-d3254"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=315360000 public
content-length: 864852
via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
x-amz-cf-id: lLjxZHYGdJEvE34_0N8vYP897j3CVrK3kxCVAwecAvfdGZfhLa6JCQ==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Show response
training.knowbe4.com/assets/ 50 KB
16 KB 360ms
360ms Script
application/x-javascript 2600:9000:200d:2a00:5:dd1f:dcc0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://training.knowbe4.com/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
Requested by: Host: training.knowbe4.com
URL: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:2a00:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97

Request headers

:path: /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: training.knowbe4.com
referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
:scheme: https
:method: GET
Referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 12:41:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Oct 2018 21:50:41 GMT
server: nginx/1.4.6 (Ubuntu)
etag: "5bc65d31-3d69"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=315360000 public
content-length: 15721
via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
x-amz-cf-id: EoqSLcRFQ0sIsRdyXs76fDRN45ckyFsMzyNDxNAy1IX2BFXcaMC5eg==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css
training.knowbe4.com/assets/ 606 B
669 B 269ms
269ms Stylesheet
text/css 2600:9000:200d:2a00:5:dd1f:dcc0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://training.knowbe4.com/assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css
Requested by: Host: training.knowbe4.com
URL: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:200d:2a00:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c

Request headers

:path: /assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: training.knowbe4.com
referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
:scheme: https
:method: GET
Referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 17 Oct 2018 12:41:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Oct 2018 21:50:43 GMT
server: nginx/1.4.6 (Ubuntu)
etag: "5bc65d33-11c"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/css
status: 200
cache-control: max-age=315360000 public
content-length: 284
via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
x-amz-cf-id: _yIzuD73R_OYdBdSRQYvG7P59AK1PrsE4hF-wPm_RYZ7IgSjpxOhIw==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1/ 0
0

GET
S 200 O7nelmd9XSI.png
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ 95 B
313 B 32ms
5ms Image
image/png 2a03:2880:f02d:12:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/O7nelmd9XSI.png

Requested by

Host: training.knowbe4.com
URL: https://training.knowbe4.com/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

/

Resource Hash

c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://training.knowbe4.com/pages/5959255657a2/XcmVKjaXBpZWl50X2lkPTYM5MDIxsrNjAyqMCZjYW1waYWglnbl9ydW5faWQ9MTU0wMjU2NiZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvNTk1OTI1NTY1N2Ey
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-fb-debug: mL3gBU0fA4wAq9iKsX9EpcT7RwdcoJlQUQ2SbbCBnBXlnAN5+Fn0Sk6HNk4Q4KgCz2/OtEayljOgjc4LOHMuRw==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OcEdZWIg79UvSWVADRSQCg==
date: Wed, 17 Oct 2018 12:41:08 GMT
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
timing-allow-origin: *
content-length: 95
x-xss-protection: 0
expires: Tue, 15 Oct 2019 19:16:37 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ajax.googleapis.com
URL: http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _typeof boolean| windowIsDefined function| _extends function| FlatpickrInstance function| _flatpickr function| flatpickr function| updateQueryStringParameter function| getParam function| colSort function| ES6Promise function| $ function| jQuery object| jQuery11240967990832271441 function| Retina function| RetinaImagePath function| RetinaImage function| Color function| Chart object| Chartkick function| proj4 function| AjaxBootstrapSelect function| AjaxBootstrapSelectList function| AjaxBootstrapSelectRequest function| Slider object| Utils object| asap_questionaire function| AsapStoreViewer object| Routes function| moment object| FullCalendar function| _ object| ProgressBar object| html5 object| Modernizr object| asap object| kb4

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://training.knowbe4.com/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js(Line 85364) Message: bootstrap-slider.js - WARNING: $.fn.slider namespace is already bound. Use the $.fn.bootstrapSlider namespace instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
messaging-security.comano.us
static.xx.fbcdn.net
training.knowbe4.com
ajax.googleapis.com
18.204.160.228
2600:9000:200d:2a00:5:dd1f:dcc0:93a1
2a03:2880:f02d:12:face:b00c:0:3
18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
c53c4e9000ebc11d28d94803771bb6927ada8418f75aef02b6a6caf4ed6c8070
f363580f9d114b58f1e1a1ac55dda8012e51f48e839e7c52d02e05df644e130d