training.knowbe4.com Open in urlscan Pro
2600:9000:200d:b600:5:dd1f:dcc0:93a1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPW...
Effective URL:
https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3R...
Submission: On October 11 via manual (October 11th 2018, 5:57:03 pm UTC) from US

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2600:9000:200d:b600:5:dd1f:dcc0:93a1, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is training.knowbe4.com.
TLS certificate: Issued by Amazon on October 8th 2018. Valid for: a year.

This is the only time training.knowbe4.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Phishing Simulation (Internet)

Domain & IP information

	IP Address		AS Autonomous System
1	52.72.175.22 52.72.175.22		14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
8	2600:9000:200... 2600:9000:200d:b600:5:dd1f:dcc0:93a1		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
11	3

1 52.72.175.22 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-175-22.compute-1.amazonaws.com

ftp.phishing.guru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:200d:b600:5:dd1f:dcc0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

training.knowbe4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	knowbe4.com training.knowbe4.com	897 KB
1	phishing.guru ftp.phishing.guru	683 B
0	uchicago.edu Failed security.bsd.uchicago.edu Failed
11	3

	Domain	Requested by
8	training.knowbe4.com	ftp.phishing.guru training.knowbe4.com
1	ftp.phishing.guru
0	security.bsd.uchicago.edu Failed	training.knowbe4.com
11	3

This site contains links to these domains. Also see Links.

Domain
34.75.2o2.lol
security.bsd.uchicago.edu

Subject Issuer	Validity	Valid
training.knowbe4.com Amazon	`2018-10-08` - `2019-11-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy
Frame ID: 6028E7BF89BA43D7025BE208ADC468AF
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3... Page URL
https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5f... Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

11
Requests

73 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

898 kB
Transfer

3683 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://34.75.2o2.lol/XdXJcsPWh0dHbA6Ly9mdHhAucGhpdhc2hpfbmcuZ3VyudSk9YS0I0bVZNamFYQnBawV081MFgybGtQVEtFNE5Ea3hQdU9UUW1VWTJGdGNHRnBnWjJ0NWZjblZ1WDJsa1BURXlNVEU0WEptRmpkR2x2YmoxamJHbGpheVoxY213OWFIUjBjSE02THk5MGNtRnBibWx1WnkxemRHRm5hVzVuTG10dWIzZGlaVFF1WTI5dEwzQmhaMlZ6TDJZMk1EWTVOVFUyTURWaSZlbWFpbF90ZW1wbGF0ZV9pZD02Mjg0MTgmYWN0aW9uPXByZXZpZXcmdXNlcl9pZD0xNjA1MjIz
Title: Protect my account

Search URL Search Domain Scan URL

URL: http://security.bsd.uchicago.edu/phish/
Title: http://security.bsd.uchicago.edu/phish

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Page URL
https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy ftp.phishing.guru/	341 B 683 B	315ms 170ms	Document text/html	52.72.175.22 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol HTTP/1.1 Server 52.72.175.22 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-72-175-22.compute-1.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash Request headers Host ftp.phishing.guru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 11 Oct 2018 17:56:51 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Server nginx/1.4.6 (Ubuntu) Vary Accept-Encoding Referrer-Policy no-referrer-when-downgrade Cache-Control max-age=0, private, must-revalidate X-Request-Id 28292d09-2fc2-4d4d-839f-4af7a33d8705 X-Runtime 0.067837 Content-Encoding gzip
GET H2	200	Primary Request XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Show response training.knowbe4.com/pages/88ee5bad29b2/	52 KB 38 KB	368ms 316ms	Document text/html	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Requested by Host: ftp.phishing.guru URL: http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `b2488e9b6060b451eb20ef5c8e1aeb14d00d11d277ad818ce0c124cdc66f2cbe` Request headers :method GET :authority training.knowbe4.com :scheme https :path /pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 referer http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy accept-encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://ftp.phishing.guru/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Response headers status 200 content-type text/html; charset=utf-8 date Thu, 11 Oct 2018 17:56:51 GMT server nginx/1.4.6 (Ubuntu) vary Accept-Encoding referrer-policy no-referrer-when-downgrade cache-control max-age=0, private, must-revalidate x-request-id bb6ade9a-3936-48eb-8ea6-26929784b427 x-runtime 0.041747 content-encoding gzip x-cache Miss from cloudfront via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id Rf2NE--S-57LIx6oLZjt_I2jGYmQISH7Ha3hhZxrzfvNV79U0bNpdQ==
GET H2	200	application-405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23.js Show response training.knowbe4.com/assets/	3 MB 837 KB	371ms 368ms	Script application/x-javascript	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/application-405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23.js Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23` Request headers :path /assets/application-405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-d0f02" vary Accept-Encoding x-cache Miss from cloudfront content-type application/x-javascript status 200 cache-control max-age=315360000 public content-length 855810 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id q83M3QsLFQc0NGDS9VhmvfpvA93VmFVyR-Bxp2MzIRniTMRFzkqzZQ== expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Show response training.knowbe4.com/assets/	50 KB 16 KB	287ms 285ms	Script application/x-javascript	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97` Request headers :path /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-3d69" vary Accept-Encoding x-cache Miss from cloudfront content-type application/x-javascript status 200 cache-control max-age=315360000 public content-length 15721 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id gq50kJgYR0-i8er1OiiQ9cbWNimfND7HL0_PgScJtXaBx60Lg17ddQ== expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css training.knowbe4.com/assets/	606 B 669 B	286ms 284ms	Stylesheet text/css	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c` Request headers :path /assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:22 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a26-11c" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css status 200 cache-control max-age=315360000 public content-length 284 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id _fcCR2PIMj7kNvuV34r0nVYFv1ZBIopffZXmRt1vfBnTuTDadvFEOQ== expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sei-modal-18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c.css training.knowbe4.com/assets/	624 B 739 B	285ms 283ms	Stylesheet text/css	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/sei-modal-18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c.css Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c` Request headers :path /assets/sei-modal-18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-163" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css status 200 cache-control max-age=315360000 public content-length 355 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id 6JmCkyTMrl6yCl5eloj4de_mo54QeNtHXJO_ml21i33a3HUxHg19BA== expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sei-tooltip-765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1.css training.knowbe4.com/assets/	2 KB 939 B	286ms 284ms	Stylesheet text/css	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/sei-tooltip-765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1.css Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1` Request headers :path /assets/sei-tooltip-765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-22b" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css status 200 cache-control max-age=315360000 public content-length 555 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id NZh22wP-Jwcf1teS0iLQXUJ7QlD_kaiY3KWDTuOJrrkU6c-y0yfbWg== expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css training.knowbe4.com/assets/	1 KB 908 B	284ms 283ms	Stylesheet text/css	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://training.knowbe4.com/assets/sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d` Request headers :path /assets/sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy :scheme https :method GET Referer https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT content-encoding gzip last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-20c" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css status 200 cache-control max-age=315360000 public content-length 524 via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) x-amz-cf-id QIA6LKySLqptNydYH9ddlIzi_YNO3umKJF0wk_hgsO0kOX6TEsengQ== expires Thu, 31 Dec 2037 23:55:55 GMT
GET		phishing_redflags_08-2017.png security.bsd.uchicago.edu/	0 0

GET		/ security.bsd.uchicago.edu/phishing_redflags_08-2017/	0 0

GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f079e69502ea6cbdb850a5b6d827ee5cd87522cce070d62684cda05278d138d9` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e762f53d0bae81e371e0da2a6cb90c033336334ced147d325f963b22660f4e74` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H2	200	sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png training.knowbe4.com/assets/	3 KB 3 KB	96ms 96ms	Image image/png	2600:9000:200d:b600:5:dd1f:dcc0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://training.knowbe4.com/assets/sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png Requested by Host: training.knowbe4.com URL: https://training.knowbe4.com/pages/88ee5bad29b2/XcmVejaXBpZWh50X2lkPTKM4ODg3eVNDY2PMyZjYW1wsYWWlnbl9ydW5faWQ9MTUzAMjUwNCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vdHJhaW5pbmcua25vd2JlNC5jb20vcGFnZXMvODhlZTViYWQyOWIy Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:b600:5:dd1f:dcc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software nginx/1.4.6 (Ubuntu) / Resource Hash `fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9` Request headers :path /assets/sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority training.knowbe4.com referer https://training.knowbe4.com/assets/sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css :scheme https :method GET Referer https://training.knowbe4.com/assets/sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 11 Oct 2018 17:56:52 GMT via 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront) last-modified Thu, 11 Oct 2018 16:28:21 GMT server nginx/1.4.6 (Ubuntu) etag "5bbf7a25-c60" x-cache Miss from cloudfront content-type image/png status 200 cache-control max-age=315360000 public accept-ranges bytes content-length 3168 x-amz-cf-id wOYqGZSJn32oAzB8rsfaRKIHI07bM8iAI3LelpYdWAQinV8WxG2PHQ== expires Thu, 31 Dec 2037 23:55:55 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: security.bsd.uchicago.edu
URL: https://security.bsd.uchicago.edu/phishing_redflags_08-2017.png

Domain: security.bsd.uchicago.edu
URL: https://security.bsd.uchicago.edu/phishing_redflags_08-2017/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishing Simulation (Internet)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _typeof boolean| windowIsDefined function| _extends function| FlatpickrInstance function| _flatpickr function| flatpickr function| updateQueryStringParameter function| getParam function| colSort function| ES6Promise function| $ function| jQuery object| jQuery112405845021687777123 function| Retina function| RetinaImagePath function| RetinaImage function| Color function| Chart object| Chartkick function| proj4 function| AjaxBootstrapSelect function| AjaxBootstrapSelectList function| AjaxBootstrapSelectRequest function| Slider object| Utils object| asap_questionaire function| AsapStoreViewer object| Routes function| moment object| FullCalendar function| _ object| ProgressBar object| html5 object| Modernizr object| asap object| kb4

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://training.knowbe4.com/assets/application-405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23.js(Line 85364) Message: bootstrap-slider.js - WARNING: $.fn.slider namespace is already bound. Use the $.fn.bootstrapSlider namespace instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ftp.phishing.guru
security.bsd.uchicago.edu
training.knowbe4.com
security.bsd.uchicago.edu
2600:9000:200d:b600:5:dd1f:dcc0:93a1
52.72.175.22
18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c
405b1be04ef2476f9afb17154e5df63b79570ecdf8d066a4971a25a495671e23
5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1
b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c
b2488e9b6060b451eb20ef5c8e1aeb14d00d11d277ad818ce0c124cdc66f2cbe
e762f53d0bae81e371e0da2a6cb90c033336334ced147d325f963b22660f4e74
f079e69502ea6cbdb850a5b6d827ee5cd87522cce070d62684cda05278d138d9
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9