training.knowbe4.com
Open in
urlscan Pro
2600:9000:2043:3c00:5:dd1f:dcc0:93a1
Malicious Activity!
Public Scan
Effective URL: https://training.knowbe4.com/pages/6ed3313ca504/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGl...
Submission: On November 05 via manual from US
Summary
TLS certificate: Issued by Amazon on October 8th 2018. Valid for: a year.
This is the only time training.knowbe4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Phishing Simulation (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.72.175.22 52.72.175.22 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
8 | 2600:9000:204... 2600:9000:2043:3c00:5:dd1f:dcc0:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
3 | 52.216.132.181 52.216.132.181 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2606:4700::68... 2606:4700::6811:f1cc | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 52.216.165.197 52.216.165.197 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
15 | 5 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-175-22.compute-1.amazonaws.com
34.75.2o2.lol |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
training.knowbe4.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
s3.amazonaws.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn2.hubspot.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
knowbe4.com
training.knowbe4.com |
945 KB |
5 |
amazonaws.com
s3.amazonaws.com |
112 KB |
1 |
hubspot.net
cdn2.hubspot.net |
6 KB |
1 |
2o2.lol
34.75.2o2.lol |
681 B |
15 | 4 |
Domain | Requested by | |
---|---|---|
8 | training.knowbe4.com |
34.75.2o2.lol
training.knowbe4.com |
5 | s3.amazonaws.com |
training.knowbe4.com
|
1 | cdn2.hubspot.net |
training.knowbe4.com
|
1 | 34.75.2o2.lol | |
15 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
34.75.2o2.lol |
Subject Issuer | Validity | Valid | |
---|---|---|---|
training.knowbe4.com Amazon |
2018-10-08 - 2019-11-08 |
a year | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-08-02 - 2019-10-25 |
a year | crt.sh |
ssl817700.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-25 - 2019-04-03 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://training.knowbe4.com/pages/6ed3313ca504/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGlvbj1jbGljayZ1cmw9aHR0cHM6Ly90cmFpbmluZy5rbm93YmU0LmNvbS9wYWdlcy82ZWQzMzEzY2E1MDQ=
Frame ID: 258C68FCAC2C8E0FB8368108645B2C70
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://34.75.2o2.lol/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdG... Page URL
- https://training.knowbe4.com/pages/6ed3313ca504/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5f... Page URL
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
Moment.js (JavaScript Libraries) Expand
Detected patterns
- env /^moment$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Self Service Password Reset Page
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://34.75.2o2.lol/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGlvbj1jbGljayZ1cmw9aHR0cHM6Ly90cmFpbmluZy5rbm93YmU0LmNvbS9wYWdlcy82ZWQzMzEzY2E1MDQ= Page URL
- https://training.knowbe4.com/pages/6ed3313ca504/XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGlvbj1jbGljayZ1cmw9aHR0cHM6Ly90cmFpbmluZy5rbm93YmU0LmNvbS9wYWdlcy82ZWQzMzEzY2E1MDQ= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGlvbj1jbGljayZ1cmw9aHR0cHM6Ly90cmFpbmluZy5rbm93YmU0LmNvbS9wYWdlcy82ZWQzMzEzY2E1MDQ=
34.75.2o2.lol/ |
341 B 681 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
XcmVmjaXBpZWO50X2lkPTnMxODczuoOTEwlMiZjYW1wWYWhlnbl9ydW5faWQ9OTY0MNzEzJmFjdGlvbj1jbGljayZ1cmw9aHR0cHM6Ly90cmFpbmluZy5rbm93YmU0LmNvbS9wYWdlcy82ZWQzMzEzY2E1MDQ=
training.knowbe4.com/pages/6ed3313ca504/ |
76 KB 77 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
training.knowbe4.com/assets/ |
3 MB 846 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
training.knowbe4.com/assets/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
landing-watermark-954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe.css
training.knowbe4.com/assets/ |
1 KB 666 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-modal-a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5.css
training.knowbe4.com/assets/ |
1 KB 717 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-tooltip-44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4.css
training.knowbe4.com/assets/ |
3 KB 958 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
training.knowbe4.com/assets/ |
2 KB 891 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dd.css
s3.amazonaws.com/helpimg/landing_pages/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flags.css
s3.amazonaws.com/helpimg/landing_pages/css/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
KB4-logo.png
cdn2.hubspot.net/hubfs/241394/html_file/files/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Hand.png
s3.amazonaws.com/knowbe4-images/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
training.knowbe4.com/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flagssprite_small.png
s3.amazonaws.com/helpimg/landing_pages/images/ |
70 KB 71 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
s3.amazonaws.com/helpimg/landing_pages/images/ |
53 B 432 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Phishing Simulation (Internet)67 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _typeof boolean| windowIsDefined function| _extends function| FlatpickrInstance function| _flatpickr function| flatpickr function| updateQueryStringParameter function| getParam function| colSort function| ES6Promise function| $ function| jQuery object| jQuery112404704683974047883 function| Retina function| RetinaImagePath function| RetinaImage function| Color function| Chart object| Chartkick function| proj4 function| AjaxBootstrapSelect function| AjaxBootstrapSelectList function| AjaxBootstrapSelectRequest function| Slider object| Utils object| asap_questionaire function| AsapStoreViewer object| Routes function| moment object| FullCalendar function| _ object| ProgressBar object| html5 object| Modernizr object| msBeautify object| translations string| en_lang string| sa_lang string| cn_lang string| cz_lang string| nl_lang string| fr_lang string| ca_lang string| de_lang string| in_lang string| hu_lang string| it_lang string| jp_lang string| kr_lang string| no_lang string| pl_lang string| pt_lang string| ru_lang string| es_lang string| mx_lang string| se_lang string| tr_lang string| gr_lang string| id_lang string| ua_lang string| vn_lang string| th_lang string| my_lang function| translate object| select object| asap object| kb40 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
34.75.2o2.lol
cdn2.hubspot.net
s3.amazonaws.com
training.knowbe4.com
2600:9000:2043:3c00:5:dd1f:dcc0:93a1
2606:4700::6811:f1cc
52.216.132.181
52.216.165.197
52.72.175.22
18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b
23714601639230b9ad2bc2728040a5e760fa5b0500dfb76e552bcb29fcbb7a62
44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4
55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591
617f793d125f780ab7bb7c9e92ab427d9e757083e7368e241e8e8fa69f013e4f
65149b7afd0ccfdea4cb383944a47825f33b1a80b092eca6f74cb01f0c186809
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
8fb60fa65202b23e887ab8e836865374d97ef12b1e41d0ddc9ce8f412cbf89ad
954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe
a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5
b02cffc112737ba0eb6659534f4d2ef29dd2bdf135b2ee71eddb278dc16a3158
be3a32c7f4a31d20ca24bbf29e61a01ef4e11a8136985cdf6c147afe93bb9ba1
c846698cc448da3901ed709b89a3a0e103b90c500d8ac60d210865616057059d
e81e2779a8d59c05af0ff8469ad60a3c8bbbe31805ac48bc0e50bfffce1aa45f
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9