us-phishalarm-ewt.proofpoint.com Open in urlscan Pro
18.210.104.232  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Show response us-phishalarm-ewt.proofpoint.com/EWT/v1/	15 KB 15 KB	431ms 210ms	Document text/html	18.210.104.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.104.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-104-232.compute-1.amazonaws.com Software nginx / Resource Hash ab3ffa637b128a0e84552409038a221bf1463adcc1aaa32f395c4db4ba157ec0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-type text/html; charset=utf-8 date Thu, 18 Aug 2022 15:24:58 GMT server nginx
GET H2	200	Site.css us-phishalarm-ewt.proofpoint.com/EWT/v1/	2 KB 2 KB	106ms 105ms	Stylesheet text/css	18.210.104.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Site.css Requested by Host: us-phishalarm-ewt.proofpoint.com URL: https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.104.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-104-232.compute-1.amazonaws.com Software nginx / Resource Hash 76f73c162d42346e4459aaf5756b14457496b4f768b3f86ea2ed09dd9a95a99d Request headers accept-language de-DE,de;q=0.9 Referer https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Thu, 18 Aug 2022 15:24:59 GMT last-modified Fri, 17 Jun 2022 17:39:14 GMT server nginx accept-ranges bytes etag "1d88271291b455e" content-length 2142 content-type text/css
GET H2	200	jquery-3.4.1.js Show response us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/	274 KB 274 KB	211ms 211ms	Script application/javascript	18.210.104.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/jquery-3.4.1.js Requested by Host: us-phishalarm-ewt.proofpoint.com URL: https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.104.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-104-232.compute-1.amazonaws.com Software nginx / Resource Hash 5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55 Request headers accept-language de-DE,de;q=0.9 Referer https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Thu, 18 Aug 2022 15:24:59 GMT last-modified Fri, 17 Jun 2022 17:39:14 GMT server nginx accept-ranges bytes etag "1d88271291f0a2c" content-length 280364 content-type application/javascript; charset=utf-8
GET H2	200	error_translations.js Show response us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/	70 KB 70 KB	107ms 106ms	Script application/javascript	18.210.104.232 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/error_translations.js Requested by Host: us-phishalarm-ewt.proofpoint.com URL: https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.104.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-104-232.compute-1.amazonaws.com Software nginx / Resource Hash bed11aaaff4bee65a98af6625a405340063b8caa8472d22723377bd6d1579b7c Request headers accept-language de-DE,de;q=0.9 Referer https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Thu, 18 Aug 2022 15:24:59 GMT last-modified Fri, 17 Jun 2022 17:39:14 GMT server nginx accept-ranges bytes etag "1d88271291a5563" content-length 71779 content-type application/javascript; charset=utf-8
GET H2	200	pfpt-logo.png us-phishalarm-ewt.proofpoint.com/EWT/v1/images/	6 KB 6 KB	298ms 297ms	Image image/png	18.210.104.232 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://us-phishalarm-ewt.proofpoint.com/EWT/v1/images/pfpt-logo.png Requested by Host: us-phishalarm-ewt.proofpoint.com URL: https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.104.232 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-104-232.compute-1.amazonaws.com Software nginx / Resource Hash 2840812a35e41980ae4a80cbe24c3eee5a7e49ba44170b69402e8490d8793fa1 Request headers accept-language de-DE,de;q=0.9 Referer https://us-phishalarm-ewt.proofpoint.com/EWT/v1/OSbXZkCOTw!2DzOlmwDlxYnIo8PALo0U1ZYFuGI6v8XGDRoBNHuNhMHW8f2R6qU87jwu3T3WJ6HdU-lbmrurjMAGSu4EXlpk_-DLXbpz3DK_EXDkQVQ$ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Thu, 18 Aug 2022 15:24:59 GMT last-modified Fri, 17 Jun 2022 17:39:14 GMT server nginx accept-ranges bytes etag "1d88271291b5b0b" content-length 5643 content-type image/png
JSON		DisplayPrompt us-phishalarm-ewt.securityeducation.com/api/Workflow/	0 0
OPTIONS H2	204	DisplayPrompt us-phishalarm-ewt.securityeducation.com/api/Workflow/	0 0	322ms 107ms	Preflight	184.73.164.240 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us-phishalarm-ewt.securityeducation.com/api/Workflow/DisplayPrompt Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.73.164.240 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-73-164-240.compute-1.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers access-control-allow-origin,x-pfpt-traceid Access-Control-Request-Method JSON Origin https://us-phishalarm-ewt.proofpoint.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers access-control-allow-headers access-control-allow-origin,x-pfpt-traceid access-control-allow-methods JSON access-control-allow-origin * date Thu, 18 Aug 2022 15:25:00 GMT server nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

us-phishalarm-ewt.securityeducation.com

URL

https://us-phishalarm-ewt.securityeducation.com/api/Workflow/DisplayPrompt

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery string| traceId string| workflowUrl string| decryptedParams string| displayPromptUrl string| defaultError string| token string| confirmationType object| localeMap object| ewt_actions function| checkCanBegin number| handle

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

us-phishalarm-ewt.proofpoint.com
us-phishalarm-ewt.securityeducation.com
us-phishalarm-ewt.securityeducation.com
18.210.104.232
184.73.164.240
2840812a35e41980ae4a80cbe24c3eee5a7e49ba44170b69402e8490d8793fa1
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
76f73c162d42346e4459aaf5756b14457496b4f768b3f86ea2ed09dd9a95a99d
ab3ffa637b128a0e84552409038a221bf1463adcc1aaa32f395c4db4ba157ec0
bed11aaaff4bee65a98af6625a405340063b8caa8472d22723377bd6d1579b7c