knowbe4.zoom.us
Open in
urlscan Pro
3.235.72.190
Malicious Activity!
Public Scan
Effective URL: https://knowbe4.zoom.us/zoomconference?m=OTk2MjY2NDAwODg.rO-RBTpXI6ZZniF6EDxEWI91roPu5YcV&_x_zm_rtaid=nDDb0K1uR9C6jlqtyf...
Submission Tags: phishing malicious Search All
Submission: On March 30 via api from US
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 24th 2020. Valid for: 2 years.
This is the only time knowbe4.zoom.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Phishing Simulation (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:10:... 2606:4700:10::6814:f774 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 4 | 3.235.72.190 3.235.72.190 | 14618 (AMAZON-AES) (AMAZON-AES) | |
10 | 13.226.159.109 13.226.159.109 | 16509 (AMAZON-02) (AMAZON-02) | |
8 | 65.9.58.48 65.9.58.48 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 199.60.103.28 199.60.103.28 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
1 | 13.32.25.102 13.32.25.102 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 65.9.58.7 65.9.58.7 | 16509 (AMAZON-02) (AMAZON-02) | |
24 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-235-72-190.compute-1.amazonaws.com
knowbe4.zoom.us |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-109.dus51.r.cloudfront.net
st1.zoom.us |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-25-102.fra56.r.cloudfront.net
static.ada.support |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
zoom.us
1 redirects
knowbe4.zoom.us st1.zoom.us st3.zoom.us st2.zoom.us |
955 KB |
2 |
ada.support
static.ada.support rollout.ada.support |
42 KB |
1 |
knowbe4.com
www.knowbe4.com |
5 KB |
1 |
calendly.com
1 redirects
click.calendly.com |
220 B |
24 | 4 |
Domain | Requested by | |
---|---|---|
10 | st1.zoom.us |
knowbe4.zoom.us
st1.zoom.us |
5 | st3.zoom.us |
knowbe4.zoom.us
|
4 | knowbe4.zoom.us |
1 redirects
knowbe4.zoom.us
|
3 | st2.zoom.us |
knowbe4.zoom.us
|
1 | rollout.ada.support |
knowbe4.zoom.us
|
1 | static.ada.support |
knowbe4.zoom.us
|
1 | www.knowbe4.com |
knowbe4.zoom.us
|
1 | click.calendly.com | 1 redirects |
24 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
blog.zoom.us |
investors.zoom.us |
developers.zoom.us |
zoom.us |
support.zoom.us |
www.linkedin.com |
twitter.com |
www.youtube.com |
www.facebook.com |
www.instagram.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.zoom.us DigiCert SHA2 Secure Server CA |
2020-05-24 - 2022-06-01 |
2 years | crt.sh |
www.knowbe4.com Cloudflare Inc ECC CA-3 |
2020-08-16 - 2021-08-16 |
a year | crt.sh |
*.ada.support Amazon |
2021-03-02 - 2022-03-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://knowbe4.zoom.us/zoomconference?m=OTk2MjY2NDAwODg.rO-RBTpXI6ZZniF6EDxEWI91roPu5YcV&_x_zm_rtaid=nDDb0K1uR9C6jlqtyfsbkQ.1617135629867.2afaad6d1c094916c8652703ccf50c75&_x_zm_rhtaid=492
Frame ID: 5A225F72A90B523BF1D4F3B5A1663B90
Requests: 24 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://click.calendly.com/ls/click?upn=iv9HLNn5AOyjxPwviujPh6U5Gcfun5gNVsSJZrhEWy-2BX5Ue7Ca-2BI2zOoZlC...
HTTP 302
https://knowbe4.zoom.us/u/acB5srwiYW HTTP 302
https://knowbe4.zoom.us/zoomconference?m=OTk2MjY2NDAwODg.rO-RBTpXI6ZZniF6EDxEWI91roPu5YcV&_x_zm_rtai... Page URL
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Zoom Blog
Search URL Search Domain Scan URL
Title: Investors
Search URL Search Domain Scan URL
Title: Developer Platform
Search URL Search Domain Scan URL
Title: Zoom Virtual Backgrounds
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: Zoom on LinkedIn
Search URL Search Domain Scan URL
Title: Zoom on Twitter
Search URL Search Domain Scan URL
Title: Zoom on Youtube
Search URL Search Domain Scan URL
Title: Zoom on Facebook
Search URL Search Domain Scan URL
Title: Zoom on Instagram
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://click.calendly.com/ls/click?upn=iv9HLNn5AOyjxPwviujPh6U5Gcfun5gNVsSJZrhEWy-2BX5Ue7Ca-2BI2zOoZlCrErBo_rAb_uAGIKxVHnzoGVmPcnUwHmWcLkZUuXmkg32X7wpFOrcHnr3C975m1oUklDaXdS58-2FTxuHEBfbXbI9FU7jX5OoAI29xqNf1ghUGTBj6gLcTS17bYLHXMzcSe0xSgeSo4z-2B4dh8frEbSOULCAM3GWSen8S2CdTROaKDcZ7KCI7WhA1DECEgKZ-2B-2FAeSotriRIe6NrD1ld1QOpuL9PdY-2ByBDBvAa75zgjdjA6TW59kNqmWaUI2itiBCfqzAFQvNCQpwd6WfaHbIw0ozy3ItGsHMwl0w-3D-3D
HTTP 302
https://knowbe4.zoom.us/u/acB5srwiYW HTTP 302
https://knowbe4.zoom.us/zoomconference?m=OTk2MjY2NDAwODg.rO-RBTpXI6ZZniF6EDxEWI91roPu5YcV&_x_zm_rtaid=nDDb0K1uR9C6jlqtyfsbkQ.1617135629867.2afaad6d1c094916c8652703ccf50c75&_x_zm_rhtaid=492 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
zoomconference
knowbe4.zoom.us/ Redirect Chain
|
62 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
st1.zoom.us/static/94172/css/ |
195 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zoomconference.min.css
st1.zoom.us/static/94172/css/ |
21 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
csrf_js
knowbe4.zoom.us/ |
15 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notification.min.css
st1.zoom.us/static/94172/js/lib/vue/advanced/notification/ |
1 KB 926 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zoom-components.min.css
st1.zoom.us/static/94172/css/vue/ |
128 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popup-captcha.min.css
st3.zoom.us/static/94172/js/lib/vue/advanced/popup-captcha/ |
21 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KB4-logo.png
www.knowbe4.com/hs-fs/hubfs/html_file/files/img/ |
4 KB 5 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.min.js
st3.zoom.us/static/94172/js/lib/vue/ |
408 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zoom-components.min.js
st2.zoom.us/static/94172/js/lib/vue/ |
243 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popup-captcha.min.js
st3.zoom.us/static/94172/js/lib/vue/advanced/popup-captcha/ |
109 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
st1.zoom.us/static/94172/js/ |
224 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.message.min.js
st3.zoom.us/static/94172/js/app/ |
2 KB 855 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.tablesorter.min.js
st2.zoom.us/static/94172/js/lib/ |
22 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed.js
static.ada.support/ |
105 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
meeting_delete_dialog.min.css
st3.zoom.us/static/94172/css/meetings/ |
371 B 761 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notification.min.js
st1.zoom.us/static/94172/js/lib/vue/advanced/notification/ |
18 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
csrf_js
knowbe4.zoom.us/ |
54 B 3 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social_icons_footer.png
st1.zoom.us/static/94172/image/new/home/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Lato-Regular.woff2
st1.zoom.us/static/94172/fonts/lato/ |
178 KB 179 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Lato-Semibold.woff2
st1.zoom.us/static/94172/fonts/lato/ |
180 KB 180 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cdn-detect.png
st2.zoom.us/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.json
rollout.ada.support/zoom/ |
7 KB 8 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Lato-Italic.woff2
st1.zoom.us/static/94172/fonts/lato/ |
191 KB 192 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Phishing Simulation (Internet)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| resourceAccountIdRoutingURl object| dataLayer string| sctyName function| ready function| createCookie function| readCookie function| delCookie boolean| isFreeAccount object| SB function| Vue object| webpackJsonpZoomUI object| __core-js_shared__ object| ZoomUI object| PopupCaptcha string| routingUrl string| hCaptchaSiteKey boolean| isCN boolean| isSupportGoogleCaptcha boolean| isSupportGoogleCaptchaForCN boolean| isSupportHcaptcha boolean| isSmartCaptcha boolean| isHcaptcha function| $ function| jQuery number| weSnsType object| adaSettings object| core object| adaEmbed object| cookieLang object| Notification function| ga object| dict object| args11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
knowbe4.zoom.us/ | Name: cred Value: 13F0390AA4F9EC08281E6779ADE7F18B |
|
.zoom.us/ | Name: _zm_currency Value: EUR |
|
.zoom.us/ | Name: _zm_csp_script_nonce Value: ycfVD7QCQTqUUzItMC5zXA |
|
.zoom.us/ | Name: _zm_mtk_guid Value: da853350168b430f95075f335b743dae |
|
.zoom.us/ | Name: _zm_chtaid Value: 492 |
|
.zoom.us/ | Name: _zm_lang Value: en-US |
|
.zoom.us/ | Name: _zm_ssid Value: aw1_c_WY6zyJaSTOCL4PUeAgyO2Q |
|
.zoom.us/ | Name: _zm_cdn_blocked Value: unlog_unblk |
|
.zoom.us/ | Name: _zm_ctaid Value: nDDb0K1uR9C6jlqtyfsbkQ.1617135629867.2afaad6d1c094916c8652703ccf50c75 |
|
.zoom.us/ | Name: _zm_page_auth Value: aw1_c_QI-0vOqcR-a6kBaxA_ws3A |
|
.zoom.us/ | Name: zm_gnl_guid_v2 Value: dffcDthCB_96TPJHtle3Y4DO7nftIn+Gop+VDu/b3IQM7+ad2QhIDe4EWnjS86vThm0EntLcOPpHZzaAl7K4IXE44A1ZBeEH44XRAMmw== |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests; default-src https://*.zoom.us https://zoom.us https://us01pbxstatic.zoom.us blob: 'self'; script-src 'unsafe-eval' 'unsafe-inline' blob: about: https://ruanshi2.8686c.com https://ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js https://appsforoffice.microsoft.com https://assets.zendesk.com https://autocomplete.demandbase.com https://cdn.wootric.com https://cdncache-a.akamaihd.net https://connect.facebook.net https://consent.trustarc.com https://d.adroll.mgr.consensu.org https://d2b9h3rz4xo53c.cloudfront.net https://d24cgw3uvb9a9h.cloudfront.net https://googleads.g.doubleclick.net https://pi.pardot.com https://s.dcbap.com https://s.ytimg.com https://s3.amazonaws.com https://scout-cdn.salesloft.com https://sealserver.trustwave.com https://secure-cdn.mplxtms.com https://serve2.cheqzone.com https://snap.licdn.com https://sp.analytics.yahoo.com https://static.zdassets.com https://static2.sharepointonline.com https://tag.demandbase.com https://tpc.googlesyndication.com https://tracking.g2crowd.com https://trk.techtarget.com https://www.comeet.co https://www.dropbox.com https://www.google-analytics.com https://static.zoom.com.cn https://www.googleadservices.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagmanager.com/* https://optimize.google.com https://tagmanager.google.com https://www.gstatic.com/recaptcha/releases/ https://www.gstatic.cn/recaptcha/releases/ https://google.com https://docs.google.com https://cse.google.com https://maps.google.com https://www.google.com https://www.recaptcha.net https://linkedin.com https://platform.linkedin.com https://px.ads.linkedin.com https://ads.linkedin.com https://www.youtube.com https://us01pbxstatic.zoom.us https://www.gstatic.com https://www.gstatic.cn https://fonts.googleapis.com https://hcaptcha.com https://assets.hcaptcha.com https://*.ada.support https://*.adroll.com https://*.hotjar.com https://*.zoom.us https://*.zoomcloudpbx.com https://*.zoomus.cn https://*.zopim.com https://adroll.com https://zoom.us https://apis.google.com https://gstatic.zoom.com.cn 'self'; img-src https: about: blob: data: 'self'; style-src https: safari-extension: chrome-extension: 'unsafe-inline' data: 'self'; font-src https: safari-extension: chrome-extension: blob: data: 'self'; connect-src * about: blob: data: 'self'; media-src * rtmp: blob: data: 'self'; frame-src https: ms-appx-web: zoommtg: zoomus: wvjbscheme: data: 'self'; object-src 'none'; base-uri 'none'; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
click.calendly.com
knowbe4.zoom.us
rollout.ada.support
st1.zoom.us
st2.zoom.us
st3.zoom.us
static.ada.support
www.knowbe4.com
13.226.159.109
13.32.25.102
199.60.103.28
2606:4700:10::6814:f774
3.235.72.190
65.9.58.48
65.9.58.7
18469af8742692a579fd449ba843827f5c7d51c7a4647c8f9e1a40f31491e6dc
271b8163a3ccda0ea83d4a13814a97d1fc2797c57fb363ca7d0e95e5e0df8a7c
2e6f50fb57c2eda10b124b8383f48528dc7eb2d28eca9f5d9c4aa52a279e1477
2ed0c4ff232af1652656a1c6f352b9aa8193d3fa2299266ea2653e9bc42fb251
30f77a5ff0bcba46d4e760b0c939a5ff112da0d3ddd13a261834134e00cc21c7
35157299bc01475db40dfee231541ffa082d437a8f5c556726438af25b28b2f8
3925701dcf6e1a6d843c0cfa742d0310ec8af0dded2c11e86282cd25cb847d39
4465765f2f6eddcdad34ffd7cab559e56bc0e75e45e192f85e9562b0771481dc
5c19f7fb839c2c3a1a65e9e7be3ad25addb601da4570b1f48ec2f664380d9257
627d08b4b72ae7a918cead726ccd0cbb59c76eece4051c7ae2353d21a5efb8cb
6b2544f22b1a2073fbd670af2971c3149c9d7f326b6f297ed4e305b515c445c5
701890c8eb3fd872c369bc3a9b522da654e852aefc0ca3ecf0f73965198e9308
7cb75b92281b6b5c3321f87d2eb9b107934f64cbffcac5ca64f2a4bf2f196c25
9079322e9bf63c28a38300dcb8b4380574404e86ec42ad58a0e6cb6afd70fc19
97cce6824527ac33d523c12ba651b24059981a16f4e4f227b54aefedfbbb9cf5
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
a67394b5849e496a457bc375c14f7441043cee097ae620482f404f9de6116828
a67800a6c88efcfa0bcf2b750775d21519ee27318bc97e62a66db31f53311653
aab248b0ee9094d0da6399a0b249e995163afd7668e9292ed9c85b54761595c2
ae17df15f37f143eb1e331e2e6df3de34d190f6873e6b047a13eba3c95989b80
d53239d0c9f5ec4407e3e9f72e970f8e48c4ca4e00e127550a30619636ddbdbb
ec446caab276ef2e74910eea6dddc859080d7a2fdcb17e3970b46a0e0ab030b6
f8999f7d33e44796974170f4fb409d601e33d6cc64357cb1d97cab14254d508e
ffccece2e45538083f7a55f39460f66b28d9fd2e969b5d7a3af716127277be2e