training.phriendlyphishing.com
108.158.32.50 Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
http://userid-81d.ws/ 6yr old
Effective URL:
https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html 8yr old
Submission: On April 29 via manual (April 29th 2025, 11:10:08 pm UTC) from AU — Scanned from AU

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 21 HTTP transactions. The main IP is 108.158.32.50, located in United States and belongs to AMAZON-02, US. The main domain is training.phriendlyphishing.com. 8yr old
TLS certificate: Issued by Amazon RSA 2048 M02 on October 8th 2024. Valid for: 1yr.

This is the only time training.phriendlyphishing.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Phishing Simulation (Internet)

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.67.110.91 18.67.110.91	16509 (AMAZON-02) (AMAZON-02)
19	108.158.32.50 108.158.32.50	16509 (AMAZON-02) (AMAZON-02)
2	18.67.110.37 18.67.110.37	16509 (AMAZON-02) (AMAZON-02)
21	3

1 18.67.110.91 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-67-110-91.syd62.r.cloudfront.net

userid-81d.ws 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

19 108.158.32.50 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-158-32-50.syd3.r.cloudfront.net

training.phriendlyphishing.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 18.67.110.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-110-37.syd62.r.cloudfront.net

metrics.articulate.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
19	phriendlyphishing.com training.phriendlyphishing.com 8yr old	777 KB
2	articulate.com metrics.articulate.com — Cisco Umbrella Rank: 20382 8yr old	490 B
1	userid-81d.ws 1 redirects userid-81d.ws 6yr old	1 KB
21	3

	Domain	Requested by
19	training.phriendlyphishing.com	training.phriendlyphishing.com
2	metrics.articulate.com	training.phriendlyphishing.com
1	userid-81d.ws	1 redirects
21	3

This site contains no links.

Subject Issuer	Validity	Valid
training.phriendlyphishing.com Amazon RSA 2048 M02	`2024-10-08` - `2025-11-06`	1yr	crt.sh
articulate.com Amazon RSA 2048 M03	`2024-07-26` - `2025-08-24`	1yr	crt.sh

This page contains 2 frames:

Primary Page: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html
Frame ID: F291A39457352130B1F67CD3ACC2BBF8
Requests: 25 HTTP requests in this frame

Frame: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/analytics-frame.html
Frame ID: A2258747078A4CA9059331A1745F9C2B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Simulation Link Expired

Page URL History Show full URLs

http://userid-81d.ws/ HTTP 307
https://userid-81d.ws/ HTTP 302
https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Page URL

Detected technologies

Paths.js (JavaScript graphics) Expand

Overall confidence: 100%
Detected patterns

paths(?:\.min)?\.js

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ruby on Rails (Web frameworks) Expand

Overall confidence: 75%
Detected patterns

React (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Page Statistics

21
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

848 kB
Transfer

2194 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://userid-81d.ws/ HTTP 307
https://userid-81d.ws/ HTTP 302
https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request story.html Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/ Redirect Chain http://userid-81d.ws/ https://userid-81d.ws/ https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html	7 KB 3 KB	836ms 258ms	Document text/html	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `cde2de58cf50b2affbad070c31545310d96a1b0f1653e5916287fc51e5957ebc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Response headers age 40758 content-encoding gzip content-type text/html date Tue, 29 Apr 2025 11:50:53 GMT etag W/"5b1ac56e51999716362b24737984a9c4" last-modified Wed, 28 Sep 2022 09:04:48 GMT server AmazonS3 vary accept-encoding via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-amz-cf-id HFgQajj1NFDcU-GqHjtk8akYsWvGGtbKET5AiurpeD7JA0CevaccIQ== x-amz-cf-pop SYD3-P2 x-cache Hit from cloudfront Redirect headers cache-control no-cache content-security-policy default-src https:; connect-src 'self' https:; font-src data: ; img-src data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; report-uri /csp_report?report_only=true content-type text/html; charset=utf-8 date Tue, 29 Apr 2025 23:10:09 GMT location https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html server Apache status 302 Found vary Origin via 1.1 74ae22067fef6f6228fb9f864f22f58a.cloudfront.net (CloudFront) x-amz-cf-id -bTWla-L0lKMEKxuiTXKiOMwtVh56tA3rn06vpzaKq-hAPVqQtZMRA== x-amz-cf-pop SYD62-P2 x-cache Miss from cloudfront x-content-type-options nosniff x-download-options noopen x-frame-options sameorigin x-permitted-cross-domain-policies none x-powered-by Phusion Passenger(R) 6.0.27 x-request-id 5bc7623c-6152-405e-a9e3-f8167db73148 x-runtime 0.024545 x-xss-protection 1; mode=block
GET H2	200	user.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story_content/	67 B 391 B	477ms 476ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story_content/user.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `7f2842721eb704c5dd8810dda0221c8f4f87b5743e0e28b9dafe55f0c114c004` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers etag "a85671704f0073177c1110ad8d5ff5ae" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 67 x-amz-cf-id _ZDkEYZE_U0Hbq9y5djHwm-PrFL1RriRsOhLwLBx8lmJ2i3yqEy9OA== date Tue, 29 Apr 2025 11:50:54 GMT content-type application/javascript last-modified Wed, 28 Sep 2022 09:03:24 GMT server AmazonS3 x-amz-cf-pop SYD3-P2
GET H2	200	output.min.css training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/css/	120 KB 73 KB	321ms 320ms	Stylesheet text/css	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/css/output.min.css Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `320a89566e2a438aa3dce47e0fd38462c04a5881fbb6fd8bd68a6bb46e154681` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers content-encoding br etag W/"fbdf733bcc1d76da5053f362befec37c" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id jRpcJY5mUPPX3hga0Pz2HnLDtxN_z4Bcwv-kH_WSqJShwA1Q2dxYeA== date Tue, 29 Apr 2025 11:50:54 GMT content-type text/css last-modified Wed, 28 Sep 2022 08:39:01 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	ds-bootstrap.min.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/	517 KB 154 KB	480ms 479ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `9b1cc45728d7609fd30b41ef8c908bffaa9d53eb27dba298eb4e0b0b9f6529ff` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers x-amz-cf-pop SYD3-P2 content-encoding br etag W/"f72b2483da1cf1a3a97c7b7d488395f8" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id 8P8S4mfLQeIzz1HCAC356YM4PquF4At6Ius1Rep9YrvBZwNc-uENEw== date Tue, 29 Apr 2025 11:50:54 GMT content-type application/javascript vary accept-encoding server AmazonS3 last-modified Wed, 28 Sep 2022 08:39:30 GMT x-amz-server-side-encryption AES256
GET H2	200	analytics-frame.html Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/ Frame A225	4 KB 2 KB	242ms 242ms	Document text/html	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/analytics-frame.html Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `3efd124f9ab9ca67e8975eaa24bda7491077f465caef02b8a0c97e9f47ad2aea` Request headers Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Response headers age 40758 content-encoding br content-type text/html date Tue, 29 Apr 2025 11:50:54 GMT etag W/"720f8fd109feb2d463d8870da8d58c54" last-modified Wed, 28 Sep 2022 09:04:39 GMT server AmazonS3 vary accept-encoding via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-amz-cf-id J1V3G80wkpXiuBvO3Ehl5nlB00UZl9j3OJHKbLHPZ7bzXhFr3KPlvg== x-amz-cf-pop SYD3-P2 x-cache Hit from cloudfront
GET H2	200	desktop.min.css training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/	75 KB 15 KB	293ms 292ms	Stylesheet text/css	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `81eb553107675b148b8a53eeb552bfc06c530fe23e9e47cdead9aba2d8a1e942` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers x-amz-cf-pop SYD3-P2 content-encoding br etag W/"287e05c0df257d2d18e1dca4e187e21c" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id IBStHWUCvfAO0cDoAuexApLp_01xN3Llu-l0DMy-XLWVlIl7ZZsiSg== date Tue, 29 Apr 2025 11:50:55 GMT content-type text/css vary accept-encoding server AmazonS3 last-modified Wed, 28 Sep 2022 08:39:53 GMT x-amz-server-side-encryption AES256
GET H2	200	ds-frame.desktop.min.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/	213 KB 42 KB	296ms 296ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-frame.desktop.min.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `22813a7f396bb750749214970cd1d1bbc66d4c37baac1d831e083ab1809f31b3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers content-encoding br etag W/"74b07897614195827b3ac812a97c5701" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id IPl3arfG32ZZRnQ-G_S8he-TafwYSpJZz20Ys9clQ97X9DD64ZuQ5A== date Tue, 29 Apr 2025 11:50:55 GMT content-type application/javascript last-modified Wed, 28 Sep 2022 08:39:36 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	frame.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/	53 KB 37 KB	278ms 278ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/frame.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `a70cd8485a6fa08adbc6920af94710ed1d2f0d84792f731c1c6b0af5f05cf532` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers x-amz-cf-pop SYD3-P2 content-encoding br etag W/"fbec9a3624cfe085fd59e59fdc40f489" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id Buum3yyOgsWPwJwcjMU0ysT6Q7Uc1GAlHZ_w_RsaF7TcvqQRnAa9aA== date Tue, 29 Apr 2025 11:50:55 GMT content-type application/javascript vary accept-encoding server AmazonS3 last-modified Wed, 28 Sep 2022 08:39:17 GMT x-amz-server-side-encryption AES256
GET H2	200	ds-slides.min.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/	863 KB 217 KB	320ms 320ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-slides.min.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `df4e54245b6bc4d83522efe818a114da3c58aa79bafe176a66f283ddcb7e1a20` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers x-amz-cf-pop SYD3-P2 content-encoding br etag W/"ec519920e1f2e05824de282845cc3867" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id 6CVueXSDG7S7jxgc11l9Rt9GGarr7KVNfv8TXuXMFne28VG7Nva_3w== date Tue, 29 Apr 2025 11:50:55 GMT content-type application/javascript vary accept-encoding server AmazonS3 last-modified Wed, 28 Sep 2022 08:39:48 GMT x-amz-server-side-encryption AES256
GET H2	200	data.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/	25 KB 4 KB	239ms 238ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/data.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `25e3b1640962fbec273054a1384cc7bfc33fe070d1cb76838a4448803d7deafd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers content-encoding br etag W/"07c6c1db5372c3a857d6c1a1967b614c" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id sPwtuYCt0GJYoolqL3z-TmULjFqvPds0Udehp66NF4sjt3V5r2rreQ== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/javascript last-modified Wed, 28 Sep 2022 08:39:12 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	paths.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/	15 KB 5 KB	258ms 258ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/paths.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `35507b492e04eebcc13f513da7f69b99a533b4bfeaa51de448bb8b8a426a0b4d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers content-encoding br etag W/"db331562487e9c9a16e9f8bc4b631bd9" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id UO7o7e7l33XQ4MeFX1STB6YO_lMlaygZ8Re8twjzaNYcrSGHKsqn9A== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/javascript last-modified Wed, 28 Sep 2022 08:39:22 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	open-sans-light.woff training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/	20 KB 21 KB	275ms 275ms	Font application/font-woff	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/open-sans-light.woff Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `a5d937d8ccd079f0088d8095ac27f8387ac099382a8201ab903962a37a41ca1d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Response headers etag "0d0d7107450f05b72a4507d0d7687dd1" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 20848 x-amz-cf-id cGoSbLswsCpt_P8rWYZFoyP6F9fU2-47sRFdEQPvJgEVQz8mvHLIZg== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/font-woff last-modified Wed, 28 Sep 2022 08:37:24 GMT server AmazonS3 x-amz-cf-pop SYD3-P2
GET H2	200	open-sans-regular.woff training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/	20 KB 20 KB	289ms 288ms	Font application/font-woff	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/open-sans-regular.woff Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `819747b05df4938922997e60e199603ecb04f4d987331ba5c3f7db30a835c3bd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Response headers etag "ce659615885f33d928eb7fe276574106" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 20248 x-amz-cf-id zN0Jng0J2uoM2fYcHykQNzBwaIwoaQfx9ybLpY-H1nM1SQVTQbx0wg== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/font-woff last-modified Wed, 28 Sep 2022 08:37:29 GMT server AmazonS3 x-amz-cf-pop SYD3-P2
GET H2	200	open-sans-bold.woff training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/	21 KB 21 KB	301ms 301ms	Font application/font-woff	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/mobile-fonts/open-sans-bold.woff Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `16c11e59500457a4d210e5584e57cdce82015483c1199119b562120e6510a67a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/stylesheets/desktop.min.css Response headers etag "72862e7cf19603ad24f26baf86dd0e08" age 40757 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 21028 x-amz-cf-id UfvD1IJMoSpHXn0qbzd951tfcM8RpjCzDRaCP8JFWEhwPOhgFvt4HA== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/font-woff last-modified Wed, 28 Sep 2022 08:37:19 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 x-amz-server-side-encryption AES256
GET DATA	200 OK	truncated /	9 KB 9 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `248cbf8685e89f4ef0953c5ee5200e3917fef3474d112bae108188df74802af2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	6 KB 6 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7761a71d24554d3e9dc15ed86dce882a537a8f1a6e16fe7e850ba0b0b17f5240` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	3 KB 3 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `03c53ec5e1e8fea30569e253b0edc00e45caf5a57bf25065e9eb6b93155e1d89` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	9 KB 9 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1e46475d6bb122673e51cbd12492592e83932c879e9e9fd8bf655b5c06766a58` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	9 KB 9 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `897ade79aeac8aae4e1483f8b70919c3faa945e7e101629b4da801e3c5099020` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	17 KB 17 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `44673e5a406a12a05e318a627e4024b7516ad8ad6e9b8ea84251587165b51de9` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	18 KB 18 KB		Font application/font-woff
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4bacc7da1e56b7a7e9200466e79a17db3acd9427e916a5cdd44c4ce2890e7bf6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Origin https://training.phriendlyphishing.com Referer Response headers Content-Type application/font-woff
GET H2	200	6mAli7uDFFi.js Show response training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/	11 KB 3 KB	240ms 240ms	Script application/javascript	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/data/js/6mAli7uDFFi.js Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/html5/lib/scripts/ds-bootstrap.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `eedd272a37a3a8e39e28fd3a5d9c17c7c06d181aa12d047e417250fe24f7b8de` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers content-encoding br etag W/"30c7d51825941d15e0225796f84f4336" age 40758 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id 4HX3y7ZDV3Bi3HA_tldUX1mVT62_0fzzRBj8zKm4HkSrqvlE0OSUag== date Tue, 29 Apr 2025 11:50:56 GMT content-type application/javascript last-modified Wed, 28 Sep 2022 08:39:07 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	favicon.ico training.phriendlyphishing.com/	4 KB 5 KB	258ms 258ms	Other image/x-icon	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Full URL https://training.phriendlyphishing.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `3e247115ab5d77c0f37fa40c5cb8a96735f35563d74721422bc41163b68f6fae` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers etag "8a3736fa5877c52c85c66a99fdbbcf9f" age 41488 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 4286 x-amz-cf-id C3G31fd2QfnA8qq-x6YZZ29FAsnlR6RWwRF7eruhusfq3IkJLlUAZg== date Tue, 29 Apr 2025 11:38:46 GMT content-type image/x-icon last-modified Wed, 28 Sep 2022 09:05:54 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 vary accept-encoding
GET H2	200	6YZa6fLFTdd_FFFFFF_P_0_526_1920_398_DX2700_DY2700_CX1488_CY309.png training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/	74 KB 74 KB	303ms 303ms	Image image/png	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Show image Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/6YZa6fLFTdd_FFFFFF_P_0_526_1920_398_DX2700_DY2700_CX1488_CY309.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `11398c4c899b082ffc321a86a57dddef642512c2ec29bc6739ed615d56a80b55` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers etag "be0fa3c4713ec55b7a81808bcd17eadd" age 40756 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 75513 x-amz-cf-id fqUSW8Kj8YNtOShynlxF41NQ0Of5WrB7HaQGKMmpNCMD73lOsxUqGA== date Tue, 29 Apr 2025 11:50:58 GMT content-type image/png last-modified Wed, 28 Sep 2022 09:03:15 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 x-amz-server-side-encryption AES256
GET H2	200	6YWoKSSNnuT_DX340_DY340_CX251_CY78.png training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/	11 KB 12 KB	341ms 341ms	Image image/png	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Show image Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/6YWoKSSNnuT_DX340_DY340_CX251_CY78.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `9893a08fe93268f65e7ed64e0f9aaf40ff5a2f7da085cc9a5b5eaf5a0f12b849` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers etag "7326d21d17837c907057ce0424c22c06" age 40756 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 11468 x-amz-cf-id sM-s7m9Vb7R_513_wz0WuVG8yJco-IlByrXTZT_ddQvLF81LNbKnsQ== date Tue, 29 Apr 2025 11:50:58 GMT content-type image/png last-modified Wed, 28 Sep 2022 09:03:10 GMT server AmazonS3 x-amz-cf-pop SYD3-P2
GET H2	200	6fhDxiV0YFn_DX1222_DY1222_CX916_CY723.png training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/	71 KB 71 KB	345ms 345ms	Image image/png	108.158.32.50 AMAZON-02
General Check archive.org Download Go to Show image Full URL https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/mobile/6fhDxiV0YFn_DX1222_DY1222_CX916_CY723.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.158.32.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-158-32-50.syd3.r.cloudfront.net Software AmazonS3 / Resource Hash `936f2d659c030eac72ad6ed2b310faff255f79d4deeede1e6d9021d61dd7c3d6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Referer https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html Response headers etag "b7b6e270c26af4c6bff060376463b1bd" age 40756 via 1.1 db487bbf70af29af96ef50a3f5b469d4.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 72374 x-amz-cf-id EVQFC170nk-FhDc3Bd0zfYo-VQvpDnD6GiprWQHX6KU50E4DkwQAcQ== date Tue, 29 Apr 2025 11:50:58 GMT content-type image/png last-modified Wed, 28 Sep 2022 09:03:05 GMT server AmazonS3 x-amz-cf-pop SYD3-P2 x-amz-server-side-encryption AES256
POST H2	200	import Show response metrics.articulate.com/v1/ Frame A225	21 B 490 B	295ms 293ms	XHR application/json	18.67.110.37 AMAZON-02
General Check archive.org Download Go to Full URL https://metrics.articulate.com/v1/import Requested by Host: training.phriendlyphishing.com URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/analytics-frame.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.67.110.37 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-67-110-37.syd62.r.cloudfront.net Software / Resource Hash `12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Content-Type application/json Referer https://training.phriendlyphishing.com/ Response headers x-amz-apigw-id JztdcEOcIAMEZWg= x-amzn-trace-id Root=1-68115c55-4d8f05287557ec3f75351432 access-control-allow-methods OPTIONS,POST x-amzn-requestid 4ea2aa43-76cd-41d7-931d-38179301cf32 via 1.1 dc7f2062b70b5b710c1b09d21b43f900.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 21 x-amz-cf-id I2ORIsClRnaX5SaEUOdkUt3Sf3RDGcGjSGX38TYB2YHXEpvRifyWmg== date Tue, 29 Apr 2025 23:10:13 GMT content-type application/json x-amz-cf-pop SYD62-P2 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
OPTIONS H2	200	import metrics.articulate.com/v1/ Frame	0 0	298ms 236ms	Preflight application/json	18.67.110.37 AMAZON-02
General Check archive.org Download Go to Full URL https://metrics.articulate.com/v1/import Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.67.110.37 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-67-110-37.syd62.r.cloudfront.net Software / Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://training.phriendlyphishing.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Tue, 29 Apr 2025 23:10:13 GMT via 1.1 dc7f2062b70b5b710c1b09d21b43f900.cloudfront.net (CloudFront) x-amz-apigw-id JztdaElvoAMEFdA= x-amz-cf-id 6-Wpidh7yXjhzz6pL2WLyhkQbGe5HhY7qg-yH9sOT3SwNYJfSj6Yqg== x-amz-cf-pop SYD62-P2 x-amzn-requestid ba9393d7-daa2-4623-a3eb-c6ed0d9b2b59 x-cache Miss from cloudfront

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishing Simulation (Internet)

94 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			userid-81d.ws/	1969-12-31 23:59:59	Name: XSRF-TOKEN Value: B-vuDC1Xp8lOAn5tWpdwgIovQIX7p-gCx8haze8qQv3xslL9R8RCRv2LqYblmSpc3gnIFf_nw--QCaFnnUD1qg
			userid-81d.ws/	1969-12-31 23:59:59	Name: _session_id Value: 9be3570c24b2177c714b4a7ebc08627c

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://training.phriendlyphishing.com/landing_pages/simulated_phishing_page/story.html(Line 142) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0B01C002C0B0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

metrics.articulate.com
training.phriendlyphishing.com
userid-81d.ws
108.158.32.50
18.67.110.37
18.67.110.91
03c53ec5e1e8fea30569e253b0edc00e45caf5a57bf25065e9eb6b93155e1d89
11398c4c899b082ffc321a86a57dddef642512c2ec29bc6739ed615d56a80b55
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
16c11e59500457a4d210e5584e57cdce82015483c1199119b562120e6510a67a
1e46475d6bb122673e51cbd12492592e83932c879e9e9fd8bf655b5c06766a58
22813a7f396bb750749214970cd1d1bbc66d4c37baac1d831e083ab1809f31b3
248cbf8685e89f4ef0953c5ee5200e3917fef3474d112bae108188df74802af2
25e3b1640962fbec273054a1384cc7bfc33fe070d1cb76838a4448803d7deafd
320a89566e2a438aa3dce47e0fd38462c04a5881fbb6fd8bd68a6bb46e154681
35507b492e04eebcc13f513da7f69b99a533b4bfeaa51de448bb8b8a426a0b4d
3e247115ab5d77c0f37fa40c5cb8a96735f35563d74721422bc41163b68f6fae
3efd124f9ab9ca67e8975eaa24bda7491077f465caef02b8a0c97e9f47ad2aea
44673e5a406a12a05e318a627e4024b7516ad8ad6e9b8ea84251587165b51de9
4bacc7da1e56b7a7e9200466e79a17db3acd9427e916a5cdd44c4ce2890e7bf6
7761a71d24554d3e9dc15ed86dce882a537a8f1a6e16fe7e850ba0b0b17f5240
7f2842721eb704c5dd8810dda0221c8f4f87b5743e0e28b9dafe55f0c114c004
819747b05df4938922997e60e199603ecb04f4d987331ba5c3f7db30a835c3bd
81eb553107675b148b8a53eeb552bfc06c530fe23e9e47cdead9aba2d8a1e942
897ade79aeac8aae4e1483f8b70919c3faa945e7e101629b4da801e3c5099020
936f2d659c030eac72ad6ed2b310faff255f79d4deeede1e6d9021d61dd7c3d6
9893a08fe93268f65e7ed64e0f9aaf40ff5a2f7da085cc9a5b5eaf5a0f12b849
9b1cc45728d7609fd30b41ef8c908bffaa9d53eb27dba298eb4e0b0b9f6529ff
a5d937d8ccd079f0088d8095ac27f8387ac099382a8201ab903962a37a41ca1d
a70cd8485a6fa08adbc6920af94710ed1d2f0d84792f731c1c6b0af5f05cf532
cde2de58cf50b2affbad070c31545310d96a1b0f1653e5916287fc51e5957ebc
df4e54245b6bc4d83522efe818a114da3c58aa79bafe176a66f283ddcb7e1a20
eedd272a37a3a8e39e28fd3a5d9c17c7c06d181aa12d047e417250fe24f7b8de

training.phriendlyphishing.com 108.158.32.50 Malicious Activity! Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

848 kBTransfer

2194 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

training.phriendlyphishing.com
108.158.32.50 Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

848 kB
Transfer

2194 kB
Size

2
Cookies

21 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!