staysafe.sophos.com Open in urlscan Pro
192.0.66.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/
Submission: On May 27 via manual (May 27th 2020, 12:57:01 pm UTC) from US

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is staysafe.sophos.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 5th 2020. Valid for: 3 months.

This is the only time staysafe.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
8	192.0.66.2 192.0.66.2		2635 (AUTOMATTIC) (AUTOMATTIC)
8	1

8 192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

staysafe.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	sophos.com staysafe.sophos.com	151 KB
8	1

	Domain	Requested by
8	staysafe.sophos.com	staysafe.sophos.com
8	1

This site contains links to these domains. Also see Links.

Domain
www.sophos.com

Subject Issuer	Validity	Valid
dev.staysafe.sophos.com Let's Encrypt Authority X3	`2020-05-05` - `2020-08-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/
Frame ID: 1EF1A6408A4FE63DAB5F1D1C59420F11
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

151 kB
Transfer

459 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sophos.com/phish-threat
Title: Sophos

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response staysafe.sophos.com/course/basic-phishing-tips-interactive_en/	11 KB 4 KB	269ms 228ms	Document text/html	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash `b4482f6e9e57fd2be0cfb0bf6547db0d546e9702bf01004dcabedc243b4e9a72` Request headers :method GET :authority staysafe.sophos.com :scheme https :path /course/basic-phishing-tips-interactive_en/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server nginx date Wed, 27 May 2020 12:56:45 GMT content-type text/html; charset=UTF-8 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b set-cookie pll_language=en; expires=Thu, 27-May-2021 12:56:45 GMT; Max-Age=31536000; path=/ link <https://staysafe.sophos.com/wp-json/>; rel="https://api.w.org/" content-encoding gzip x-rq ams2 102 123 3122 age 0 x-cache miss accept-ranges bytes
GET H2	200	/ staysafe.sophos.com/_static/	213 KB 37 KB	16ms 14ms	Stylesheet text/css	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/phishthreat/assets/css/master.min.css,/wp-content/mu-plugins/jetpack/css/jetpack.css?m=1588866532 Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `6d0aaf0ec364f4e384cc261c415d7a3b1fab8ee0d682a7a9285f0a824128cd30` Request headers Referer https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 27 May 2020 12:56:46 GMT content-encoding gzip x-rq ams2 100 142 3118 last-modified Thu, 07 May 2020 15:48:54 GMT server nginx age 371890 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 status 200 cache-control max-age=31536000 accept-ranges bytes content-length 38131
GET H2	200	/ Show response staysafe.sophos.com/_static/	104 KB 37 KB	30ms 29ms	Script application/x-javascript	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZdVrKOPT4FubmZ6UWJJql5uZh5QsX2uraGphYWhhZmZiVEWACXMILc= Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `c6e31af3e9c2301dae74ec5ac1843274d4434df360f16f064836246b48949f6a` Request headers Referer https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 27 May 2020 12:56:46 GMT content-encoding gzip x-rq ams2 102 123 3122 last-modified Wed, 29 Apr 2020 18:57:22 GMT server nginx age 620717 vary Accept-Encoding x-cache hit content-type application/x-javascript status 200 cache-control max-age=31536000 accept-ranges bytes content-length 37495
GET H2	200	wp-emoji-release.min.js Show response staysafe.sophos.com/wp-includes/js/	14 KB 5 KB	14ms 13ms	Script application/x-javascript	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.1 Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea` Request headers Referer https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 27 May 2020 12:56:46 GMT content-encoding gzip x-rq ams2 102 224 3164 last-modified Wed, 29 Apr 2020 18:57:21 GMT server nginx age 2388647 etag W/"5ea9ce11-364d" vary Accept-Encoding x-cache hit content-type application/x-javascript status 200 cache-control max-age=31536000 accept-ranges bytes content-length 4693 expires Thu, 27 May 2021 12:56:46 GMT
GET H2	200	sophos-logo.png staysafe.sophos.com/wp-content/themes/phishthreat/assets/images/	4 KB 4 KB	15ms 14ms	Image image/png	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://staysafe.sophos.com/wp-content/themes/phishthreat/assets/images/sophos-logo.png Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `5940cb8b477258b23e3d3e2136f22ec12ff9d26964e54e81a4d4582ceb032169` Request headers Referer https://staysafe.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/phishthreat/assets/css/master.min.css,/wp-content/mu-plugins/jetpack/css/jetpack.css?m=1588866532 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 27 May 2020 12:56:46 GMT x-rq ams2 98 137 3153 last-modified Mon, 03 Feb 2020 16:04:56 GMT server nginx age 6584942 etag "5e3844a8-10dc" x-cache hit content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 4316 expires Thu, 27 May 2021 12:56:46 GMT
GET H2	200	secondary-logo.png staysafe.sophos.com/wp-content/themes/phishthreat/assets/images/	12 KB 12 KB	15ms 14ms	Image image/png	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://staysafe.sophos.com/wp-content/themes/phishthreat/assets/images/secondary-logo.png Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `8a4007fcbdbb05010eeb3b8401048e2c6aef424ff851d25c8409ffe08eb6f526` Request headers Referer https://staysafe.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/phishthreat/assets/css/master.min.css,/wp-content/mu-plugins/jetpack/css/jetpack.css?m=1588866532 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 27 May 2020 12:56:46 GMT x-rq ams2 102 107 3089 last-modified Tue, 18 Feb 2020 08:04:17 GMT server nginx age 6584942 etag "5e4b9a81-2fe0" x-cache hit content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 12256 expires Thu, 27 May 2021 12:56:46 GMT
GET H2	200	flama-book-webfont.ttf staysafe.sophos.com/wp-content/themes/phishthreat/assets/fonts/	50 KB 26 KB	109ms 109ms	Font application/font-ttf	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/wp-content/themes/phishthreat/assets/fonts/flama-book-webfont.ttf Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `d088c5e7ccc85feda2e2f398f4188c8c49f6c0178e75e2e758f9a9c4e3fddff0` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://staysafe.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/phishthreat/assets/css/master.min.css,/wp-content/mu-plugins/jetpack/css/jetpack.css?m=1588866532 Origin https://staysafe.sophos.com Response headers date Wed, 27 May 2020 12:56:46 GMT content-encoding gzip age 0 x-cache miss status 200 content-length 26279 x-rq ams2 100 142 3118 last-modified Thu, 07 May 2020 08:21:58 GMT server nginx etag "5eb3c526-c8f0" vary X-Mobile-Class, X-Query-Args, Accept-Encoding access-control-allow-methods GET, HEAD content-type application/font-ttf access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Thu, 27 May 2021 12:56:46 GMT
GET H2	200	flama-light-webfont.ttf staysafe.sophos.com/wp-content/themes/phishthreat/assets/fonts/	50 KB 26 KB	111ms 111ms	Font application/font-ttf	192.0.66.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://staysafe.sophos.com/wp-content/themes/phishthreat/assets/fonts/flama-light-webfont.ttf Requested by Host: staysafe.sophos.com URL: https://staysafe.sophos.com/course/basic-phishing-tips-interactive_en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash `1eee700208fddc9dbea7fd453e8a1dbaca020a9c0dedb43f985f3fd1ddcbda2d` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://staysafe.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/phishthreat/assets/css/master.min.css,/wp-content/mu-plugins/jetpack/css/jetpack.css?m=1588866532 Origin https://staysafe.sophos.com Response headers date Wed, 27 May 2020 12:56:46 GMT content-encoding gzip age 0 x-cache miss status 200 x-rq ams2 102 123 3122 last-modified Thu, 07 May 2020 07:22:23 GMT server nginx etag "5eb3b72f-c918" vary X-Mobile-Class, X-Query-Args, Accept-Encoding access-control-allow-methods GET, HEAD content-type application/font-ttf access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Thu, 27 May 2021 12:56:46 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			staysafe.sophos.com/	1970-01-19 18:35:20	Name: pll_language Value: en

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://staysafe.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZdVrKOPT4FubmZ6UWJJql5uZh5QsX2uraGphYWhhZmZiVEWACXMILc=(Line 8) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

staysafe.sophos.com
192.0.66.2
1eee700208fddc9dbea7fd453e8a1dbaca020a9c0dedb43f985f3fd1ddcbda2d
5940cb8b477258b23e3d3e2136f22ec12ff9d26964e54e81a4d4582ceb032169
6d0aaf0ec364f4e384cc261c415d7a3b1fab8ee0d682a7a9285f0a824128cd30
8a4007fcbdbb05010eeb3b8401048e2c6aef424ff851d25c8409ffe08eb6f526
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
b4482f6e9e57fd2be0cfb0bf6547db0d546e9702bf01004dcabedc243b4e9a72
c6e31af3e9c2301dae74ec5ac1843274d4434df360f16f064836246b48949f6a
d088c5e7ccc85feda2e2f398f4188c8c49f6c0178e75e2e758f9a9c4e3fddff0

staysafe.sophos.com Open in urlscan Pro 192.0.66.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

151 kBTransfer

459 kBSize

1 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

staysafe.sophos.com Open in urlscan Pro
192.0.66.2 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

151 kB
Transfer

459 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions