![](/screenshots/80f57693-b08b-44bc-8d23-de89e9704bc8.png)
salesforce.kinectrics.com
Open in
urlscan Pro
2a02:26f0:6c00:180::680d
Malicious Activity!
Public Scan
Submission: On March 03 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on February 29th 2020. Valid for: 3 months.
This is the only time salesforce.kinectrics.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Salesforce (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 2a02:26f0:6c0... 2a02:26f0:6c00:180::680d | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 184.31.87.156 184.31.87.156 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
14 | 2 |
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-87-156.deploy.static.akamaitechnologies.com
c.salesforce.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
kinectrics.com
salesforce.kinectrics.com |
87 KB |
1 |
salesforce.com
c.salesforce.com |
|
14 | 2 |
Domain | Requested by | |
---|---|---|
13 | salesforce.kinectrics.com |
salesforce.kinectrics.com
|
1 | c.salesforce.com |
salesforce.kinectrics.com
|
14 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.salesforce.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
prod.7.slot.cdn.salesforce-communities.com Let's Encrypt Authority X3 |
2020-02-29 - 2020-05-29 |
3 months | crt.sh |
c.salesforce.com GeoTrust RSA CA 2018 |
2019-03-26 - 2020-06-24 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://salesforce.kinectrics.com/
Frame ID: 155326DF2BA2A82A5E049452910059C0
Requests: 12 HTTP requests in this frame
Frame:
https://c.salesforce.com/login-messages/promos.html
Frame ID: 3FDBF885C90B417483F295BE2A0152CF
Requests: 2 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Try for Free
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
salesforce.kinectrics.com/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sfdc_210.css
salesforce.kinectrics.com/css/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SfdcSessionBase208.js
salesforce.kinectrics.com/jslibrary/ |
16 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LoginHint208.js
salesforce.kinectrics.com/jslibrary/ |
19 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo214.svg
salesforce.kinectrics.com/img/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clear.png
salesforce.kinectrics.com/img/ |
477 B 627 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
baselogin.js
salesforce.kinectrics.com/jslibrary/ |
640 B 625 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1384
salesforce.kinectrics.com/marketing/survey/survey1/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1384
salesforce.kinectrics.com/marketing/survey/survey4/ |
18 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.gif
salesforce.kinectrics.com/ Frame 3FDB |
43 B 192 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SalesforceSans-Regular.woff2
salesforce.kinectrics.com/login/assets/fonts/SalesforceSans/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SalesforceSans-Light.woff2
salesforce.kinectrics.com/login/assets/fonts/SalesforceSans/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
promos.html
c.salesforce.com/login-messages/ Frame 3FDB |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
capslock_blue.png
salesforce.kinectrics.com/img/icon/ |
559 B 709 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Salesforce (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| SFDCSessionVars function| SfdcFramework object| Sfdc object| SfdcApp object| DomainSwitcher object| IdpOptions object| LoginHint function| loader function| checkCaps function| handleLogin function| lazyload1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
salesforce.kinectrics.com/ | Name: QCQQ Value: 4fEZJxzyYhW |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.salesforce.com
salesforce.kinectrics.com
184.31.87.156
2a02:26f0:6c00:180::680d
02c47d1fb4a92fd6eca59ed828b0d0d7a8ef8285688bd27f36b1e003ffa9a52c
1f1752651aca663f40e45c60e182172fc426a40df042098f6e68a56db2c459f3
1ffebe9e4f604c89adbd9fb2f9141730ea487256cb5cf185b6c7f2c31cc33725
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
42a531dce996297d2a03cb33044b36408821072ad24b9477a237bd8a3ed6ebf7
6a49bd5b8fa631e313f1371a3338b557f8a2d5b3437afaa7b2f1a0fca9e82c39
6effaae73ce83316d1356ea984e417519743bce7a23982f053b1b8ec82135dae
a48f997fa23140662c20f7a46e93cefcef071fbf81ce038067582f2d822d86d5
b7df2d6cb9d0ecda707a1de1302b3c9d9bda16247dc382e696579a8308d49771
d5ac3358bf842fd7f3753f56dd9d175ec0bab30ef2be083906e1dc3597cf79c2
dd464055be78eadee2d5d3ecc5380600b788883e462d9e77372877dc04110e6d
f1319ff2c12c90286e7e8728932b032548a753a9ac7f01927b99814b2707ed97
fcbfcc1886467917ad6333d95a59fd92ad22c69b1509c75ebc6b2d7a10e14cf8