# PhishDestroy domain threat record: kunnskapsfilm.no

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kunnskapsfilm.no/
Machine-readable companion: https://phishdestroy.io/domain/kunnskapsfilm.no/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 21:43:04 UTC
- Last availability or vendor check: 2026-10-22 10:29:30 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 109.106.245.135
- Registrar in stored WHOIS data: Domeneshop AS
- Registrar country in stored WHOIS data: NORWAY
- Last stored HTTP status: 200
- Registration date (registry RDAP, kunnskapsfilm.no): 2019-02-09 12:55:29 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127c3-2714-704e-b346-6c3a542d7132/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kunnskapsfilm.no
- Certificate Transparency search: https://crt.sh/?q=%25.kunnskapsfilm.no
- Web Archive lookup: https://web.archive.org/web/*/https://kunnskapsfilm.no/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
kunnskapsfilm.no presents itself as Kunnskapsfilm, a Norwegian educational film service. Its page title reads "Kunnskapsfilm - For elever og lærere i grunnskole og videregående opplæring", which pitches it at pupils and teachers in primary, lower secondary and upper secondary schools. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-10-10. The site was still online with live content when last checked on 2026-10-19.

How the scam works
The page title matches what a genuine school resource would display, but PhishDestroy classifies the site as impersonation. Impersonation pages like this borrow a trusted name so that teachers and pupils lower their guard. They then ask visitors to log in, register or hand over personal details. In an education setting, the usual targets are school or learning-platform credentials, email logins and contact details. Attackers can reuse these to take over accounts or to send further phishing through a school's own channels.

Evidence
VirusTotal shows 5 of 92 engines flagging the domain as of 2026-10-16. The engines are alphaMountain.ai, BitDefender, G-Data, Gridinsoft and SOCRadar. That count is low, so most security tools will not yet warn a visitor who opens the site. The domain also appears in 37 AlienVault OTX threat pulses, which shows that analysts have repeatedly linked it to suspicious activity. Among blocklists, PhishDestroy currently lists it.

Infrastructure
The domain was registered on 2019-02-09 through Domeneshop AS, more than seven years before PhishDestroy flagged it. An address with that much history and a credible Norwegian name passes casual checks far more easily than a freshly registered lookalike. The site runs on Hostinger International Limited's network from servers in the Netherlands. Its free Let's Encrypt certificate means the padlock in the browser proves nothing about who operates the page.

What to do
If you entered a username and password on this site, change that password right away. Also change it on any school, Feide or email account where you used the same one, and turn on two-factor authentication. If you shared personal details, be wary of follow-up messages that mention Kunnskapsfilm or your school, and alert your school's IT contact. Teachers who passed the site to classes should tell pupils not to log in there. School IT and security teams should block the domain on their web filters and email gateways and check sign-in logs for unusual access since 2026-10-10. They should also report the site to Domeneshop AS and Hostinger for review.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127c3-2714-704e-b346-6c3a542d7132/
VirusTotal report: https://www.virustotal.com/gui/domain/kunnskapsfilm.no
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kunnskapsfilm.no
Archived copy: https://web.archive.org/web/20261010213923/https://kunnskapsfilm.no/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:56:56 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a127c3-2714-704e-b346-6c3a542d7132.png
  Captured: 2026-10-10 21:43:04 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127c3-2714-704e-b346-6c3a542d7132.png
  Captured: 2026-10-10 21:43:04 UTC
  Source report: https://urlscan.io/result/01a127c3-2714-704e-b346-6c3a542d7132/
- URLScan capture 2: https://urlscan.io/screenshots/01a0c1a2-4773-7130-9dd4-633cd44f6102.png
  Captured: 2026-10-10 21:35:52 UTC
  Source report: https://urlscan.io/result/01a127c3-2714-704e-b346-6c3a542d7132/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1397514c-a027-44c5-b561-5a8d5ea6871d.png
  Captured: 2026-10-12 11:51:48 UTC
  Source report: https://radar.cloudflare.com/scan/1397514c-a027-44c5-b561-5a8d5ea6871d
  SHA-256: 1657c4e6b4d57e271b7012cdebb2938315a9a7f4980d4e4549ee30c00406f158
- URLQuery: https://screenshots.phishdestroy.io/uq/83e06ae5-f4c4-4f5b-ac77-4086f2259002.png
  Source report: https://urlquery.net/report/83e06ae5-f4c4-4f5b-ac77-4086f2259002
  SHA-256: 570f2051b902d121429670df773cf92b2cb2fde83eb43b130256b9fb865aba78
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c1a2-4773-7130-9dd4-633cd44f6102.png
  Captured: 2026-09-21 01:43:59 UTC
  Source report: https://urlscan.io/result/01a0c1a2-4773-7130-9dd4-633cd44f6102/
  SHA-256: d31ad7f9e16bf5d8dadab2709b1c0c56d743a16f9db9a62fb5f010257a2767bb
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a150c7-543d-73e9-a14c-d3edec61df35.png
  Captured: 2026-10-18 20:50:09 UTC
  Source report: https://urlscan.io/result/01a150c7-543d-73e9-a14c-d3edec61df35/
  SHA-256: d5d027e65b6bd40f5a59321e8a1e92770fa478fa755c50de2137a73d2ef49ee7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:34:00Z",
        "uuid": "01a127c3-2714-704e-b346-6c3a542d7132",
        "scanned_at": "2026-10-10T21:41:16Z",
        "final_url": "https://kunnskapsfilm.no/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://kunnskapsfilm.no/",
                "from": "http://kunnskapsfilm.no/",
                "status": 307
            }
        ],
        "ip": "109.106.245.135",
        "domains": [
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.217.25.202",
            "109.106.245.135"
        ],
        "asns": [
            "15169",
            "47583"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "link_domains": [
            "leidar.no"
        ],
        "doc_hash": "0b4cee55318b355493844bfd82950b060bd2dde04c03cb06b5024a37705d1738",
        "script_hashes": [
            "e923165e0466e69b1e37ea031843f07029a2b4ce2f7aa133f807f020fea53217",
            "0a65b0a2f930ac72138c36aea669a3c760c93ce1093e52fb2c542d46f8d1ec61",
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "0aecf921d740d9f4636fcbf28d21bacb1a1fddc25f4a9f081f57eec5fe069f63",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "wpml_cookies",
            "cnArgs",
            "jQuery",
            "drop_down_menu",
            "soundFilePlaying",
            "utteranceSpeaking",
            "speakbuttons",
            "speakTxt",
            "playAudioFile",
            "stopUtteranceSpeaking",
            "stopSoundFilePlaying",
            "getTextContentWithoutExcludes",
            "html5",
            "Modernizr",
            "yepnope",
            "lunar",
            "balanceText",
            "_wpemojiSettings",
            "twemoji",
            "wp"
        ],
        "cookies": [
            "wp-wpml_current_language"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "kunnskapsfilm.no",
                "www.kunnskapsfilm.no"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "kunnskapsfilm.no",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-07T18:33:04Z",
            "valid_from": "2026-10-09T18:33:05Z"
        },
        "domain_age_days": 2759,
        "apex_age_days": 2759,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 1,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.33",
            "content-security-policy": "upgrade-insecure-requests"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:20Z",
        "uuid": "1397514c-a027-44c5-b561-5a8d5ea6871d",
        "scanned_at": "2026-10-12T11:51:48Z",
        "final_url": "https://kunnskapsfilm.no/",
        "status": 200,
        "history": [
            {
                "url": "https://kunnskapsfilm.no/",
                "status": 200
            }
        ],
        "dom_hash": "75e5b319e0c3e42b3f445d2c732105327b30b079d6ec8a5e02342fc8ddf6967a",
        "doc_hash": "cb7fdfc032c2265a2d75d9545bd857236ac01a45b22df32052cdb4cd906cd77e",
        "domain_risks": [
            "Movies",
            "Entertainment"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "kunnskapsfilm.no",
                "type": "A",
                "value": "109.106.245.135"
            }
        ],
        "dnssec_valid": true,
        "ip": "109.106.245.135",
        "whois": {
            "registrar": "Domeneshop AS",
            "created": "2019-02-09T12:55:29Z",
            "updated": "2026-05-06T08:03:27Z",
            "nameservers": [
                "ns1.hyp.net",
                "ns3.hyp.net",
                "ns2.hyp.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:39:10Z",
        "analysis_at": "2026-10-20T02:00:20Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "G-Data": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "malware",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "porn",
            "alphaMountain.ai": "Education, Phishing, Video/Multimedia (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "educational materials"
        },
        "popularity": {
            "Alexa": 647019,
            "Statvoo": 647019,
            "Cloudflare Radar": 1000000
        },
        "first_seen": "2023-10-05T12:33:16Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx.domeneshop.no",
                "priority": 10
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns2.hyp.net"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:_spf.domeneshop.no ~all"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns3.hyp.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "109.106.245.135"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.domeneshop.no",
                "value": "ns1.hyp.net"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns1.hyp.net"
            }
        ],
        "dns_at": "2026-10-20T02:00:36Z",
        "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a",
        "cert": {
            "san": [
                "kunnskapsfilm.no",
                "www.kunnskapsfilm.no"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5e1292ff81a45ca48b3a6841bfd5a674bb9",
            "sha256": "950d590c7a06e6c3b50dd721e5da319667ba77bd7f04b4d58a05b3ef8d6bac28",
            "subject": "kunnskapsfilm.no",
            "valid_to": "2027-01-07T18:33:04Z",
            "valid_from": "2026-10-09T18:33:05Z"
        },
        "whois": {
            "dnssec": "Signed"
        },
        "rdap": {
            "events": {
                "last changed": "2026-05-06T08:03:27Z",
                "registration": "2019-02-09T12:55:29Z"
            },
            "registrar": "Domeneshop AS",
            "registrar_iana_id": "930834408"
        }
    }
}
```