suomitunnistus.live
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://suomitunnistus.live/
Submission Tags: https://phish.report @phish_report Search All
Submission: On July 16 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by E1 on July 14th 2022. Valid for: 3 months.
This is the only time suomitunnistus.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: FI Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 52.222.214.14 52.222.214.14 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 52.30.29.9 52.30.29.9 | 16509 (AMAZON-02) (AMAZON-02) | |
22 | 3 |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-14.fra56.r.cloudfront.net
todentaminen.posti.fi |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-29-9.eu-west-1.compute.amazonaws.com
tunnistautuminen.suomi.fi |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
suomitunnistus.live
1 redirects
suomitunnistus.live |
82 KB |
4 |
suomi.fi
tunnistautuminen.suomi.fi |
21 KB |
2 |
posti.fi
todentaminen.posti.fi |
5 KB |
22 | 3 |
Domain | Requested by | |
---|---|---|
17 | suomitunnistus.live |
1 redirects
suomitunnistus.live
|
4 | tunnistautuminen.suomi.fi |
suomitunnistus.live
|
2 | todentaminen.posti.fi |
suomitunnistus.live
|
22 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.posti.fi |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.suomitunnistus.live E1 |
2022-07-14 - 2022-10-12 |
3 months | crt.sh |
prd.auth.posticloud.fi Amazon |
2022-03-31 - 2023-04-29 |
a year | crt.sh |
tunnistautuminen.suomi.fi Amazon |
2021-11-01 - 2022-11-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://suomitunnistus.live/
Frame ID: 0790CFEAB8B28111F20BA5FDEB5CDDDA
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
PostiPage URL History Show full URLs
-
http://suomitunnistus.live/
HTTP 301
https://suomitunnistus.live/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Ehdot
Search URL Search Domain Scan URL
Title: Tietosuoja
Search URL Search Domain Scan URL
Title: Tuki
Search URL Search Domain Scan URL
Title: Ehdot
Search URL Search Domain Scan URL
Title: Tietosuoja
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://suomitunnistus.live/
HTTP 301
https://suomitunnistus.live/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
suomitunnistus.live/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
suomitunnistus.live/bootstrap/css/ |
160 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
suomitunnistus.live/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
view.js
suomitunnistus.live/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
suomitunnistus.live/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xhr.js
suomitunnistus.live/ |
1 KB 825 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
posti_common.js
suomitunnistus.live/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
suomitunnistus.live/bootstrap/js/ |
58 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo
todentaminen.posti.fi/uas/template/postifi/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default_page_icon
todentaminen.posti.fi/uas/template/postifi/resource/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
saastro.svg
suomitunnistus.live/ |
16 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
handels.svg
suomitunnistus.live/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
danske.png
suomitunnistus.live/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
omasp.svg
suomitunnistus.live/ |
6 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pop.svg
suomitunnistus.live/ |
15 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spankki_button_150x70.png
tunnistautuminen.suomi.fi/resources/images/bank_buttons/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nordea_button_164x70.png
tunnistautuminen.suomi.fi/resources/images/bank_buttons/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
osuuspankki_button_127x70.png
tunnistautuminen.suomi.fi/resources/images/bank_buttons/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Aktia20_logo.png
tunnistautuminen.suomi.fi/resources/images/bank_buttons/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
posti_background
suomitunnistus.live/uas/template/posti/resource/ |
282 B 282 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
montserrat-latin.woff2
suomitunnistus.live/uas/template/posti/resource/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
online
suomitunnistus.live/user/ |
282 B 725 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: FI Government (Government)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| View function| OnWindowLoad function| AutoFocus function| OnSubmitClick function| DisableSubmit function| disableEnterKeyAndFocus function| addEventHandler function| getFirstNodeValue number| uidEvent object| bootstrap2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
todentaminen.posti.fi/ | Name: AWSALB Value: +azwN2+zhY3OYaV+84elMB3evJatvWxhaQUvft+Oo51OUVzTa2x9pufSRIwIHD3XJi5Lvo5DaTkdUCVOhBSkhPE1iKVUnxqHpevIoXIFzwFQFayB/joW/8T72sIf |
|
todentaminen.posti.fi/ | Name: AWSALBCORS Value: +azwN2+zhY3OYaV+84elMB3evJatvWxhaQUvft+Oo51OUVzTa2x9pufSRIwIHD3XJi5Lvo5DaTkdUCVOhBSkhPE1iKVUnxqHpevIoXIFzwFQFayB/joW/8T72sIf |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
suomitunnistus.live
todentaminen.posti.fi
tunnistautuminen.suomi.fi
2a06:98c1:3120::3
52.222.214.14
52.30.29.9
1270a60a136b75077a4692e70ab6765257c240e240c15bad8edc66afae351f2d
2ad3016e00a223ccc762ac24e5bd7e5ce59a06367e905c4d9ddc38394b41e515
2d34defd9d666208dbf43eb4c26c857c44fae6c94e74f80a33e3cded82a9736b
596af74d8179ebc97c9c5ccae92fd4659c561709f5146064d58ebda10f59eae3
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
633b4a046fb174bf6b163b2538f1b8af7875290a2285d2755d1b7557aba479ac
70c3d690bdc5ce3b9a1527c46044989a3176e610882fa99f4523e75bc395bcce
7134918e8cbec0d57679fab0a87ea10a1679a7314d244edbe5632f7fdad1ae34
7580610c4fb6114acc1606a3adfcb0ed60e774345537563dd7681cd2158af5f6
7d589daf748aeaed583797a20cd7f3c7be56e25c49d7cbf6f0f779c46ab6b18f
7f8104895c39f5fc5755e66be00a09da7b8820285e71b2503457b5b0c3e30632
946aa215396257ceaea84e0e0d52be8c41e76eef1b38833d402d74a461257aa7
963b56b456a2894648d641ac2123fe07a7d391b44b8bd978148fe48c7b9df277
98246d2647b0a73e9418148a9c9593eb9c31315632c884eb381a0efbd88a36b9
9e237344b18f7f0084cce23f540de53ae79136d9dac59c4f438439266fdbab83
b930ee05cd1f71d674780884e9f5f5452b09fb1f4ee9b72be0ea572abc803c61
bb4bc0e2888635579d67ef5d4ce71fd440c0e381854b2d0c8d63c5691d137128
bba5a6187feba2accccb2b87e9165bae488e1f16c03334d011b25d2e65e3d5bf
d47958fd26ce03af9e7c0dfb4dc15c713041a9aa50f8ed91d59a8bdb4d8254cf
e77180ce5a2fc5dba86aaf8621d09f584459bf4f3b0694838f79f6e1df77733b