![](/screenshots/65c3413b-abe4-42e4-82b7-a84a7647a50f.png)
posti.redirectme.net
Open in
urlscan Pro
85.209.134.115
Malicious Activity!
Public Scan
Effective URL: https://posti.redirectme.net/posti.php
Submission: On October 28 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 27th 2022. Valid for: 3 months.
This is the only time posti.redirectme.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: S-Pankki (Banking) FI Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 22 | 85.209.134.115 85.209.134.115 | 211252 (AS_DELIS) (AS_DELIS) | |
2 | 52.222.214.14 52.222.214.14 | 16509 (AMAZON-02) (AMAZON-02) | |
23 | 2 |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-14.fra56.r.cloudfront.net
todentaminen.posti.fi |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
redirectme.net
1 redirects
posti.redirectme.net |
132 KB |
2 |
posti.fi
todentaminen.posti.fi |
5 KB |
23 | 2 |
Domain | Requested by | |
---|---|---|
22 | posti.redirectme.net |
1 redirects
posti.redirectme.net
|
2 | todentaminen.posti.fi |
posti.redirectme.net
|
23 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.posti.fi |
Subject Issuer | Validity | Valid | |
---|---|---|---|
posti.redirectme.net R3 |
2022-10-27 - 2023-01-25 |
3 months | crt.sh |
prd.auth.posticloud.fi Amazon |
2022-03-31 - 2023-04-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://posti.redirectme.net/posti.php
Frame ID: 4E4B6CFC2084790E1BD350D4C94358B9
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/65c3413b-abe4-42e4-82b7-a84a7647a50f.png)
Page Title
PostiPage URL History Show full URLs
-
http://posti.redirectme.net/posti.php
HTTP 301
https://posti.redirectme.net/posti.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Ehdot
Search URL Search Domain Scan URL
Title: Tietosuoja
Search URL Search Domain Scan URL
Title: Tuki
Search URL Search Domain Scan URL
Title: Ehdot
Search URL Search Domain Scan URL
Title: Tietosuoja
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://posti.redirectme.net/posti.php
HTTP 301
https://posti.redirectme.net/posti.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
posti.php
posti.redirectme.net/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
posti.redirectme.net/assets/bootstrap/css/ |
160 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
posti.redirectme.net/assets/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
view.js
posti.redirectme.net/assets/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
posti.redirectme.net/assets/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xhr.js
posti.redirectme.net/assets/ |
1 KB 883 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
posti_common.js
posti.redirectme.net/assets/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
posti.redirectme.net/assets/bootstrap/js/ |
58 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo
todentaminen.posti.fi/uas/template/postifi/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default_page_icon
todentaminen.posti.fi/uas/template/postifi/resource/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
saastro.svg
posti.redirectme.net/assets/ |
16 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
handels.svg
posti.redirectme.net/assets/ |
4 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
danske.png
posti.redirectme.net/assets/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
omasp.svg
posti.redirectme.net/assets/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pop.svg
posti.redirectme.net/assets/ |
15 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s-bank-fi.svg
posti.redirectme.net/assets/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aktia.png
posti.redirectme.net/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nordea.png
posti.redirectme.net/assets/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opfi.png
posti.redirectme.net/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aland.svg
posti.redirectme.net/assets/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
posti_background
posti.redirectme.net/uas/template/posti/resource/ |
283 B 283 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin.woff2
posti.redirectme.net/uas/template/posti/resource/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
online
posti.redirectme.net/user/ |
283 B 499 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: S-Pankki (Banking) FI Government (Government)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| View function| OnWindowLoad function| AutoFocus function| OnSubmitClick function| DisableSubmit function| disableEnterKeyAndFocus function| addEventHandler function| getFirstNodeValue number| uidEvent object| bootstrap2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
todentaminen.posti.fi/ | Name: AWSALB Value: H3d132w+gSQC6k1UWJwrlZIBhN3W49768Gmu5vQK/zqAtUEMC71iWJBO68qOAAjz2L6+cDoEcQ6K2DZoKD3jTWGOwURqdBCtLdwruH4P3NRQkFUJJ5Rdf574HS+w |
|
todentaminen.posti.fi/ | Name: AWSALBCORS Value: H3d132w+gSQC6k1UWJwrlZIBhN3W49768Gmu5vQK/zqAtUEMC71iWJBO68qOAAjz2L6+cDoEcQ6K2DZoKD3jTWGOwURqdBCtLdwruH4P3NRQkFUJJ5Rdf574HS+w |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
posti.redirectme.net
todentaminen.posti.fi
52.222.214.14
85.209.134.115
2ad3016e00a223ccc762ac24e5bd7e5ce59a06367e905c4d9ddc38394b41e515
2c45e1451b593ef13e12a2207c0f0ff90765d4e7f1ed8fa1e961bc1a3f482f66
596af74d8179ebc97c9c5ccae92fd4659c561709f5146064d58ebda10f59eae3
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
633b4a046fb174bf6b163b2538f1b8af7875290a2285d2755d1b7557aba479ac
70c3d690bdc5ce3b9a1527c46044989a3176e610882fa99f4523e75bc395bcce
70e00ddd49737eb28461160925c45c922b87a4273102e12729ec429218e866df
7134918e8cbec0d57679fab0a87ea10a1679a7314d244edbe5632f7fdad1ae34
7580610c4fb6114acc1606a3adfcb0ed60e774345537563dd7681cd2158af5f6
7f8104895c39f5fc5755e66be00a09da7b8820285e71b2503457b5b0c3e30632
8bcc7daad200a677d61858100bee13893d34981ea3103dd7453f0e5e9719d57f
963b56b456a2894648d641ac2123fe07a7d391b44b8bd978148fe48c7b9df277
98246d2647b0a73e9418148a9c9593eb9c31315632c884eb381a0efbd88a36b9
9e237344b18f7f0084cce23f540de53ae79136d9dac59c4f438439266fdbab83
b930ee05cd1f71d674780884e9f5f5452b09fb1f4ee9b72be0ea572abc803c61
bb4bc0e2888635579d67ef5d4ce71fd440c0e381854b2d0c8d63c5691d137128
bba5a6187feba2accccb2b87e9165bae488e1f16c03334d011b25d2e65e3d5bf
c6148bcc5413941b38af824d0152a5a72993ab1f5900b32637b905296227e2d4
d47958fd26ce03af9e7c0dfb4dc15c713041a9aa50f8ed91d59a8bdb4d8254cf
e77180ce5a2fc5dba86aaf8621d09f584459bf4f3b0694838f79f6e1df77733b
f549b7f82c657c6667a9307218885710788ce71d4349b6a8b74abd8eb19be6ae