![](/screenshots/9b0c275e-ef05-46cc-9df5-4d79ebeb7f2e.png)
op-fi-korttisi.com
Open in
urlscan Pro
2606:4700:3036::ac43:c895
Malicious Activity!
Public Scan
Effective URL: https://op-fi-korttisi.com/pages
Submission: On July 29 via manual from IN — Scanned from FI
Summary
TLS certificate: Issued by GTS CA 1P5 on July 27th 2023. Valid for: 3 months.
This is the only time op-fi-korttisi.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 13 | 2606:4700:303... 2606:4700:3036::ac43:c895 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
op-fi-korttisi.com
4 redirects
op-fi-korttisi.com |
37 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
13 | op-fi-korttisi.com |
4 redirects
op-fi-korttisi.com
|
10 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
op-fi-korttisi.com GTS CA 1P5 |
2023-07-27 - 2023-10-25 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://op-fi-korttisi.com/pages
Frame ID: 54539D8E1DD6EBF3CE695A0FE25F7584
Requests: 6 HTTP requests in this frame
Frame:
https://op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/invisible.js
Frame ID: 1D92B317E6E9CD51CB4D13366BF39D61
Requests: 2 HTTP requests in this frame
Frame:
https://op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/invisible.js
Frame ID: C3EC8F824171DF60B0F15490AE8154EC
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/9b0c275e-ef05-46cc-9df5-4d79ebeb7f2e.png)
Page Title
404 Not FoundPage URL History Show full URLs
- http://op-fi-korttisi.com/pages Page URL
-
http://op-fi-korttisi.com/cdn-cgi/phish-bypass?atok=cLSbSWGrj_a5slmFCn7dbAQgyrADH1X09okIiuq2yrQ-169063...
HTTP 301
http://op-fi-korttisi.com/pages HTTP 301
https://op-fi-korttisi.com/pages Page URL
- https://op-fi-korttisi.com/pages Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://op-fi-korttisi.com/pages Page URL
-
http://op-fi-korttisi.com/cdn-cgi/phish-bypass?atok=cLSbSWGrj_a5slmFCn7dbAQgyrADH1X09okIiuq2yrQ-1690630607-0-%2Fpages
HTTP 301
http://op-fi-korttisi.com/pages HTTP 301
https://op-fi-korttisi.com/pages Page URL
- https://op-fi-korttisi.com/pages Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- http://op-fi-korttisi.com/cdn-cgi/phish-bypass?atok=cLSbSWGrj_a5slmFCn7dbAQgyrADH1X09okIiuq2yrQ-1690630607-0-%2Fpages HTTP 301
- http://op-fi-korttisi.com/pages HTTP 301
- https://op-fi-korttisi.com/pages
- https://op-fi-korttisi.com/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
- https://op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/invisible.js
- https://op-fi-korttisi.com/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
- https://op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/invisible.js
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
pages
op-fi-korttisi.com/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
op-fi-korttisi.com/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
op-fi-korttisi.com/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages
op-fi-korttisi.com/ Redirect Chain
|
16 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
pages
op-fi-korttisi.com/ |
0 727 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
invisible.js
op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/ Frame 1D92 Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
pages
op-fi-korttisi.com/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
7ee5110d7f00d999
op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 1D92 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
invisible.js
op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/11b725eb/ Frame C3EC Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
7ee5110f280c376c
op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame C3EC |
0 545 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- op-fi-korttisi.com
- URL
- https://op-fi-korttisi.com/cdn-cgi/challenge-platform/h/b/cv/result/7ee5110d7f00d999
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 012 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.op-fi-korttisi.com/ | Name: __cf_mw_byp Value: cLSbSWGrj_a5slmFCn7dbAQgyrADH1X09okIiuq2yrQ-1690630607-0-/pages |
|
op-fi-korttisi.com/ | Name: 8sUEl7lUOy0XX2_purJVe_VEuuw Value: BR5Z_nciG-MymMn7ChHZAzXKfNE |
|
op-fi-korttisi.com/ | Name: l9rosO4i8DvY_lx9aw3uMvWBbAw Value: 1690630601 |
|
op-fi-korttisi.com/ | Name: 6jjWwXj-U-aJiw9FQ4Kvo3RjuqI Value: 1690717001 |
|
op-fi-korttisi.com/ | Name: 5me9gILTuNHgqLsTWj6ON3MsXuc Value: pd7ftYJDQJko5QCXcNpwKfG2tWU |
|
op-fi-korttisi.com/ | Name: tN0x2VmKyVz45ed_MTZO9R_HfM0 Value: XEQQE_rXUUfJN3a5IuLl9oh5bhg |
|
op-fi-korttisi.com/ | Name: RjSWVe1qCWDQ9QFi7FlZ25eIgOI Value: qDkoTrmHAUp33V26yJ82g0FDIGc |
|
op-fi-korttisi.com/ | Name: ah7evqM9Wwum5YtSYYUlMIq-rYw Value: 1690630610 |
|
op-fi-korttisi.com/ | Name: 9GXlBFZRgRfcIrJ_z_TrO1sBGGE Value: 1690717010 |
|
op-fi-korttisi.com/ | Name: nRGfsCIpZLPJsJt1s0o22RmyS9M Value: 7DUQJNDWy9xoSWEQrz2KflDFbdU |
|
op-fi-korttisi.com/ | Name: ah_2uVgScCGaoVmPfuMDhq6J4U8 Value: Anavx2igi8eCg4yJu-AVcAKppy8 |
|
.op-fi-korttisi.com/ | Name: cf_clearance Value: i_lSHZ8GajmkFjbM2WN7X38wujny84rD9cZYOWJkpKA-1690630612-0-0.2.1690630612 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
op-fi-korttisi.com
op-fi-korttisi.com
2606:4700:3036::ac43:c895
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
499b39b8d1fd2f148a44b33c25c1d09a8e973f389d2bc8d7527ba88cc22b7740
4e177aa0a4e4424f3fdb73aa2703bef8b035ee6c3ddfb34fe55b43cfe9a682dd
a09057a90d845e102971713b3ee711250f23fc520bb8d1ae3bdfdf7424503caf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edb81b28778b949740170dc38e62964ad1390464267d2dfe1cf3b9611b79d9eb
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016