emballasje.postenlabs.no
Open in
urlscan Pro
76.76.21.21
Malicious Activity!
Public Scan
Submission: On May 12 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by R3 on March 9th 2021. Valid for: 3 months.
This is the only time emballasje.postenlabs.no was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Posten Norge (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 76.76.21.21 76.76.21.21 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 2a04:4e42:1b:... 2a04:4e42:1b::621 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 35.244.128.15 35.244.128.15 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200e | 15169 (GOOGLE) (GOOGLE) | |
25 | 5 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: 15.128.244.35.bc.googleusercontent.com
cdn.sanity.io |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
postenlabs.no
emballasje.postenlabs.no |
148 KB |
7 |
jsdelivr.net
cdn.jsdelivr.net |
168 KB |
2 |
sanity.io
cdn.sanity.io |
2 MB |
1 |
google-analytics.com
www.google-analytics.com |
177 B |
1 |
googletagmanager.com
www.googletagmanager.com |
56 KB |
25 | 5 |
Domain | Requested by | |
---|---|---|
14 | emballasje.postenlabs.no |
emballasje.postenlabs.no
|
7 | cdn.jsdelivr.net |
emballasje.postenlabs.no
cdn.jsdelivr.net |
2 | cdn.sanity.io |
emballasje.postenlabs.no
|
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | www.googletagmanager.com |
emballasje.postenlabs.no
|
25 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
no.surveymonkey.com |
www.postennorge.no |
Subject Issuer | Validity | Valid | |
---|---|---|---|
emballasje.postenlabs.no R3 |
2021-03-09 - 2021-06-07 |
3 months | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2021-05-11 - 2022-03-26 |
10 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
sanity.io R3 |
2021-05-08 - 2021-08-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://emballasje.postenlabs.no/
Frame ID: 013FC5F88CA32DF555C97B58D0E15810
Requests: 25 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: Gå til spørreundersøkelse
Search URL Search Domain Scan URL
Title: Meld deg på intervju
Search URL Search Domain Scan URL
Title: Postens bærekraftsrapporter
Search URL Search Domain Scan URL
Title: Års og bærekraftsrapport 2021
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
emballasje.postenlabs.no/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6e9ef204d6fd7ac61493.css
emballasje.postenlabs.no/_next/static/css/ |
222 B 408 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5c73b605db7913c1172b.css
emballasje.postenlabs.no/_next/static/css/ |
257 B 416 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-65067f7abe511d22bb1f.js
emballasje.postenlabs.no/_next/static/chunks/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webpack-50bee04d1dc61f8adf5b.js
emballasje.postenlabs.no/_next/static/chunks/ |
2 KB 936 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framework.0c239260661ae1d12aa2.js
emballasje.postenlabs.no/_next/static/chunks/ |
128 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c3369f7f651fecd51087bee95da4d34a5f8158b8.d1f157c3d89755ef24e5.js
emballasje.postenlabs.no/_next/static/chunks/ |
40 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_app-a9bac270172639df4cbd.js
emballasje.postenlabs.no/_next/static/chunks/pages/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
%5B%5B...slug%5D%5D-b600392ae2ef4616d870.js
emballasje.postenlabs.no/_next/static/chunks/pages/ |
114 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/assets/ |
2 KB 901 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
posten.css
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/dist/ |
211 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
151 KB 56 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googleAnalyticsInit.js
emballasje.postenlabs.no/ |
319 B 476 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a1a19c2ef283c667d9ec25409d15c7f65a79482e-2000x750.gif
cdn.sanity.io/images/blgu8l3w/production/ |
1 MB 1 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
91fde6af119f91049bb40d08ad54305edcdad272-4471x3750.png
cdn.sanity.io/images/blgu8l3w/production/ |
213 KB 213 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/dist/ |
160 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.min.js
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/dist/ |
485 B 481 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_buildManifest.js
emballasje.postenlabs.no/_next/static/1q12DYI374Sf-t63mJbuM/ |
497 B 650 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_ssgManifest.js
emballasje.postenlabs.no/_next/static/1q12DYI374Sf-t63mJbuM/ |
76 B 234 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 177 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PostenSans-Medium.woff2
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/assets/fonts/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PostenSans-Bold.woff2
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/assets/fonts/ |
28 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
svg-sprite.svg
cdn.jsdelivr.net/npm/@posten/hedwig@11.5.6/dist/ |
79 KB 28 KB |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
%5B%5B...slug%5D%5D-b600392ae2ef4616d870.js
emballasje.postenlabs.no/_next/static/chunks/pages/ |
0 37 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5c73b605db7913c1172b.css
emballasje.postenlabs.no/_next/static/css/ |
257 B 328 B |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Posten Norge (Transportation)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| gtag string| googleAnalyticsID object| dataLayer object| google_tag_manager object| google_tag_data object| gaGlobal object| hedwig object| FontAwesomeConfig object| ___FONT_AWESOME___ function| replaceLastPathofUrl string| src string| spriteUrl function| loadIcons object| webpackJsonp_N_E object| _N_E object| regeneratorRuntime object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| next function| onYouTubeIframeAPIReady object| __SSG_MANIFEST object| __BUILD_MANIFEST2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.postenlabs.no/ | Name: emballasje_ga Value: GA1.1.404951645.1620800862 |
|
.postenlabs.no/ | Name: emballasje_ga_L17LSZ1HJQ Value: GS1.1.1620800862.1.0.1620800862.0 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdn.sanity.io
emballasje.postenlabs.no
www.google-analytics.com
www.googletagmanager.com
2a00:1450:4001:80f::2008
2a00:1450:4001:828::200e
2a04:4e42:1b::621
35.244.128.15
76.76.21.21
02f71659c3cba38bb90dbe065f79192a6ed5bddf07e865bf9ffaa1107e01634d
09a245a4fca1a35d1a0a228ac9050689b79fb3b0d5c6f324e51885e815c3df1d
1b92491bfcbb457aa48f6c9b6adf0f4a6be0fd6594634126b7788919bd3b734d
26362abec014030e0a7aebb5462b4bafd89882aeacc7ad426cfe468e44e5a608
26a81f9748a42eeb15a43c5cc3c1a7b7582e4d9f0ab3cd5be477f87096eed840
304a57945a1b44c2f502ddb3d2b2f315f7baa57c4c3f1f47c00f499f71ef38c2
4a27cce7c4977eb5602516dbf118d7b4731f815d6bbc573ef28cc2ad0b7250e8
5b3993196c7aff1389f4e18edffaa01329edc1a83c7a1a68c5e559c6e95b421a
653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479
882f8e26a41744d760948be6d84613b5485f83a9ccaf16aa64401dfc2a99e5a7
8c80a302b149f36cf6e07d14c9aeb1b2d0c8e6b0dacb820d712802e989242fa9
8dd7bb349c35db3b769ef9cb7ecaca19aa908ccc777dfc1300896e30df5a3fc8
a17eb66d9a690672eea19efdf848f396cacfcd55c2bb217a688c36affd0d8003
a634be59afb8f7b0d775c9521c40fe005bcbb176f1fcfdf3ad7e25d0c91d6741
a668722025f83ea3c7dad6e09854271b5d45bd1cfaa30d6305cc7779cfec972d
b0d07fd0ecfc8286de3cb0d3d5267f2c6c668c267ad547369585bc13b7d7f6f8
d795368e22cf325175d8a6170fd28716bc82a8fc3536c62403565fcb67d18c76
db603ebe29c314fd1d9922d8e52593e895cfbeae0ee195715cb9a3083da50bad
e000ec1fb811d46435554fa0065c6e1eff0a21801f00aca70ebd9d89e6f5ffe8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e98f7e4969f1d33b5219018cc1c30797f7ef1bef30c810ca33e0cdcd5f2dfa
eba0cf588adde0fbfae8e5f0c664a964e95de733e1ffc0e3ccc020802c387f9a
f660ca0badb23ddca91dd3b86c7a538d64c5acab3327a981942f792484ef631f