fi-suomi.xyz Open in urlscan Pro
50.87.148.121 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fi-suomi.xyz/fi/nordea/nordea3.php
Effective URL:
https://fi-suomi.xyz/fi/nordea/Tunnistautuminen.html
Submission: On March 20 via manual (March 20th 2023, 9:56:42 am UTC) from NO — Scanned from FI

Summary HTTP 2 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 50.87.148.121, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is fi-suomi.xyz.
TLS certificate: Issued by R3 on March 11th 2023. Valid for: 3 months.

This is the only time fi-suomi.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 3	50.87.148.121 50.87.148.121		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	2

3 50.87.148.121 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-87-148-121.unifiedlayer.com

fi-suomi.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	fi-suomi.xyz 1 redirects fi-suomi.xyz	1 MB
2	1

	Domain	Requested by
3	fi-suomi.xyz	1 redirects
2	1

This site contains links to these domains. Also see Links.

Domain
www.nordea.fi

Subject Issuer	Validity	Valid
*.fi-suomi.xyz R3	`2023-03-11` - `2023-06-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fi-suomi.xyz/fi/nordea/Tunnistautuminen.html
Frame ID: 4AEBB5C0F9D82D448D6AC044C5259325
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - Tunnistautuminen

Page URL History Show full URLs

https://fi-suomi.xyz/fi/nordea/nordea3.php HTTP 302
https://fi-suomi.xyz/fi/nordea/index-w.html Page URL
https://fi-suomi.xyz/fi/nordea/Tunnistautuminen.html Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1181 kB
Transfer

1921 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.fi/nordea-id
Title: www.nordea.fi

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fi-suomi.xyz/fi/nordea/nordea3.php HTTP 302
https://fi-suomi.xyz/fi/nordea/index-w.html Page URL
https://fi-suomi.xyz/fi/nordea/Tunnistautuminen.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://fi-suomi.xyz/fi/nordea/nordea3.php HTTP 302
https://fi-suomi.xyz/fi/nordea/index-w.html

2 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	index-w.html Show response fi-suomi.xyz/fi/nordea/ Redirect Chain https://fi-suomi.xyz/fi/nordea/nordea3.php https://fi-suomi.xyz/fi/nordea/index-w.html	972 KB 654 KB	267ms 267ms	Document text/html	50.87.148.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://fi-suomi.xyz/fi/nordea/index-w.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.148.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 50-87-148-121.unifiedlayer.com Software Apache / Resource Hash `3d6c356b372d1777c5420f20ce866bbf61db41a18aaa91c44cb987a18f6270da` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-type text/html date Mon, 20 Mar 2023 09:56:25 GMT last-modified Fri, 17 Mar 2023 08:24:47 GMT server Apache vary Accept-Encoding Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Mon, 20 Mar 2023 09:56:24 GMT location ./index-w.html server Apache
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76` Request headers Referer Origin https://fi-suomi.xyz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03` Request headers Referer Origin https://fi-suomi.xyz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff` Request headers Referer Origin https://fi-suomi.xyz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	196 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a08d312a7cd00975612ecb6060481bae0b408e915d1d1e3c85a1ec2550a3e650` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	Primary Request Tunnistautuminen.html Show response fi-suomi.xyz/fi/nordea/	636 KB 412 KB	233ms 233ms	Document text/html	50.87.148.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://fi-suomi.xyz/fi/nordea/Tunnistautuminen.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.148.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 50-87-148-121.unifiedlayer.com Software Apache / Resource Hash `bcae0323dce209f68d6390f490cf17613f957636212861cd8ceabd05b5b406ac` Request headers Referer https://fi-suomi.xyz/fi/nordea/index-w.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-type text/html date Mon, 20 Mar 2023 09:56:36 GMT last-modified Fri, 17 Mar 2023 08:25:51 GMT server Apache vary Accept-Encoding
GET DATA	200 OK	truncated /	30 KB 30 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c` Request headers Referer Origin https://fi-suomi.xyz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	31 KB 31 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44` Request headers Referer Origin https://fi-suomi.xyz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fi-suomi.xyz
50.87.148.121
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c
3d6c356b372d1777c5420f20ce866bbf61db41a18aaa91c44cb987a18f6270da
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76
a08d312a7cd00975612ecb6060481bae0b408e915d1d1e3c85a1ec2550a3e650
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
bcae0323dce209f68d6390f490cf17613f957636212861cd8ceabd05b5b406ac
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44

fi-suomi.xyz Open in urlscan Pro 50.87.148.121 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1181 kBTransfer

1921 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

fi-suomi.xyz Open in urlscan Pro
50.87.148.121 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1181 kB
Transfer

1921 kB
Size

0
Cookies

2 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!