yrittajamediat.fi
Open in
urlscan Pro
93.90.51.38
Malicious Activity!
Public Scan
Submitted URL: http://bit.ly/2OseydY
Effective URL: https://yrittajamediat.fi/js/@%25@%25@%25@%25@@/
Submission: On October 16 via manual from US
Effective URL: https://yrittajamediat.fi/js/@%25@%25@%25@%25@@/
Submission: On October 16 via manual from US
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 93.90.51.38, located in
Finland and
belongs to MEGATUUTTI, FI.
The main domain is yrittajamediat.fi.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 10th 2018. Valid for: 3 months.
This is the only time yrittajamediat.fi was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on September 10th 2018. Valid for: 3 months.
This is the only time yrittajamediat.fi was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 67.199.248.11 67.199.248.11 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
| 1 7 | 93.90.51.38 93.90.51.38 | 45010 (MEGATUUTTI) (MEGATUUTTI) | |
| 6 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
yrittajamediat.fi
1 redirects
yrittajamediat.fi |
251 KB |
| 1 |
bit.ly
1 redirects
bit.ly |
368 B |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | yrittajamediat.fi |
1 redirects
yrittajamediat.fi
|
| 1 | bit.ly | 1 redirects |
| 6 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| yrittajamediat.fi Let's Encrypt Authority X3 |
2018-09-10 - 2018-12-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://yrittajamediat.fi/js/@%25@%25@%25@%25@@/
Frame ID: B8CC6ABDD2B12E738FA44743AD842580
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bit.ly/2OseydY
HTTP 301
https://yrittajamediat.fi/js/@%25@%25@%25@%25@@ HTTP 301
https://yrittajamediat.fi/js/@%25@%25@%25@%25@@/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.ly/2OseydY
HTTP 301
https://yrittajamediat.fi/js/@%25@%25@%25@%25@@ HTTP 301
https://yrittajamediat.fi/js/@%25@%25@%25@%25@@/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
yrittajamediat.fi/js/@%25@%25@%25@%25@@/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
e1.png
yrittajamediat.fi/js/@%25@%25@%25@%25@@/images/ |
35 KB 35 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
e2.png
yrittajamediat.fi/js/@%25@%25@%25@%25@@/images/ |
79 KB 79 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
e3.png
yrittajamediat.fi/js/@%25@%25@%25@%25@@/images/ |
114 KB 114 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
e4.png
yrittajamediat.fi/js/@%25@%25@%25@%25@@/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
down.png
yrittajamediat.fi/js/@%25@%25@%25@%25@@/images/ |
577 B 819 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
yrittajamediat.fi
67.199.248.11
93.90.51.38
2b3e71fdc2fdfafea8c3fb47a3c98ebaa9b36d45e24dfdcb384cb4ba5f432a8d
67efa21d9c23bf34d55334cd7e04831f52fcf5305ab1885040a125f1e3f97752
c79540d18cf2470eb192f0707a1a27606999876229fb6f61e9872d2378283eb0
db1ce4501a389281b61ca5cf10feb133a90722022fbd558997b08d0f73e70e68
ed62f92d22dc8d6a2b2e4427cadc70cc8e6e7fddb26a936cbc437eb7aa3b7929
f2b8f5dbdb873081435082bf568b0c9c0b45869f6c34b51285552ce701c65022