fi.oma-ei-posti.com Open in urlscan Pro
2606:4700:3036::6815:2e8c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fi.oma-ei-posti.com/
Effective URL:
https://fi.oma-ei-posti.com/pages
Submission: On July 23 via manual (July 23rd 2024, 9:39:47 am UTC) from FI — Scanned from FI

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3036::6815:2e8c, located in United States and belongs to CLOUDFLARENET, US. The main domain is fi.oma-ei-posti.com.
TLS certificate: Issued by WE1 on July 21st 2024. Valid for: 3 months.

This is the only time fi.oma-ei-posti.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Posti Group (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3036::6815:2e8c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	172.67.139.52 172.67.139.52	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.161.119.65 3.161.119.65	16509 (AMAZON-02) (AMAZON-02)
10	3

2 2606:4700:3036::6815:2e8c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

fi.oma-ei-posti.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.67.139.52 (United States)

ASN13335 (CLOUDFLARENET, US)

fi.oma-ei-posti.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.161.119.65 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-119-65.vie50.r.cloudfront.net

todentaminen.posti.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	oma-ei-posti.com 1 redirects fi.oma-ei-posti.com	51 KB
1	posti.fi todentaminen.posti.fi	23 KB
10	2

	Domain	Requested by
10	fi.oma-ei-posti.com	1 redirects fi.oma-ei-posti.com
1	todentaminen.posti.fi
10	2

This site contains no links.

Subject Issuer	Validity	Valid
oma-ei-posti.com WE1	`2024-07-21` - `2024-10-19`	3 months	crt.sh
prd.auth.posticloud.fi Amazon RSA 2048 M03	`2024-01-31` - `2025-03-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fi.oma-ei-posti.com/pages
Frame ID: 1B5B1BE924AC9ABFFAC8BD4879EA3066
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Posti

Page URL History Show full URLs

https://fi.oma-ei-posti.com/ HTTP 302
https://fi.oma-ei-posti.com/pages Page URL

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

73 kB
Transfer

118 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fi.oma-ei-posti.com/ HTTP 302
https://fi.oma-ei-posti.com/pages Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request pages Show response
fi.oma-ei-posti.com/
Redirect Chain

https://fi.oma-ei-posti.com/
https://fi.oma-ei-posti.com/pages

6 KB
2 KB

119ms
118ms

Document
text/html

2606:4700:3036::6815:2e8c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fi.oma-ei-posti.com/pages
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:2e8c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: b1b8423cfde9dc350efb74626fe251518afb585d417612b95fdd70b8ce37ad71

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8a7ab4690f035688-OSL
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 23 Jul 2024 09:39:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bz3Us0CYVa0%2F2Ox%2BjZ2ZQl9liqVVCOZf07hA%2BqOSz2cENPZ6mCV0sYTcuxXcXh1%2Fy1hK2XFN2sFeKdRKDynTFM7BKLqgC9V3dUdgiwacHhP3W20%2B9WqNJvCMZKOl9%2BxCOaDgMMDnnYAK0hoVzxq5nvps"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8a7ab467ddad5688-OSL
content-type: text/html; charset=UTF-8
date: Tue, 23 Jul 2024 09:39:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://fi.oma-ei-posti.com/pages
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JcMB0YiLkMm6D%2F%2FyopOEgZ9Mo1PB50hHg8SieQxHJbrLg9pyCXnGuM5uQt0g59AfUz2vCs1dE3%2Fb%2FtSvGNb1UW%2BuJWUD4Lx%2B%2B3%2FjorLL124t4JdLLbURW6zM1VHqR7d00vXrrRTDgMfCghIsRArHQo%2F1"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33

GET
H3 200 style.css
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 18 KB
5 KB 219ms
218ms Stylesheet
text/css 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/pages
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d768a8c5fabbef1b079922c539cfa8367b5a2864176ee405f640680d26d2d76a

Request headers

Referer: https://fi.oma-ei-posti.com/pages
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:41 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 16 Dec 2022 12:04:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"4672-639c5ed7-14129a;br"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AckmE1pnFvzLw1OzDos1zNYv5SjD3dS6%2FQrr%2Bfdy5NYWleTRoJx%2BEAVe5rMiEZSkXaimm%2F0NnXhTGLLvJYu%2FslJMAB0Wenm119lmdAgvrD8z%2BeSpWQXFrDkV%2BPDBs2CKhAyV6plS"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=43200
cf-ray: 8a7ab469de210b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 Jul 2024 03:04:35 GMT

GET
H3 200 logo
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 3 KB
3 KB 181ms
180ms Image
text/plain 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/logo
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/pages
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fi.oma-ei-posti.com/pages
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:41 GMT
cf-cache-status: DYNAMIC
last-modified: Fri, 16 Dec 2022 12:00:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "df7-639c5dec-141298;;;"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wrzManAjA%2Fi4l7bxBihqDTVkhcpRoostTwM0ILcpG4%2BUyhk8s6K832Q7%2BFRauevPIRD7AUfSJT1XRqy6HBXLRQykMFr66zDL4tpXblvVNDWr7tHXbSGEAZnN3x%2BSaQDm%2FGu%2BFy3b"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 8a7ab469de220b41-OSL
alt-svc: h3=":443"; ma=86400
content-length: 3575

GET
H3 200 default_page_icon.svg
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 4 KB
2 KB 221ms
220ms Image
image/svg+xml 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/default_page_icon.svg
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/pages
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 963b56b456a2894648d641ac2123fe07a7d391b44b8bd978148fe48c7b9df277

Request headers

Referer: https://fi.oma-ei-posti.com/pages
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:41 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 16 Dec 2022 12:02:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"e6b-639c5e65-141286;br"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xIIXGiQmvwgEUyF3mSfPwUN9ze6rE2u2U7BPxq%2BBjnSpRd%2BRV5%2BmGcgbZ5T3Ck%2BJ0HlCh8sbG131QLmc5cxwBwVgwxRJkirIpLijiiPvfUUEemLF6eZWbd7Dgnjun42%2FH6sJBm7p"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=43200
cf-ray: 8a7ab469de230b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 Jul 2024 03:04:36 GMT

GET
H3 200 posti_background_left.svg
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 24 KB
8 KB 183ms
182ms Image
image/svg+xml 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/posti_background_left.svg
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef5e830d7c7e0830b340ac67d5b9bfd46aaca550740548d5cfc5322c75b95bdc

Request headers

Referer: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:42 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 16 Dec 2022 12:04:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"61bf-639c5ec9-141296;br"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VWHB7QSQSIhqa6fWsrkLTSSEHCZnUQFqucicU3lQjQddxm1boLyazdqrLt5zOK7gyMbSPUgzPwHJ5IZu4DbVBW0j465SfAavj5CA5vyTu63mG%2BiS7nWvnxTkBua1yjey43RK40HD"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=43200
cf-ray: 8a7ab46b4f540b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 Jul 2024 05:25:51 GMT

GET
H3 200 montserrat-latin.woff2
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 19 KB
19 KB 179ms
178ms Font
font/woff2 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/montserrat-latin.woff2
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94

Request headers

Referer: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Origin: https://fi.oma-ei-posti.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:42 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 16 Dec 2022 12:02:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "4ae4-639c5e3f-141288;;;"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qmLL3eO0fRiLzuSC%2FsxcXlFAu3H9qyOlThAqtS2nzT1J0jaQylNK24HI4bMCQ9d9Ru6Ut%2B9Z4KPRhH%2BnaRxQKyFArkCijXwH%2B39YmLVBS%2FtcP3u%2BSrAVMGOoW6GeaklNlqNxHqLX"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=43200
accept-ranges: bytes
cf-ray: 8a7ab46b6f660b41-OSL
alt-svc: h3=":443"; ma=86400
content-length: 19172
expires: Tue, 23 Jul 2024 03:04:35 GMT

GET
H3 404 arrow_right
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 0
500 B 114ms
113ms Image
text/html 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/arrow_right
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Jul 2024 09:39:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gHyLTdTB7juMiZ1U%2BTe%2FhmQ6jHv2zFUiZthyxJ3jOkR8Ep9dhPjAW9Bnkdq9EEXy6ZTyRvVzYPKcoZfwSzUw9wIw1PZSt%2FzbNLGi7%2FPuUd4MVI9gk%2FldtBPZ80QRE%2BCoRlR%2Bmw7P"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
cf-ray: 8a7ab46b5f580b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 200 posti_background_right.svg
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 23 KB
10 KB 235ms
234ms Image
image/svg+xml 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/posti_background_right.svg
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15cba496cec1f19d4d41fb36d138a54cc350f9fdb20cbe8ffdfa40e89fe5bdb0

Request headers

Referer: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:42 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 16 Dec 2022 12:04:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5a05-639c5ebf-141283;br"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=txetVzGd6i%2BoiLXVQzoKg8USyw3k3WuFN4bl4o5%2BJoVhDgWuub73tSlZDoYpPHLHNXU7ttGSczTgVTXrUYp0I9g0jym9NohVkaRcPGzMkAADmkfy%2BkyQFxajW%2FrLJ%2Baf0vhEDiim"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=43200
cf-ray: 8a7ab46b5f590b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Tue, 23 Jul 2024 05:25:51 GMT

GET
H3 404 chevron_down_gray
fi.oma-ei-posti.com/front_end/front_end_files/posti/ 0
490 B 118ms
118ms Image
text/html 172.67.139.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/chevron_down_gray
Requested by: Host: fi.oma-ei-posti.com
URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.139.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Jul 2024 09:39:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q17fuz%2Fu4T8HjzWhuQHdV%2FoJqYEPbRixQqnUG5mZcMgzx9WYVub5pAl4A8L6ajcfkao8RhGm6OseJXMzidMIKQ6VYvmgZelocdtjvcmSnqRFizpp1816Y5%2F3lhVqe2mQCORk182X"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
cf-ray: 8a7ab46b5f5a0b41-OSL
alt-svc: h3=":443"; ma=86400
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 logo.ico
todentaminen.posti.fi/uas/template/postifi/ 22 KB
23 KB 474ms
180ms Other
image/x-icon 3.161.119.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://todentaminen.posti.fi/uas/template/postifi/logo.ico?locale=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.119.65 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-119-65.vie50.r.cloudfront.net

Software

CloudFront /

Resource Hash

ea6ec16c4b53ef2fa344f940002b96b8625c755514ca25229ebdcb3a197ced14

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; connect-src 'self'; frame-src .posti.fi .posti.com .netposti.fi .omaposti.fi .omaposti.com .itella.fi .itella.com .postinext.fi .postinext.com .posticloud.fi; script-src 'self' 'unsafe-inline'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fi.oma-ei-posti.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 09:39:42 GMT
content-security-policy: default-src 'none'; connect-src 'self'; frame-src *.posti.fi *.posti.com *.netposti.fi *.omaposti.fi *.omaposti.com *.itella.fi *.itella.com *.postinext.fi *.postinext.com *.posticloud.fi; script-src 'self' 'unsafe-inline'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 dcfb75fa135c8a89160cd57d1f78027a.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P2
x-cache: Miss from cloudfront
content-length: 22382
x-xss-protection: 1; mode=block
last-modified: Wed, 12 Apr 2023 10:37:44 GMT
server: CloudFront
x-frame-options: deny
content-type: image/x-icon
cache-control: public
x-amz-cf-id: NfdWXL6X1KewbdbZonB-5EAiy6IzALMeLjhzziUf6HKf_-vUCbCQjw==
expires: Tue, 23 Jul 2024 10:39:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Posti Group (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
fi.oma-ei-posti.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ev43101snn1n2flr99tiauteer
todentaminen.posti.fi/	1970-01-20 22:25:32	Name: AWSALB Value: moVAedN459bJlDLm3c7p7f3mWkM3SoHtF1YKl0U3E7KUe4IrwxLXTo3h5WW/PcrAfKWg7eSnDOFCt3PKx31LseXf08QWt460bPBsRM4bDB4bf8SCJOR+5wQ2R6MD
todentaminen.posti.fi/	1970-01-20 22:25:32	Name: AWSALBCORS Value: moVAedN459bJlDLm3c7p7f3mWkM3SoHtF1YKl0U3E7KUe4IrwxLXTo3h5WW/PcrAfKWg7eSnDOFCt3PKx31LseXf08QWt460bPBsRM4bDB4bf8SCJOR+5wQ2R6MD

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/arrow_right Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://fi.oma-ei-posti.com/front_end/front_end_files/posti/chevron_down_gray Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fi.oma-ei-posti.com
todentaminen.posti.fi
172.67.139.52
2606:4700:3036::6815:2e8c
3.161.119.65
15cba496cec1f19d4d41fb36d138a54cc350f9fdb20cbe8ffdfa40e89fe5bdb0
8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94
963b56b456a2894648d641ac2123fe07a7d391b44b8bd978148fe48c7b9df277
b1b8423cfde9dc350efb74626fe251518afb585d417612b95fdd70b8ce37ad71
d768a8c5fabbef1b079922c539cfa8367b5a2864176ee405f640680d26d2d76a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea6ec16c4b53ef2fa344f940002b96b8625c755514ca25229ebdcb3a197ced14
ef5e830d7c7e0830b340ac67d5b9bfd46aaca550740548d5cfc5322c75b95bdc

fi.oma-ei-posti.com Open in urlscan Pro 2606:4700:3036::6815:2e8c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

73 kBTransfer

118 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

fi.oma-ei-posti.com Open in urlscan Pro
2606:4700:3036::6815:2e8c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

73 kB
Transfer

118 kB
Size

3
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!