www.kuzka.gov.tr Open in urlscan Pro
213.238.176.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.kuzka.gov.tr/Page/ae/enUS/?mid=3Dd05e1e734b442db67b6d5de48d9af91421adb3d8af6deea4b4820bf672b612e3a8f483489c97...
Submission: On January 31 via automatic, source phishtank (January 31st 2024, 8:32:25 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 9 HTTP transactions. The main IP is 213.238.176.194, located in Samsun, Turkey and belongs to EARTH, TR. The main domain is www.kuzka.gov.tr.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 17th 2024. Valid for: a year.

This is the only time www.kuzka.gov.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	213.238.176.194 213.238.176.194	41683 (EARTH) (EARTH)
3	2606:4700:303... 2606:4700:3038::6815:eae7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.71.16.29 139.71.16.29	6307 (AMERICAN-...) (AMERICAN-EXPRESS)
3	23.197.129.56 23.197.129.56	16625 (AKAMAI-AS) (AKAMAI-AS)
9	5

1 213.238.176.194 (Samsun, Turkey)

ASN41683 (EARTH, TR)
PTR: merkur.sislan.net

www.kuzka.gov.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3038::6815:eae7 (United States)

ASN13335 (CLOUDFLARENET, US)

rawcdn.githack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.71.16.29 (United States)

ASN6307 (AMERICAN-EXPRESS, US)
PTR: cdaas2.americanexpress.com

cdaas.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.197.129.56 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-129-56.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	aexp-static.com www.aexp-static.com — Cisco Umbrella Rank: 13520	108 KB
3	githack.com rawcdn.githack.com — Cisco Umbrella Rank: 61233	140 KB
1	americanexpress.com cdaas.americanexpress.com — Cisco Umbrella Rank: 36060	11 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	27 KB
1	kuzka.gov.tr www.kuzka.gov.tr	3 KB
9	5

	Domain	Requested by
3	www.aexp-static.com	rawcdn.githack.com
3	rawcdn.githack.com	www.kuzka.gov.tr
1	cdaas.americanexpress.com	rawcdn.githack.com
1	cdnjs.cloudflare.com	www.kuzka.gov.tr
1	www.kuzka.gov.tr
9	5

This site contains no links.

Subject Issuer	Validity	Valid
*.kuzka.gov.tr Sectigo RSA Domain Validation Secure Server CA	`2024-01-17` - `2025-01-16`	a year	crt.sh
githack.com GTS CA 1P5	`2024-01-02` - `2024-04-01`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
cdaas.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2023-10-11` - `2024-10-09`	a year	crt.sh
m.americanexpress.com DigiCert EV RSA CA G2	`2023-04-05` - `2024-04-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.kuzka.gov.tr/Page/ae/enUS/?mid=3Dd05e1e734b442db67b6d5de48d9af91421adb3d8af6deea4b4820bf672b612e3a8f483489c97ca899b85cfe5fef41e5ea640901d47ee754ff0b40114626fff59f19e6d5de125d646252
Frame ID: E1567C27D5E41BC125D08EF830FCD25D
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

American Express |

Detected technologies

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

290 kB
Transfer

809 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.kuzka.gov.tr/Page/ae/enUS/ 10 KB
3 KB 372ms
94ms Document
text/html 213.238.176.194
EARTH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kuzka.gov.tr/Page/ae/enUS/?mid=3Dd05e1e734b442db67b6d5de48d9af91421adb3d8af6deea4b4820bf672b612e3a8f483489c97ca899b85cfe5fef41e5ea640901d47ee754ff0b40114626fff59f19e6d5de125d646252

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

213.238.176.194 Samsun, Turkey, ASN41683 (EARTH, TR),

Reverse DNS

merkur.sislan.net

Software

Microsoft-IIS/10.0 /

Resource Hash

df6b324acaa02512e196bb0b3dbb46ef1377be4268762098aea4e57e0156db84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: private,public,max-age=0,public, max-age=86400
content-encoding: br
content-length: 3245
content-type: text/html
date: Wed, 31 Jan 2024 20:32:23 GMT
etag: "80d886dd8054da1:0",
last-modified: Wed, 31 Jan 2024 20:05:41 GMT
server: Microsoft-IIS/10.0
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
x-powered-by-plesk: PleskWin

GET
H2 200 oce-min.css
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/ 285 KB
49 KB 113ms
53ms Stylesheet
text/css 2606:4700:3038::6815:eae7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css

Requested by

Host: www.kuzka.gov.tr
URL: https://www.kuzka.gov.tr/Page/ae/enUS/?mid=3Dd05e1e734b442db67b6d5de48d9af91421adb3d8af6deea4b4820bf672b612e3a8f483489c97ca899b85cfe5fef41e5ea640901d47ee754ff0b40114626fff59f19e6d5de125d646252

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3038::6815:eae7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22ac73d718eefac83c6f65ec81fb08c201cda95fa7bb753407059f48df09e147

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.kuzka.gov.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-fastly-request-id: 135c627a96869fa5ba7402daed7093cf6bf4043e
date: Wed, 31 Jan 2024 20:32:21 GMT
via: 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-cache: MISS
x-cache-hits: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-hel1410027-HEL
server: cloudflare
x-github-request-id: FB66:2FFC17:44D4653:479C22E:65AB93F0
x-timer: S1705743345.481234,VS0,VE336
etag: W/"58070408e19e0d997d1cd2ac1dd1e10e18e3f485a00e53d104893719c98df2e0"
source-age: 0
vary: Authorization,Accept-Encoding,Origin
x-githack-cache-status: MISS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FMcVnDxQro1h5pOwZMJLFkudWi39WhAixp5exrUK8mt8ijX6uj4PD8HPI5S6Ne2%2Fr7WKc%2BeR0gfsdUWRhy0GsqQ%2BW5Ot4EXH%2F7Q8I9Pc6sI9InWaPy%2BZP93PyS6UdM3kzn2MxLES83Z76GE9xeTDr8I%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
cf-ray: 84e4b9387b69b992-AMS
expires: Sun, 19 Jan 2025 09:35:45 GMT

GET
H2 200 oce-fonts.css
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/ 207 KB
22 KB 111ms
52ms Stylesheet
text/css 2606:4700:3038::6815:eae7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3038::6815:eae7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18f3644f71d444e98a23bcccbd33e41a5dd356642e195559227879f10a182b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.kuzka.gov.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-fastly-request-id: 5f574e7d5c8b3d806f083acff3ed58787d2d84ae
date: Wed, 31 Jan 2024 20:32:21 GMT
via: 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 359290
content-encoding: br
x-cache: MISS
x-cache-hits: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-hel1410023-HEL
server: cloudflare
x-github-request-id: 3EC0:1718A5:413AAD7:442A0A2:659844F5
x-timer: S1704477942.001510,VS0,VE356
etag: W/"c408e28284057fe7f3c7b84b6e9edcbc528d33d19d43196d8f74f1e25da59d31"
source-age: 0
vary: Authorization,Accept-Encoding,Origin
x-githack-cache-status: MISS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=esQIS%2BOodJo0XDnT292pTFaE7oCAopigCQeg477LA5jntyqRB%2B%2BANjBS%2BKwc6N3QJbSWF7wlPm5WKN455WXHJYgnMxkutBEWX1pM9GEUsS55oQm9kVBtcpIkHeT9i%2Bojue%2B%2Bw9KDcHzLFLKnVbtUnh4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
cf-ray: 84e4b9387b65b992-AMS
expires: Sat, 04 Jan 2025 18:05:44 GMT

GET
H2 200 oce-font.css
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/ 104 KB
69 KB 90ms
31ms Stylesheet
text/css 2606:4700:3038::6815:eae7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-font.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3038::6815:eae7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcf4b83f0c88cac6c69c6a37010429b5db8af648c0bb5a7ddaed4fc357e2e46d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.kuzka.gov.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-fastly-request-id: e9f6cc17f497a2a9d4b603282e2fa7a602acafe2
date: Wed, 31 Jan 2024 20:32:21 GMT
via: 1.1 varnish
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 359290
content-encoding: br
x-cache: MISS
x-cache-hits: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-hel1410029-HEL
server: cloudflare
x-github-request-id: 8DC4:3CBA42:C0A89D:C91712:659844FA
x-timer: S1704477947.187848,VS0,VE196
etag: W/"26f8b7f629b0547cd04bfb9027a9336ada7ef041ebdc3500b73a4178d52339f7"
source-age: 0
vary: Authorization,Accept-Encoding,Origin
x-githack-cache-status: MISS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SK2zqozrtmosVP02acPvg4O7fAds1A8ZNClfvU9HElSrveu2h4b9hfeNLQm44nzOHn2moCxZW3MjnNpJlvmxQydcsmMM%2Brjxzf9aYf6PfH7PARVM7coXBIeZvnHWLnruibaJvVoBlqXfRNSSzl61iq4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000, public, immutable
x-robots-tag: none
cf-ray: 84e4b9387b68b992-AMS
expires: Sat, 04 Jan 2025 18:05:48 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/ 85 KB
27 KB 40ms
21ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kuzka.gov.tr/
Origin: https://www.kuzka.gov.tr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 20:32:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2297583
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27446
last-modified: Tue, 29 Aug 2023 04:36:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64ed75bb-6b36"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bcVtuKb7G0YKhgcKJa7QXnx4%2BhH3qqfTKz3W%2FPDJns%2F5Gxi90McPxIWS3IaenPfHrz4t%2FceIbyFNy4AWfvnf%2BMvEETFv60%2FZof7GjAcRWHELMe0lRnyuzHPNE3g5H5KGng5KLHsD9KXvLXVdzH4DesN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84e4b9383d223a6d-FRA
expires: Mon, 20 Jan 2025 20:32:21 GMT

GET
H/1.1 200
OK amex-desktop-logo.png
cdaas.americanexpress.com/myca/oce/latest/content/images/common/ 11 KB
11 KB 652ms
175ms Image
image/png 139.71.16.29
AMERICAN-EXPRESS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdaas.americanexpress.com/myca/oce/latest/content/images/common/amex-desktop-logo.png
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 139.71.16.29 , United States, ASN6307 (AMERICAN-EXPRESS, US),
Reverse DNS: cdaas2.americanexpress.com
Software: /
Resource Hash: 610166ddd2d965283356d314f592522c1907a5334cec1daa0874fc61639a667c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rawcdn.githack.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 20:32:22 GMT
Last-Modified: Mon, 22 Jan 2024 16:14:02 GMT
ETag: "65ae944a-2b7e"
Vary: Origin
Content-Type: image/png
Cache-Control: max-age=31536000, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 11134

GET
H2 200 0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
www.aexp-static.com/nav/ngn/fonts/ 37 KB
37 KB 128ms
27ms Font
font/woff 23.197.129.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.197.129.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-129-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://www.kuzka.gov.tr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 20:32:22 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-943d"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37949
expires: Fri, 27 Nov 2020 03:31:12 GMT

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 36 KB
37 KB 145ms
44ms Font
font/woff 23.197.129.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.197.129.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-129-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://www.kuzka.gov.tr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 20:32:22 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-9121"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37153
expires: Mon, 25 Jan 2021 11:07:20 GMT

GET
H2 200 dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/ 34 KB
34 KB 141ms
40ms Font
font/woff 23.197.129.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.197.129.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-129-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://www.kuzka.gov.tr
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 20:32:22 GMT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-87c4"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 34756

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdaas.americanexpress.com
cdnjs.cloudflare.com
rawcdn.githack.com
www.aexp-static.com
www.kuzka.gov.tr
139.71.16.29
213.238.176.194
23.197.129.56
2606:4700:3038::6815:eae7
2606:4700::6811:190e
18f3644f71d444e98a23bcccbd33e41a5dd356642e195559227879f10a182b19
22ac73d718eefac83c6f65ec81fb08c201cda95fa7bb753407059f48df09e147
3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
610166ddd2d965283356d314f592522c1907a5334cec1daa0874fc61639a667c
bcf4b83f0c88cac6c69c6a37010429b5db8af648c0bb5a7ddaed4fc357e2e46d
df6b324acaa02512e196bb0b3dbb46ef1377be4268762098aea4e57e0156db84
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

www.kuzka.gov.tr Open in urlscan Pro 213.238.176.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

290 kBTransfer

809 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.kuzka.gov.tr Open in urlscan Pro
213.238.176.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

290 kB
Transfer

809 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!