bireysel.zirraatbankasy.com Open in urlscan Pro
178.62.68.74 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bireysel.zirraatbankasy.com/en/login
Submission: On November 25 via api (November 25th 2023, 11:02:57 pm UTC) from US — Scanned from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 178.62.68.74, located in Slough, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is bireysel.zirraatbankasy.com.
TLS certificate: Issued by R3 on November 24th 2023. Valid for: 3 months.

This is the only time bireysel.zirraatbankasy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ziraat Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 14	178.62.68.74 178.62.68.74	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700::68... 2606:4700::6812:1df3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:81d::200a	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:822::2003	15169 (GOOGLE) (GOOGLE)
17	4

14 178.62.68.74 (Slough, United Kingdom) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

bireysel.zirraatbankasy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1df3 (United States)

ASN13335 (CLOUDFLARENET, US)

unicons.iconscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81d::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:822::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	zirraatbankasy.com 1 redirects bireysel.zirraatbankasy.com	182 KB
2	gstatic.com fonts.gstatic.com	39 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
1	iconscout.com unicons.iconscout.com — Cisco Umbrella Rank: 83697	10 KB
17	4

	Domain	Requested by
14	bireysel.zirraatbankasy.com	1 redirects bireysel.zirraatbankasy.com
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	bireysel.zirraatbankasy.com
1	unicons.iconscout.com	bireysel.zirraatbankasy.com
17	4

This site contains no links.

Subject Issuer	Validity	Valid
bireysel.zirraatbankasy.com R3	`2023-11-24` - `2024-02-22`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-16` - `2024-04-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bireysel.zirraatbankasy.com/en/login
Frame ID: 25EDFA1700BCB2D55FEF2EB97188982B
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

eBanking | Ziraat Bankası

Page URL History Show full URLs

https://bireysel.zirraatbankasy.com/en/login/ HTTP 301
https://bireysel.zirraatbankasy.com/en/login Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

232 kB
Transfer

1171 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bireysel.zirraatbankasy.com/en/login/ HTTP 301
https://bireysel.zirraatbankasy.com/en/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
bireysel.zirraatbankasy.com/en/
Redirect Chain

https://bireysel.zirraatbankasy.com/en/login/
https://bireysel.zirraatbankasy.com/en/login

6 KB
2 KB

251ms
251ms

Document
text/html

178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://bireysel.zirraatbankasy.com/en/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / PHP/8.0.30 PleskLin

Resource Hash

21e9a1280bd64dbc540a9a82a1694efb4002b58c32c8c123dfaf2e80e8dafd47

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, must-revalidate
content-encoding: gzip
content-length: 1563
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Sat, 25 Nov 2023 23:02:51 GMT
expires: -1
pragma: no-cache
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.0.30 PleskLin

Redirect headers

content-length: 330
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=iso-8859-1
date: Sat, 25 Nov 2023 23:02:51 GMT
location: https://bireysel.zirraatbankasy.com/en/login
server: nginx
x-powered-by: PleskLin

GET
H2 200 bootstrap.min.css
bireysel.zirraatbankasy.com/assets/css/ 259 KB
25 KB 468ms
463ms Stylesheet
text/css 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/css/bootstrap.min.css
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 982c27d8483f4945573ea223e5de357c9d09cc65c26439a0edf5bf740bbd69e9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Mon, 12 Sep 2022 09:12:39 GMT
server: nginx
etag: W/"631ef807-40a84"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 icons.min.css
bireysel.zirraatbankasy.com/assets/css/ 464 KB
62 KB 452ms
447ms Stylesheet
text/css 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/css/icons.min.css
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 99f381baf34a259f521bfd6e27531f0e706d3133f2288106eb0f8f7813d98735

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Thu, 29 Apr 2021 02:54:56 GMT
server: nginx
etag: W/"608a2000-741ef"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 app.min.css
bireysel.zirraatbankasy.com/assets/css/ 96 KB
15 KB 468ms
464ms Stylesheet
text/css 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/css/app.min.css
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: abac313530031e403c7cadf083a9e0ae41939720e5cd40bf7289add3b8382ee4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Mon, 12 Sep 2022 10:00:11 GMT
server: nginx
etag: W/"631f032b-17e9d"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 logo_web.png
bireysel.zirraatbankasy.com/assets/images/ 5 KB
5 KB 337ms
333ms Image
image/png 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bireysel.zirraatbankasy.com/assets/images/logo_web.png
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
last-modified: Mon, 12 Sep 2022 09:14:30 GMT
server: nginx
etag: "631ef876-12d7"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 4823

GET
H2 200 jquery.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/jquery/ 87 KB
30 KB 468ms
465ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/jquery/jquery.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-15d84"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 bootstrap.bundle.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/bootstrap/js/ 78 KB
21 KB 334ms
330ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/bootstrap/js/bootstrap.bundle.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: b5f6d1cd9dfac2e3e8794297cae7b0acb3b371f81d3b6a2f738a33b9845632ce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-13959"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 metisMenu.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/metismenu/ 5 KB
2 KB 335ms
332ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/metismenu/metisMenu.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 76c63eb57b94cca29ebfe2936ee2f04484e54b149e0237d731984d577d7f7474

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-12b8"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 simplebar.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/simplebar/ 45 KB
13 KB 468ms
466ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/simplebar/simplebar.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: a133ac374f1d67d935e32954eecad95016064e834d305cd076899fa1e60713f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-b51b"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 waves.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/node-waves/ 6 KB
2 KB 184ms
182ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/node-waves/waves.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 47ffc00429342db1b5fd3bd0438fac6f08f398fc499fd485e5fec5276030278a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-18b9"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.waypoints.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/waypoints/lib/ 9 KB
3 KB 467ms
465ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/waypoints/lib/jquery.waypoints.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-2344"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.counterup.min.js Show response
bireysel.zirraatbankasy.com/assets/libs/jquery.counterup/ 2 KB
911 B 468ms
466ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/libs/jquery.counterup/jquery.counterup.min.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: b8985337c167aa4e6e5296ffa6fd288e65bcd4e0da8f82439726f961f6f733da

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-886"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 app.js Show response
bireysel.zirraatbankasy.com/assets/js/ 5 KB
1 KB 468ms
466ms Script
application/javascript 178.62.68.74
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bireysel.zirraatbankasy.com/assets/js/app.js
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/en/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.62.68.74 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: decf4fdfeba38d2e6eb2ec89905c0b9ce081e9d3cb8fd0a9ee94d8583139ca96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/en/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: br
last-modified: Wed, 24 Feb 2021 19:22:04 GMT
server: nginx
etag: W/"6036a75c-1499"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 line.css
unicons.iconscout.com/release/v3.0.0/css/ 56 KB
10 KB 199ms
53ms Stylesheet
text/css 2606:4700::6812:1df3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://unicons.iconscout.com/release/v3.0.0/css/line.css
Requested by: Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/assets/css/icons.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1df3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22ff898a14845b852d7a96f333cb3ea5134cd008bc01665d948e727ad0e850e5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:02:52 GMT
x-amz-version-id: Mfp4KvdHVq22Oi.YGlXaWYu0ywyXXs_8
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 7C20C7YMKXC05Z22
age: 1001954
cf-polished: origSize=65054
x-amz-server-side-encryption: AES256
x-amz-replication-status: REPLICA
alt-svc: h3=":443"; ma=86400
x-amz-id-2: HhUy4zmLJikJMCiDKabFIMjEfFcJ96F5/24E0j8/Zmm4WpGc42JphU27cCtkmpHt4I1FtHTMAj4=
cf-bgj: minify
last-modified: Wed, 12 Aug 2020 06:31:01 GMT
server: cloudflare
etag: W/"f7bb978ee7bb23ddef038e456ffa1040"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 82bd85940e7c2886-MIA
expires: Sun, 24 Nov 2024 23:02:52 GMT

GET
H2 200 css2
fonts.googleapis.com/ 10 KB
1 KB 228ms
86ms Stylesheet
text/css 2607:f8b0:4006:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@300;400;500;600;700&display=swap

Requested by

Host: bireysel.zirraatbankasy.com
URL: https://bireysel.zirraatbankasy.com/assets/css/app.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a2b5d3d882accb3e5c3d31f6f39a5495803dc615d2fd7b40942626afa1f4c469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bireysel.zirraatbankasy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 25 Nov 2023 23:02:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 25 Nov 2023 23:02:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 25 Nov 2023 23:02:52 GMT

GET
H2 200 zYX9KVElMYYaJe8bpLHnCwDKjSL9AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ 20 KB
20 KB 337ms
87ms Font
font/woff2 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjSL9AIFsdA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@300;400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ef914e59b0047a261844d96acabb60c34d3acab6b85ea24198726ce4781fd37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bireysel.zirraatbankasy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 23:28:14 GMT
x-content-type-options: nosniff
age: 430479
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20064
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:58:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Nov 2024 23:28:14 GMT

GET
H2 200 zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ 19 KB
19 KB 314ms
65ms Font
font/woff2 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@300;400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bireysel.zirraatbankasy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 12:22:55 GMT
x-content-type-options: nosniff
age: 211198
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19156
x-xss-protection: 0
last-modified: Tue, 02 May 2023 16:04:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Nov 2024 12:22:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ziraat Bank (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bireysel.zirraatbankasy.com/	1970-01-20 16:29:20	Name: XSRF-TOKEN Value: eyJpdiI6ImVaUG96Y2dhdTNHYmZSLzZ3OHVPU3c9PSIsInZhbHVlIjoiQ1dWUkl6TWp0SUpMWkRHdzJURjU5SDZYNGtIZmVSQWdWSXhaMFZUbStLR3FLQTZpOThYdWs2UWIrd0gybjNOWnpLY0FTbGZrVjdCWEgzS2EwK09tdXdGZ0JoQ0t1ZUlqV1BlSUZma0ZRR05QTllYZThCelI3bm5lTU5BdGo2cmciLCJtYWMiOiIwMjJmMWU3OTUyNDAwYTM4MzViOGQ1YWIwZmJkYTNmYmFlZDc4MDViMjUzYzQ5ZDkwYWVhN2U5M2I5MjQ3ZjNjIn0%3D
			bireysel.zirraatbankasy.com/	1970-01-20 16:29:20	Name: ziraat_bankasi_session Value: eyJpdiI6IlVYM3dQTjBabStaYVBJL0NrWWltSEE9PSIsInZhbHVlIjoiUUdIV3Z3NUVJOUU0aFFjV1RkUC80aGc4Z1RXeDdCME9YTThIWXhidW5GYUhOcFl3SmJ2bWJxQWdaajQ1UG1mRWdMWDN5b1p0cStic2RqYldCZjVTS3l4Q0pzQ2hBcjRnQXNoanRZdDdqKzlXYlpJaCs0cXB0aHB0d2g5dDNUUzYiLCJtYWMiOiI4NWYxY2Y0ODlmMTgwY2E3MGYwZWE4NmIzZWJiNTE2ZTIwNzJkNjc2YjkwMWIwMTliOWJlYTgzMDcyOGY1OTg5In0%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bireysel.zirraatbankasy.com
fonts.googleapis.com
fonts.gstatic.com
unicons.iconscout.com
178.62.68.74
2606:4700::6812:1df3
2607:f8b0:4006:81d::200a
2607:f8b0:4006:822::2003
21e9a1280bd64dbc540a9a82a1694efb4002b58c32c8c123dfaf2e80e8dafd47
22ff898a14845b852d7a96f333cb3ea5134cd008bc01665d948e727ad0e850e5
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
47ffc00429342db1b5fd3bd0438fac6f08f398fc499fd485e5fec5276030278a
5ef914e59b0047a261844d96acabb60c34d3acab6b85ea24198726ce4781fd37
76c63eb57b94cca29ebfe2936ee2f04484e54b149e0237d731984d577d7f7474
982c27d8483f4945573ea223e5de357c9d09cc65c26439a0edf5bf740bbd69e9
99f381baf34a259f521bfd6e27531f0e706d3133f2288106eb0f8f7813d98735
a133ac374f1d67d935e32954eecad95016064e834d305cd076899fa1e60713f7
a2b5d3d882accb3e5c3d31f6f39a5495803dc615d2fd7b40942626afa1f4c469
abac313530031e403c7cadf083a9e0ae41939720e5cd40bf7289add3b8382ee4
b5f6d1cd9dfac2e3e8794297cae7b0acb3b371f81d3b6a2f738a33b9845632ce
b8985337c167aa4e6e5296ffa6fd288e65bcd4e0da8f82439726f961f6f733da
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638
decf4fdfeba38d2e6eb2ec89905c0b9ce081e9d3cb8fd0a9ee94d8583139ca96
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

bireysel.zirraatbankasy.com Open in urlscan Pro 178.62.68.74 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

232 kBTransfer

1171 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

bireysel.zirraatbankasy.com Open in urlscan Pro
178.62.68.74 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

232 kB
Transfer

1171 kB
Size

2
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!