giftbsvrhmnktl23.cloud Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://giftbsvrhmnktl23.cloud/
Submission Tags: @phish_report
Submission: On September 09 via api (September 9th 2024, 7:22:48 pm UTC) from FI — Scanned from NL

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is giftbsvrhmnktl23.cloud.
TLS certificate: Issued by WE1 on September 7th 2024. Valid for: 3 months.

This is the only time giftbsvrhmnktl23.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	195.39.224.29 195.39.224.29	28967 (FIBABANKA-AS) (FIBABANKA-AS)
3	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	3

6 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

giftbsvrhmnktl23.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 195.39.224.29 (Turkey)

ASN28967 (FIBABANKA-AS, TR)
PTR: internetbankaciligi.fibabanka.com.tr

internetbankaciligi.fibabanka.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

giftbsvrhmnktl23.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	giftbsvrhmnktl23.cloud 1 redirects giftbsvrhmnktl23.cloud	114 KB
7	fibabanka.com.tr internetbankaciligi.fibabanka.com.tr	70 KB
15	2

	Domain	Requested by
9	giftbsvrhmnktl23.cloud	1 redirects giftbsvrhmnktl23.cloud
7	internetbankaciligi.fibabanka.com.tr	giftbsvrhmnktl23.cloud
15	2

This site contains no links.

Subject Issuer	Validity	Valid
giftbsvrhmnktl23.cloud WE1	`2024-09-07` - `2024-12-06`	3 months	crt.sh
*.fibabanka.com.tr GlobalSign RSA OV SSL CA 2018	`2024-04-19` - `2025-05-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://giftbsvrhmnktl23.cloud/
Frame ID: 35C4A30CBA4D49E33646D1ECFE0F1B4F
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

İnternet Bankacılığı - Fibabanka

Page URL History Show full URLs

https://giftbsvrhmnktl23.cloud/ Page URL
https://giftbsvrhmnktl23.cloud/cdn-cgi/phish-bypass?atok=foGsZysVCixqZ4XUk8I6bEbECUovMervci75vxH6D2s-172590... HTTP 301
https://giftbsvrhmnktl23.cloud/ Page URL

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

184 kB
Transfer

281 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://giftbsvrhmnktl23.cloud/ Page URL
https://giftbsvrhmnktl23.cloud/cdn-cgi/phish-bypass?atok=foGsZysVCixqZ4XUk8I6bEbECUovMervci75vxH6D2s-1725909748-0.0.1.1-%2F HTTP 301
https://giftbsvrhmnktl23.cloud/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
giftbsvrhmnktl23.cloud/ 4 KB
2 KB 264ms
30ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://giftbsvrhmnktl23.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71ae560748c6e9d979f4dc1cda68804a35a14a784513966e4d427847a96a923e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cf-ray: 8c098c1abe541c92-AMS
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 09 Sep 2024 19:22:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xn6DxAW1GyDtFXPsuLv3xaOIcyE9ej97T3xbyLXPQ7KZbFQWoXWrfGQba47Q%2FXl3SNOQ298rMDXlVDdsIGp63Bwq3hXlztnA8uiWLnIJxJ0QfLn1Q%2FPD2PvmOUpLiT3Tax%2BdVxwRvNIsoXiWepH5Fe%2FXr%2B90"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 cf.errors.css
giftbsvrhmnktl23.cloud/cdn-cgi/styles/ 23 KB
5 KB 20ms
19ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://giftbsvrhmnktl23.cloud/cdn-cgi/styles/cf.errors.css

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 04 Sep 2024 18:14:57 GMT
server: cloudflare
etag: W/"66d8a3a1-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8c098c1b1ed71c92-AMS
expires: Mon, 09 Sep 2024 21:22:28 GMT

GET
H2 200 icon-exclamation.png
giftbsvrhmnktl23.cloud/cdn-cgi/images/ 452 B
586 B 33ms
32ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://giftbsvrhmnktl23.cloud/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://giftbsvrhmnktl23.cloud/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:29 GMT
x-content-type-options: nosniff
last-modified: Wed, 04 Sep 2024 18:14:57 GMT
server: cloudflare
etag: "66d8a3a1-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8c098c1c58dc1c92-AMS
content-length: 452
expires: Mon, 09 Sep 2024 21:22:29 GMT

GET
H2 404 favicon.ico
giftbsvrhmnktl23.cloud/ 808 B
786 B 61ms
61ms Other
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://giftbsvrhmnktl23.cloud/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 08 Sep 2024 10:15:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YKlihctYule5ppGwwvZwXkRO8JMOSpDUQsYXyzxluh%2Fb6Tj7TCO4v0gWU%2FwCcjaGqZ9Rgfh%2BIe9jjaOZVEzlbjMi4fgT5aTFAj2WohyBPQHGRUbX%2Bp18ENTJUBr38iVjN1kf6PPS%2FXWjGQHCcl5RcuTdKYvY"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 8c098c1ca9651c92-AMS
alt-svc: h3=":443"; ma=86400

GET
H2

200

Primary Request / Show response
giftbsvrhmnktl23.cloud/
Redirect Chain

https://giftbsvrhmnktl23.cloud/cdn-cgi/phish-bypass?atok=foGsZysVCixqZ4XUk8I6bEbECUovMervci75vxH6D2s-1725909748-0.0.1.1-%2F
https://giftbsvrhmnktl23.cloud/

49 KB
9 KB

7714ms
7713ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://giftbsvrhmnktl23.cloud/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33 PleskLin
Resource Hash: b9cb7a44f069b574a11dc239bc4ed543025b4c285b0f9966ed2ef93f578a42b8

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8c098c437e561c92-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 09 Sep 2024 19:22:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9PInQWTV8BFK6cc3FUJJoXvKdYOK3bZafr5PrzDB8UCNa0ISISg4C%2BPqgaKEF8LAHZzCpkvS0XsuKtVhoSztlCOq6n%2BV5PrOlhl7jxCF4mo7vRoPESet4eCduw92LlSrC3iVPPnzroXg11ztPGIsNC6bVYhM"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-cache-status: BYPASS
x-powered-by: PHP/7.4.33 PleskLin

Redirect headers

cache-control: private, no-cache
cf-ray: 8c098c434e041c92-AMS
content-length: 167
content-type: text/html
date: Mon, 09 Sep 2024 19:22:35 GMT
location: https://giftbsvrhmnktl23.cloud/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H/1.1 200
OK mask.png
internetbankaciligi.fibabanka.com.tr/ 853 B
1 KB 513ms
87ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/mask.png?c944b68f94f8f75acfa54161df5be7f0

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

6e2cb2019248aae70b028806100716cd59fee55843dfcd449d8f4f70e72de687

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-355"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 853
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK logosFibaBig.png
internetbankaciligi.fibabanka.com.tr/ 3 KB
4 KB 497ms
72ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/logosFibaBig.png?57e859af74f04810dd4bd577077e5ced

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

89d4895235a6c6224de744df63f4dcd4721abf65977165075f03ff3755dd9fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-ca5"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 3237
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK keyboard.png
internetbankaciligi.fibabanka.com.tr/ 392 B
904 B 462ms
93ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/keyboard.png?6ffbcd03cf60e234c41be0a1df1d634e

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

8f2ffa35b11473699caee7e334a55c55f48161c87e7168b7a8db31a9369681a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-188"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 392
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK web-app-bg.png
internetbankaciligi.fibabanka.com.tr/ 50 KB
50 KB 456ms
88ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/web-app-bg.png?3f6cef3d2e944e0addf9f2b2b409f09d

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

afad8115a957455e1ff9db8603fe2e43189546b816a05e5998492883333fb6fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-c633"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 50739
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK download-on-the-ios-app@3x.png
internetbankaciligi.fibabanka.com.tr/ 2 KB
2 KB 435ms
68ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/download-on-the-ios-app@3x.png?ea4361bc3997c44e4d5af15ba1e67e37

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

3cf40a56ef066c25603078b6808933bacedb308bfb686e10d9798bc6d1223bbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-7c4"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 1988
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK download-on-the-google@3x.png
internetbankaciligi.fibabanka.com.tr/ 3 KB
4 KB 522ms
79ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/download-on-the-google@3x.png?712861405cf8d1d83387ae76a242c1d6

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

4318072cb4e55a9419fe50d93df99e319810020262115f7c7296022a6c511334

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-c1e"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 3102
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK callCenterImage.png
internetbankaciligi.fibabanka.com.tr/ 8 KB
8 KB 395ms
74ms Image
image/png 195.39.224.29
FIBABANKA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internetbankaciligi.fibabanka.com.tr/callCenterImage.png?46a5dc1fd1baea6f81a5c1dd674910aa

Requested by

Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.39.224.29 , Turkey, ASN28967 (FIBABANKA-AS, TR),

Reverse DNS

internetbankaciligi.fibabanka.com.tr

Software

Resource Hash

fbd9fd1b865759b699464038300ada3e904cd4c6e799e455f66a57330ca24d86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Sep 2024 22:25:44 GMT
etag: "66db8168-1f7f"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 8063
x-xss-protection: 1; mode=block

GET
H3 200 4551e8a2c6e856dad93e18abeb8eba93.otf
giftbsvrhmnktl23.cloud/assets/ 63 KB
45 KB 86ms
85ms Font
font/otf 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://giftbsvrhmnktl23.cloud/assets/4551e8a2c6e856dad93e18abeb8eba93.otf
Requested by: Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e5306eefcc34967144b899dee62f3ef7406e8540891c4abaef076ec92fad4127

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
Origin: https://giftbsvrhmnktl23.cloud
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Sep 2023 11:33:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64f9b520-fcf4"
x-cache-status: BYPASS
vary: Accept-Encoding
x-powered-by: PleskLin
content-type: font/otf
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QVOXLYoxC1C%2FwCjl2bT4jwEGvS1cZPXk%2BqabesGO57HwO4sGeW4Gl1KQBTl%2BHJRDmERAbN2R81PyuKGHulP2oF55g8juBZtc3Uh1A7QF1JxYn%2BwGFF%2BFTcM7TDid%2F4S49qNNreTjob54"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 8c098c747c310e87-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 84d5e430a2dd042573bed12641931b35.otf
giftbsvrhmnktl23.cloud/assets/ 67 KB
45 KB 71ms
70ms Font
font/otf 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://giftbsvrhmnktl23.cloud/assets/84d5e430a2dd042573bed12641931b35.otf
Requested by: Host: giftbsvrhmnktl23.cloud
URL: https://giftbsvrhmnktl23.cloud/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 5598f15eecbd0c1db372f9a2f69432ab1572f624af008f6950fce8581c2996c4

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
Origin: https://giftbsvrhmnktl23.cloud
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Sep 2023 11:33:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64f9b522-10c1c"
x-cache-status: BYPASS
vary: Accept-Encoding
x-powered-by: PleskLin
content-type: font/otf
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t20tn9x8C7Tinjsr5HQg03ykvpkANk7b4Va1HefuDwLzQqtiOMYATx1dXWvzSW1J7hKr1r4X0NWCwrEgybxGPHxXPjpjlLIgapJgrFNY6IELJ1p4FLkZxrIuNKPbLY651JYzQPKUojru"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 8c098c747c380e87-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.png
giftbsvrhmnktl23.cloud/ 7 KB
7 KB 81ms
80ms Other
image/png 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://giftbsvrhmnktl23.cloud/favicon.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 98a3bbab02dde611e653c0751e8c1cce9137be4c107e1e42bda3aaec60c8d0d0

Request headers

Referer: https://giftbsvrhmnktl23.cloud/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 09 Sep 2024 19:22:43 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
x-cache-status: BYPASS
alt-svc: h3=":443"; ma=86400
content-length: 6963
last-modified: Fri, 25 Aug 2023 03:54:48 GMT
server: cloudflare
etag: "64e82608-1b33"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOIqGnUv%2Bv5jS29n9BPj8dSydbJ0D9i9353TdBvuR%2BLMaU%2F4c8XIvuM%2BgrlUORb6l5EUVaYQE3nZj4uFWGUwTEIb%2B5XwL%2FuACW852iXdAq7w2KIrOd6KD5XzVP2T0HzUFIJbMPNZKWjs"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8c098c780a820e87-AMS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getIEVersion

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.giftbsvrhmnktl23.cloud/	1970-01-20 23:26:36	Name: __cf_mw_byp Value: foGsZysVCixqZ4XUk8I6bEbECUovMervci75vxH6D2s-1725909748-0.0.1.1-/
			giftbsvrhmnktl23.cloud/	1970-01-20 23:26:07	Name: lonercu Value: j9bc5n5vt27n1p8u0tm1p2m6fi

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://giftbsvrhmnktl23.cloud/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://giftbsvrhmnktl23.cloud/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "username"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

giftbsvrhmnktl23.cloud
internetbankaciligi.fibabanka.com.tr
188.114.96.3
195.39.224.29
2a06:98c1:3120::3
3cf40a56ef066c25603078b6808933bacedb308bfb686e10d9798bc6d1223bbe
4318072cb4e55a9419fe50d93df99e319810020262115f7c7296022a6c511334
5598f15eecbd0c1db372f9a2f69432ab1572f624af008f6950fce8581c2996c4
6e2cb2019248aae70b028806100716cd59fee55843dfcd449d8f4f70e72de687
71ae560748c6e9d979f4dc1cda68804a35a14a784513966e4d427847a96a923e
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
89d4895235a6c6224de744df63f4dcd4721abf65977165075f03ff3755dd9fc4
8f2ffa35b11473699caee7e334a55c55f48161c87e7168b7a8db31a9369681a7
98a3bbab02dde611e653c0751e8c1cce9137be4c107e1e42bda3aaec60c8d0d0
afad8115a957455e1ff9db8603fe2e43189546b816a05e5998492883333fb6fa
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
b9cb7a44f069b574a11dc239bc4ed543025b4c285b0f9966ed2ef93f578a42b8
e5306eefcc34967144b899dee62f3ef7406e8540891c4abaef076ec92fad4127
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fbd9fd1b865759b699464038300ada3e904cd4c6e799e455f66a57330ca24d86

giftbsvrhmnktl23.cloud Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

3 Countries

184 kBTransfer

281 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

2 Console Messages

Security Headers

Indicators

giftbsvrhmnktl23.cloud Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

184 kB
Transfer

281 kB
Size

2
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!