urlscan.io logo urlscan.io
SecurityTrails logo

saazain.com Open in urlscan Pro
198.12.246.179  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://saazain.com/card.php
Effective URL: https://saazain.com/otp.html
Submission: On August 02 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 198.12.246.179, located in Ashburn, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is saazain.com.
TLS certificate: Issued by R11 on June 16th 2024. Valid for: 3 months.
This is the only time saazain.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Garanti (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2 198.12.246.179 398101 (GO-DADDY-...)
13 217.68.217.11 12903 (GARANTI-TECH)
1 2 23.53.42.160 20940 (AKAMAI-ASN1)
2 2a02:26f0:170... 20940 (AKAMAI-ASN1)
4 2a02:26f0:350... 20940 (AKAMAI-ASN1)
21 5
2    198.12.246.179 (Ashburn, United States)

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 179.246.12.198.host.secureserver.net
saazain.com
13    217.68.217.11 (Turkey)

ASN12903 (GARANTI-TECH, TR)
sube.assets.garantibbva.com.tr
2    23.53.42.160 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-42-160.deploy.static.akamaitechnologies.com
img1.wsimg.com
2    2a02:26f0:1700:11::b856:6788 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
events.api.secureserver.net
4    2a02:26f0:3500:899::228b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
csp.secureserver.net
Apex Domain
Subdomains		 Transfer
13 garantibbva.com.tr
sube.assets.garantibbva.com.tr — Cisco Umbrella Rank: 378215
370 KB
6 secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 20700
csp.secureserver.net — Cisco Umbrella Rank: 20670
558 B
2 wsimg.com
img1.wsimg.com — Cisco Umbrella Rank: 15358
21 KB
2 saazain.com
saazain.com
3 KB
21 4
Domain Requested by
13 sube.assets.garantibbva.com.tr saazain.com
sube.assets.garantibbva.com.tr
4 csp.secureserver.net img1.wsimg.com
2 events.api.secureserver.net img1.wsimg.com
2 img1.wsimg.com 1 redirects saazain.com
2 saazain.com 1 redirects
21 5

This site contains links to these domains. Also see Links.

Domain
sube.garantibbva.com.tr
www.garantibbva.com.tr
Subject Issuer Validity Valid
www.saazain.com
R11		 2024-06-16 -
2024-09-14		 3 months crt.sh
sube.assets.garantibbva.com.tr
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-01-04 -
2025-01-03		 a year crt.sh
*.api.secureserver.net
Starfield Secure Certificate Authority - G2		 2024-07-15 -
2025-08-16		 a year crt.sh
*.secureserver.net
Starfield Secure Certificate Authority - G2		 2023-10-10 -
2024-11-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://saazain.com/otp.html
Frame ID: 28ED1FB515C9A25568AA4BF98FE8A60E
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Online Banking

Page URL History Show full URLs

  1. http://saazain.com/card.php HTTP 307
    https://saazain.com/card.php HTTP 302
    https://saazain.com/otp.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

21
Requests

95 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

394 kB
Transfer

890 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://saazain.com/card.php HTTP 307
    https://saazain.com/card.php HTTP 302
    https://saazain.com/otp.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
  • https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request otp.html
saazain.com/
Redirect Chain
  • http://saazain.com/card.php
  • https://saazain.com/card.php
  • https://saazain.com/otp.html
11 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://saazain.com/otp.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.12.246.179 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
179.246.12.198.host.secureserver.net
Software
Apache /
Resource Hash
eebe0274b739dccfbd9bc7db997ec88fc57b29d73422f3b531af7c1e36c803d2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
br
content-length
2991
content-type
text/html
date
Fri, 02 Aug 2024 05:42:28 GMT
etag
"aa929-29ab-61b27a9f22c2d-br"
last-modified
Tue, 18 Jun 2024 10:37:09 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-encoding
br
content-length
1
content-type
text/html; charset=UTF-8
date
Fri, 02 Aug 2024 05:42:27 GMT
location
otp.html
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/8.2.20
addtohomescreen.css
sube.assets.garantibbva.com.tr/assets/css/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/addtohomescreen.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
e464e649382f0b340febadd96d0c42649146f337a20c13b01d6f0fab6a38bd2c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 07:04:26 GMT
ETag
"bb4-61e7196899280"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
Content-Length
1356
Expires
Sun, 01 Sep 2024 05:42:29 GMT
pace.css
sube.assets.garantibbva.com.tr/assets/css/ 		566 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/pace.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
1b82aa466e978481cd73c23382706e0a35834830fef6ede2b60cc6faab3c10e7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 30 Jul 2024 07:04:18 GMT
ETag
"236-61e71960f8080"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Content-Length
566
Keep-Alive
timeout=65, max=100
Expires
Sun, 01 Sep 2024 05:42:29 GMT
firstscreen.css
sube.assets.garantibbva.com.tr/assets/css/ 		773 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/firstscreen.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
7d0777cac58dc6055e2e0e6aad20af5f5baf42809035103317719153d8da8971
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 30 Jul 2024 07:04:00 GMT
ETag
"305-61e7194fcd800"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Content-Length
773
Keep-Alive
timeout=65, max=100
Expires
Sun, 01 Sep 2024 05:42:29 GMT
bootstrap-login.css
sube.assets.garantibbva.com.tr/assets/css/ 		212 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
b4abe73a248b9b2983fa297b73d6104f25796410f88e65aca6d860d0d97306cd
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 07:03:52 GMT
ETag
"350be-61e719482c600"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
Content-Length
50993
Expires
Sun, 01 Sep 2024 05:42:29 GMT
bootstrap-login-utility.css
sube.assets.garantibbva.com.tr/assets/css/ 		210 KB
47 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login-utility.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
464bc5ed6aa582d7ec81c537c2cde24d48fc8c72875c8151de38273ba668fe11
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 07:03:48 GMT
ETag
"34683-61e719445bd00"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
Content-Length
47540
Expires
Sun, 01 Sep 2024 05:42:29 GMT
gt-facelift-login-style.css
sube.assets.garantibbva.com.tr/assets/css/ 		65 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/css/gt-facelift-login-style.css?__ctst__=1718673941539
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
2aa2e1432f2be7a3d070e94cc564e59bd92edc6b12fc09b1a626a20fea83b092
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 07:04:30 GMT
ETag
"102ee-61e7196c69b80"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
Content-Length
9168
Expires
Sun, 01 Sep 2024 05:42:29 GMT
logo-garantibbva-2x.png
sube.assets.garantibbva.com.tr/assets/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sube.assets.garantibbva.com.tr/assets/img/logo-garantibbva-2x.png
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
3541db151826636ff9b170b457d6019b1593a62f4782cb2e3846b61ed1bcf60c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"1a4b-61e715fb37c80"
Content-Type
image/png
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Content-Length
6731
Keep-Alive
timeout=65, max=99
Expires
Sun, 01 Sep 2024 05:42:29 GMT
scc-c2.min.js
img1.wsimg.com/signals/js/clients/scc-c2/
Redirect Chain
  • https://img1.wsimg.com/traffic-assets/js/tccl.min.js
  • https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
105 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
H2
Server
23.53.42.160 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-160.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8f7092c94ef904c57584706cdb5f1fd9fe1efce52ce3105e99b9a7def487f09f

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id
VDVeY4oO8ClQrknn.k4OgPWK0heF1LAr
content-encoding
gzip
date
Fri, 02 Aug 2024 05:42:29 GMT
x-amz-request-id
0TSJGGF1J7TQ2C9Q
x-amz-server-side-encryption
AES256
x-amz-meta-version
0.4.0
content-length
20848
x-amz-id-2
vB1xV0z8z9VxCz9YOXrYOGCp+1rmiDsjKqplM7hwmGwRjbrOJKEVqlQyV5sQfpCryN/psdbqfpLj6nqXs1JWEw==
last-modified
Fri, 17 May 2024 22:31:26 GMT
etag
"ace51bdb3b35a6b66c74fa115d4caa3f"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=1800
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 02 Aug 2024 06:12:29 GMT

Redirect headers

location
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
access-control-allow-origin
*
date
Fri, 02 Aug 2024 05:42:29 GMT
cache-control
max-age=31536000
timing-allow-origin
*
content-length
0
expires
Sat, 02 Aug 2025 05:42:29 GMT
logo-garantibbva-2x.png
sube.assets.garantibbva.com.tr/assets/img/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sube.assets.garantibbva.com.tr/assets/img/logo-garantibbva-2x.png
Requested by
Host: saazain.com
URL: https://saazain.com/otp.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
3541db151826636ff9b170b457d6019b1593a62f4782cb2e3846b61ed1bcf60c

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"1a4b-61e715fb37c80"
Content-Type
image/png
Cache-Control
public
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Content-Length
6731
Expires
Sun, 01 Sep 2024 05:42:29 GMT
SourceSansPro-Regular.woff
sube.assets.garantibbva.com.tr/assets/fonts/ 		67 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/fonts/SourceSansPro-Regular.woff
Requested by
Host: sube.assets.garantibbva.com.tr
URL: https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
4d05c31802fc851316e0e0587e3b16b4161859f816a529845b1fad9fc84a2399
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Origin
https://saazain.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"10c64-61e715fb37c80"
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
content-length
72096
icons.woff
sube.assets.garantibbva.com.tr/assets/fonts/ 		38 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/fonts/icons.woff
Requested by
Host: sube.assets.garantibbva.com.tr
URL: https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
f79ac9928f4fdc7cb758e936ee5ff677223e62a0146ec993ce694ac861ec34c2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Origin
https://saazain.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"9730-61e715fb37c80"
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
Content-Length
25011
SourceSansPro-Light.woff
sube.assets.garantibbva.com.tr/assets/fonts/ 		67 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/fonts/SourceSansPro-Light.woff
Requested by
Host: sube.assets.garantibbva.com.tr
URL: https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
d094bf5e2ed17c9d18a11c0490dea66b35ac0f50c5bb63350e28273b710c2e28
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Origin
https://saazain.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"10bf8-61e715fb37c80"
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
content-length
72070
SourceSansPro-Semibold.woff
sube.assets.garantibbva.com.tr/assets/fonts/ 		67 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/fonts/SourceSansPro-Semibold.woff
Requested by
Host: sube.assets.garantibbva.com.tr
URL: https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
82bacd1dfe341ae6a5a28507d2f5d7ef4fcdad9aaf176448ce6f0d312c6b4fe7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://sube.assets.garantibbva.com.tr/assets/css/bootstrap-login.css?__ctst__=1718673941539
Origin
https://saazain.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"10b84-61e715fb37c80"
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=100
content-length
71981
event
events.api.secureserver.net/t/1/tl/ 		43 B
279 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://events.api.secureserver.net/t/1/tl/event?dh=saazain.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F127.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.0&vg=5d422a58-7064-4f2b-9006-18a5b42ada19&vtg=5d422a58-7064-4f2b-9006-18a5b42ada19&dp=%2Fotp.html&trace_id=1accd0f38a0945fbbe743dea18ce073b&cts=2024-08-02T05%3A42%3A29.841Z&hit_id=bb3c4389-e6c0-49a5-b61e-ff00659b8996&ht=pageview&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl504289%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229945250%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=1528626977&z=1515715223
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:1700:11::b856:6788 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
date
Fri, 02 Aug 2024 05:42:30 GMT
x-content-type-options
nosniff
x-frame-options
DENY
content-type
image/gif
access-control-allow-origin
https://saazain.com
cache-control
private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
content-length
43
x-xss-protection
1; mode=block
event
events.api.secureserver.net/t/1/tl/ 		43 B
279 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://events.api.secureserver.net/t/1/tl/event?dh=saazain.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F127.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.0&vg=5d422a58-7064-4f2b-9006-18a5b42ada19&vtg=5d422a58-7064-4f2b-9006-18a5b42ada19&dp=%2Fotp.html&trace_id=1accd0f38a0945fbbe743dea18ce073b&cts=2024-08-02T05%3A42%3A30.143Z&hit_id=c6b7d13f-4192-4a7e-a77b-a2a9e3964683&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl504289%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229945250%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=1528626977&z=387648044&tce=1722577348850&tcs=1722577348850&tdc=1722577350136&tdclee=1722577349844&tdcles=1722577349844&tdi=1722577349844&tdl=1722577349252&tdle=1722577348850&tdls=1722577348850&tfs=1722577348850&tns=1722577346523&trqs=1722577348862&tre=1722577349023&trps=1722577349021&tles=1722577350136&tlee=0&nt=navigate&LCP=3348&nav_type=hard
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:1700:11::b856:6788 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
date
Fri, 02 Aug 2024 05:42:30 GMT
x-content-type-options
nosniff
x-frame-options
DENY
content-type
image/gif
access-control-allow-origin
https://saazain.com
cache-control
private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
content-length
43
x-xss-protection
1; mode=block
eventbus
csp.secureserver.net/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://csp.secureserver.net/eventbus
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:3500:899::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains ; preload

Request headers

Referer
https://saazain.com/
Authorization
api-key b18ef4f046435b64a469b32c3c1c20a3
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Fri, 02 Aug 2024 05:42:30 GMT
Strict-Transport-Security
max-age=86400 ; includeSubDomains ; preload
x-amzn-trace-id
Root=1-66ac71c6-268c5a9e5be553352c2eb4e0
x-amzn-requestid
9d81127b-9702-4b28-a38a-77f931bda749
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
x-envoy-upstream-service-time
104
Connection
keep-alive
x-amz-apigw-id
b3a3FHbpIAMEkog=
Content-Length
0
Expires
Fri, 02 Aug 2024 05:42:30 GMT
eventbus
csp.secureserver.net/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://csp.secureserver.net/eventbus
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:3500:899::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains ; preload

Request headers

Referer
https://saazain.com/
Authorization
api-key 8da2217409854bee82e12dc4ca0b39fb
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Fri, 02 Aug 2024 05:42:30 GMT
Strict-Transport-Security
max-age=86400 ; includeSubDomains ; preload
x-amzn-trace-id
Root=1-66ac71c6-0fd6871e59411e45124d594f
x-amzn-requestid
f663fe72-8308-4a82-986f-2e06d1c19666
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
x-envoy-upstream-service-time
250
Connection
keep-alive
x-amz-apigw-id
b3a3FELNIAMEqRQ=
Content-Length
0
Expires
Fri, 02 Aug 2024 05:42:30 GMT
eventbus
csp.secureserver.net/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://csp.secureserver.net/eventbus
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:3500:899::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains ; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://saazain.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type,authorization
Access-Control-Allow-Methods
OPTIONS,POST
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
0
Content-Type
application/json
Date
Fri, 02 Aug 2024 05:42:30 GMT
Expires
Fri, 02 Aug 2024 05:42:30 GMT
Pragma
no-cache
Strict-Transport-Security
max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id
b3a3EHj2oAMEUJw=
x-amzn-requestid
fa5cd2f4-a17f-4f6a-8273-4b4ad5e2da19
x-amzn-trace-id
Root=1-66ac71c6-683ba34819bf876856514b67
x-envoy-upstream-service-time
7
eventbus
csp.secureserver.net/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://csp.secureserver.net/eventbus
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:3500:899::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains ; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://saazain.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type,authorization
Access-Control-Allow-Methods
OPTIONS,POST
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
0
Content-Type
application/json
Date
Fri, 02 Aug 2024 05:42:30 GMT
Expires
Fri, 02 Aug 2024 05:42:30 GMT
Pragma
no-cache
Strict-Transport-Security
max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id
b3a3EGd_IAMELbg=
x-amzn-requestid
aba00d6b-4e06-4bc6-8ba6-d525a40aa1fb
x-amzn-trace-id
Root=1-66ac71c6-42e4b4eb6550b8237bb345ee
x-envoy-upstream-service-time
6
favicon.ico
sube.assets.garantibbva.com.tr/assets/img/ 		31 KB
14 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://sube.assets.garantibbva.com.tr/assets/img/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.68.217.11 , Turkey, ASN12903 (GARANTI-TECH, TR),
Reverse DNS
Software
/
Resource Hash
0db7e4dcc239c436fca36d8d30dfcfba672f83ae9df63a3b6ea23a80ef8e2c8e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload

Request headers

Referer
https://saazain.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:42:30 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Encoding
gzip
Last-Modified
Tue, 30 Jul 2024 06:49:06 GMT
ETag
"7d26-61e715fb37c80"
Vary
Accept-Encoding
Content-Type
image/x-icon
Cache-Control
public
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Accept, Origin, X-Requested-With, Content-Type, Last-Modified
Keep-Alive
timeout=65, max=99
Content-Length
13767
Expires
Sun, 01 Sep 2024 05:42:30 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Garanti (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _trfd object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| scc-c2 object| _trfq

3 Cookies

Domain/Path Name / Value
.saazain.com/ Name: _tccl_visitor
Value: 5d422a58-7064-4f2b-9006-18a5b42ada19
.saazain.com/ Name: _tccl_visit
Value: 5d422a58-7064-4f2b-9006-18a5b42ada19
.saazain.com/ Name: _scc_session
Value: pc=1&C_TOUCH=2024-08-02T05:42:29.840Z