afyonanahaber.com.tr Open in urlscan Pro
78.31.67.16  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://sankyo-m.jp/pdfs/cs.html?email=cert@soc.tdc.dk Page URL
2. https://afyonanahaber.com.tr/mysqladmin/img/index.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	cs.html sankyo-m.jp/pdfs/	590 B 868 B	23ms 13ms	Document text/html	119.245.143.45 INFOSPHERE NTT PC...
General Check archive.org Show headers Download Go to Full URL http://sankyo-m.jp/pdfs/cs.html?email=cert@soc.tdc.dk Protocol HTTP/1.1 Server 119.245.143.45 Osaka, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP), Reverse DNS sankyo-m.jp Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 590 Content-Type text/html Date Mon, 02 May 2022 11:17:39 GMT ETag "6041cfe2-24e-5ddba2d56beb6" Keep-Alive timeout=3, max=100 Last-Modified Thu, 28 Apr 2022 17:22:57 GMT Server Apache
GET H2	200	Primary Request index.html Show response afyonanahaber.com.tr/mysqladmin/img/	11 KB 4 KB	1188ms 246ms	Document text/html	78.31.67.16 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://afyonanahaber.com.tr/mysqladmin/img/index.html Requested by Host: sankyo-m.jp URL: http://sankyo-m.jp/pdfs/cs.html?email=cert@soc.tdc.dk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 78.31.67.16 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.karahisartv.com Software nginx / Resource Hash d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c Request headers Referer http://sankyo-m.jp/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers content-encoding gzip content-type text/html date Mon, 02 May 2022 11:17:40 GMT etag W/"61f7a0fa-2bea" last-modified Mon, 31 Jan 2022 08:42:34 GMT server nginx vary Accept-Encoding
GET H2	200	email-2-icon.png icons.iconarchive.com/icons/graphicloads/100-flat/256/	6 KB 7 KB	323ms 307ms	Image image/png	2606:4700:3038::6815:e9b6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9b6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c Request headers accept-language jp-JP,jp;q=0.9 Referer https://afyonanahaber.com.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT cf-cache-status REVALIDATED last-modified Wed, 08 Jul 2020 23:41:28 GMT server cloudflare etag "5f0659a8-19be" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n7nBbx5TC8FZ26KCChGy7wrFEqDxYC9Iq3XdYgFFwvwIpA1VXxdnbUt2%2B8JU4F2cbNzkaMNuUaShrPPneGyhrPmZ3wX451BPDq%2BnJwOHDMOLORSY92AaUaPixDU7k2WyzNqLtXlpk92xMClEgkl3SkdufUc%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 70505a1019141da3-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6590
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	341ms 111ms	Script application/javascript	2001:4de0:ac18::1:a:1b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer https://afyonanahaber.com.tr/ Origin https://afyonanahaber.com.tr accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-10fdd" vary Accept-Encoding x-hw 1651490260.dop029.sj3.t,1651490260.cds210.sj3.hn,1651490260.cds207.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	22ms 11ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://afyonanahaber.com.tr/ Origin https://afyonanahaber.com.tr accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1832293 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6157 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=txWPxat4RueWk%2FZWG0RiGHr2Zwoy9Qgr9ZhR8RBsnvtjXFpKwCvlLmqhLvp5av%2BJc3RUR8hT3o%2FgotHmmMJnDD5BJexIWTq2ZiJPoDJMaUw0hin%2BA5H32ZxtxFGKaJkoe6lYDdCPda5hbmaMJlGcrjB9"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 70505a101e1f349f-NRT expires Sat, 22 Apr 2023 11:17:40 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	28ms 16ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://afyonanahaber.com.tr/ Origin https://afyonanahaber.com.tr accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 907 age 39647 cdn-cachedat 04/23/2022 14:12:09 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cdn-proxyver 1.02 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 etag W/"14d449eb8876fa55e1ef3c2cc52b0c17" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 162716b8517c6405cf0cfbd1e8823e93 cf-ray 70505a101e9d80b7-NRT cdn-requestcountrycode US cdn-status 200 cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	90ms 6ms	Script text/javascript	2404:6800:4004:80a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:80a::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://afyonanahaber.com.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 30 Apr 2022 13:02:42 GMT content-encoding gzip x-content-type-options nosniff age 166498 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 30 Apr 2023 13:02:42 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	26ms 14ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://afyonanahaber.com.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 674, 718, 718 age 13278696 cdn-cachedat 2021-06-08 05:11:08 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid d57b249fbc897a386cb949167a1340aa cf-ray 70505a101c668078-NRT cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	jquery.session.min.js Show response cdn.jsdelivr.net/npm/jquery.session@1.0.0/	2 KB 2 KB	26ms 14ms	Script application/javascript	2606:4700::6810:5714 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js Requested by Host: afyonanahaber.com.tr URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://afyonanahaber.com.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 02 May 2022 11:17:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 3635605 x-jsd-version 1.0.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19162-FRA, cache-tyo11981-TYO timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4E9zxloAQLc8i%2FrRbKPzaMrzloImS4FiwQiTZpo4DQyIh06XhWBXG6QPwR0n1jIniUwJUfEruMQzeJVkiWNvgcNZkyhmxhjAFgCpWjAQWzwYSp6ATOR6EQJTMy6CJRrgnxFZHvxiPNW31BTstvg%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 70505a101e242071-NRT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| getDateTime string| message function| clickIE function| clickNS function| disableCtrlKeyCombination function| $ function| jQuery function| Popper object| bootstrap string| currentTime

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			afyonanahaber.com.tr/	1970-01-20 02:44:50	Name: __session:0.3172263673642963: Value: https:

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html#cert@soc.tdc.dk Message: Mixed Content: The page at 'https://afyonanahaber.com.tr/mysqladmin/img/index.html#cert@soc.tdc.dk' was loaded over HTTPS, but requested an insecure element 'http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://afyonanahaber.com.tr/mysqladmin/img/index.html#cert@soc.tdc.dk(Line 243) Message: Mixed Content: The page at 'https://afyonanahaber.com.tr/mysqladmin/img/index.html#cert@soc.tdc.dk' was loaded over HTTPS, but requested an insecure element 'http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

afyonanahaber.com.tr
ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
icons.iconarchive.com
maxcdn.bootstrapcdn.com
sankyo-m.jp
stackpath.bootstrapcdn.com
119.245.143.45
2001:4de0:ac18::1:a:1b
2404:6800:4004:80a::200a
2606:4700:3038::6815:e9b6
2606:4700::6810:5714
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:bcf
78.31.67.16
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b