urlscan.io logo urlscan.io
SecurityTrails logo

xz3cs.cloud Open in urlscan Pro
2606:4700:3032::ac43:c05a  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://xz3cs.cloud/
Effective URL: https://xz3cs.cloud/
Submission: On September 23 via api from QA — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 20 HTTP transactions. The main IP is 2606:4700:3032::ac43:c05a, located in United States and belongs to CLOUDFLARENET, US. The main domain is xz3cs.cloud.
TLS certificate: Issued by WE1 on September 22nd 2024. Valid for: 3 months.
This is the only time xz3cs.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Finansbank (Banking)

Domain & IP information

IP Address AS Autonomous System
19 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
20 2
Apex Domain
Subdomains		 Transfer
19 xz3cs.cloud
xz3cs.cloud
141 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 794
30 KB
20 2
Domain Requested by
19 xz3cs.cloud xz3cs.cloud
code.jquery.com
1 code.jquery.com xz3cs.cloud
20 2

This site contains links to these domains. Also see Links.

Domain
www.qnbfinansbank.com
Subject Issuer Validity Valid
xz3cs.cloud
WE1		 2024-09-22 -
2024-12-21		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://xz3cs.cloud/
Frame ID: 2A2A1AA89432910F1583BE4B952CF734
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

İnternet Şubesi

Page URL History Show full URLs

  1. http://xz3cs.cloud/ HTTP 307
    https://xz3cs.cloud/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

172 kB
Transfer

492 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://xz3cs.cloud/ HTTP 307
    https://xz3cs.cloud/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
xz3cs.cloud/
Redirect Chain
  • http://xz3cs.cloud/
  • https://xz3cs.cloud/
23 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33 PleskLin
Resource Hash
808b9ffb2b8d6667e1ae9caaf4398a137c66e5c635399e80401645141d0e5857

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8c792d19ee8094cf-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 23 Sep 2024 08:31:02 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dAVGcAwnn0Kr2sWuz04DJ7xIrsWLSSy70NELkNBE6C6CYaueU%2BzldH%2BRAB1RdP76cGMUksHyrmk90unnVPpkubvxDQ5TflABNtICI1jo4dE7L1DEheP9KqYArZYORf735MCI8tKKdF1UOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
x-cache-status
MISS
x-powered-by
PHP/7.4.33 PleskLin

Redirect headers

Location
https://xz3cs.cloud/
Non-Authoritative-Reason
HttpsUpgrades
speculation
xz3cs.cloud/cdn-cgi/ 		128 B
552 B 		Other
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://xz3cs.cloud
Referer
https://xz3cs.cloud/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ljg%2BvNJq99%2BDq5PVKZBvuV0Scf8mrcm8dFR3eQdUcziMNhSBedVGlIDpAPwzfzG7H1nkeORMzYZ%2FmNgmV%2FlXxcpUkkChOg4d%2FHEaZV1oRqgYHpMjH7%2B0rTBtxBR8zOU2tDXyThDbtHDaHA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a8f2294cf-LHR
access-control-allow-origin
https://xz3cs.cloud
content-length
128
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d84"
age
3510325
x-cache
HIT, HIT
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
55, 271267
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga21981-LGA, cache-lcy-eglc8600085-LCY
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1727080263.925962,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30879
server
nginx
1.css
xz3cs.cloud/assets/ 		202 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/assets/1.css
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
e1bc8b5658f16ea8945a2281db1f2c95cbb5ab9256c7400987e5d9b456213c2d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
BYPASS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"66f035c4-326a3"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4PE8lKXDMK%2BZTebiSwbKOXLf7bwbYby3tL7SOQknfojzqYfzYsdAdrH07Dok%2BnGP6nX%2BGdSD0lDFv8YiMcfCuogWnhFUplrVy%2BgdzYmuA6NccSt%2BG8t%2BxfP9XdIFOYnO77eJMor5pK2jWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a9f2f94cf-LHR
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
text/css
last-modified
Sun, 22 Sep 2024 15:20:36 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
login.css
xz3cs.cloud/assets/ 		17 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/assets/login.css
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
adcf2715a8b9d7b8e1f5c3f326445489ff68c511802cf23d2d0b89363e5bd6be

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
BYPASS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"66f039ae-42b8"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4fLI3p4ydb%2BLXhjoVE7WwOiUbdz2JhP2OHLr1%2Bq%2FC9GRnWJ7Y3fjEfYDv6d7qq5Ao2AOQEek%2B%2F5FDi%2Btph%2B3HdCZF095kzgHoOers6wKXDoV0dbA%2B85MtawReaUoxU3QttrIbh6LGohR0g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a9f3294cf-LHR
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
text/css
last-modified
Sun, 22 Sep 2024 15:37:18 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
login2.css
xz3cs.cloud/assets/ 		54 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/assets/login2.css
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
7f8700ef2732543508f6998c46e1552369e7c3c6d330d11d508833b36d4a5965

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
BYPASS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"66f03844-d67d"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GbxW1M2ihVJcB9IqGnW4ViyGJnno2uJK5qTUnVb1Hdsy3LxglmofI2HHNO851qqksOhxka28IKmMlA24DQmDGHqTpVl6HpC1I8ssoZhDnDmus2NffgZ%2F2wxUuXymUItS6k5EFil7kOLLEw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a9f3594cf-LHR
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
text/css
last-modified
Sun, 22 Sep 2024 15:31:16 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
content_title_left.png
xz3cs.cloud/assets/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/content_title_left.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
9a2765ce8c2c1b3ab845aa9d69528351bf4f9bce5c1142479be9a5c7a7865577

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f02f68-3bbe"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BkVdzGU09SmugmKU7GxtXa1t4pvTOyYq1hlHKNq415ebQUEOOpinRK00hue2JG2AePqkvo8WAcQUuzwhYj4gvvnR%2FYhFB8dBNYI5SANGDD54apY56d%2FxBw807qBepOVHGYtUCm1DrrgYLw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1b988894cf-LHR
accept-ranges
bytes
content-length
15294
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:53:28 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
content_title_right.png
xz3cs.cloud/assets/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/content_title_right.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
4288f17db6c0ddf260f7a73a8d40ddd2dbde9b0ce30fef8b7b4844c291a4a041

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f02f72-482"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SffCR8rINk%2Bo67hYpWg6ECr%2BrslpqAJbRxdcONWZtTvlV6vW8X7PWesFGbHWZo5yj%2BhKAhbs2Pc0aDmS%2Bg%2Bs6xqNA3qwqdzWq7PiRS0jTUB3daKOtgkkPJLmaEtgYc4Xuv6lfNmBjGi7Og%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1ba89f94cf-LHR
accept-ranges
bytes
content-length
1154
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:53:38 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
qr_disabled.png
xz3cs.cloud/assets/images/ 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/qr_disabled.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
323524115e60df7e7e094de9388e553bf8f7e87c8ef934d50ad1b99841c735e6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f03086-9bb2"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6HT4LdyzU63CNJe6aAFdisFlR9EVtZGhz1eMhyxHMHJRH0VeyUSC2T80kFjWu87O67GZ8bGB990eqvfDdV0Dst2LfdIQk3qapAzW6zcgiqowX3PhA1pVjsiD2diIUgZdgAlwBNgHBpCYZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a9f3794cf-LHR
accept-ranges
bytes
content-length
39858
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:58:14 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
captcha-refresh.jpg
xz3cs.cloud/assets/images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/captcha-refresh.jpg
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
6722e1471c13f7e3365469775fe0a6c39b1df6a5b4f6dff08b4f113ab545a163

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f02f86-15b7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AwRZ2aYUbTecnYIZpM5VFHukHgRAnuZCJaxwEX%2Fz80AgkEW3U9jzG1ofW7zpiIRNctc2mlbzllNv2yLPFbTZDtuLRVZfX2AmEvCXr%2F%2B%2F9fck1DJfmqrusEf6sjGcHb4nVQLfRgAHZGzEw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1a9f3994cf-LHR
accept-ranges
bytes
content-length
5559
date
Mon, 23 Sep 2024 08:31:02 GMT
content-type
image/jpeg
last-modified
Sun, 22 Sep 2024 14:53:58 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
content_ok.png
xz3cs.cloud/assets/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/content_ok.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
7f9856451b35e2bdad8f886132298558d91a43acdf686f40e18d3d95ba01eb32

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f0303c-428"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DWEibrGzCyoWGFzO9GoWG4BiG7OJivAzr9sPQXXocsl7gbTOVEE%2BfHwyo%2BU9JOgEeruHCEkv1%2FDaMk%2BtFwbD4WEvTC6WswxFKcEVTeDFIpZrllxIq%2FHleAP3lh2kVHTpgIDS2g2qYg68rA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bb8b394cf-LHR
accept-ranges
bytes
content-length
1064
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:57:00 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
guvenlik_top.png
xz3cs.cloud/assets/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/guvenlik_top.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
1add688782519f1f33deaf5a1a2042b51a6c25db796af48796ff4eada25231e9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f03074-529"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D5pw7EXFuejVoiPm%2B1rpfyVvmENhbZpA1dxctUnH1SYqmf4s5coPA%2F2pQDBzqpHg709BJd%2FKfCm0RgjF9XQ6GMXwy1K1n50vWzhR1HQ17N5Zfq0%2FTUuaMRqFFV6oCnJJroTZR5b2yLCUxA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bb8b494cf-LHR
accept-ranges
bytes
content-length
1321
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:57:56 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
guvenlik_bottom.png
xz3cs.cloud/assets/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/images/guvenlik_bottom.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
8b0bd6f54d36ad05ec14dda8b2450a9af826ac4030f304c6efbe460a679fc6ac

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

x-cache-status
MISS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f03070-865"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PcNLMAEf44vMEqoflUg5JVpRw%2BZ6JGK%2B0DE%2Fs3Q45xxQSxVd1fSY8N09vBynAObwHU1PfIaAGAeKVJsIDLJIw91yYUG93%2FHk%2BJlzDiKiO4CluRF29kaKEO3Zh4wPBPcOPTw%2FmKyixRZvRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bb8b794cf-LHR
accept-ranges
bytes
content-length
2149
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:57:52 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
logo.png
xz3cs.cloud/assets/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/logo.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/assets/login2.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
20f8ed2bf854270b68617662902cf145554cd87ba4ff29d800879978bbb2d92a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/assets/login2.css

Response headers

x-cache-status
BYPASS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f030ea-2ecc"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iKb7m6mqMvSn6yE%2FwDwq1XIbGA9I7MmgCK9%2BndrK1n%2BKD1rU5p3U%2FosNiDFvuPQusFBHt02g6g7tdbA4rAKhF9RJ78r%2FkxgX0HIUVnCVrnDflQSAHhwUxEVg8tHDBN5CghvItiwNBTGj5g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bc8c494cf-LHR
accept-ranges
bytes
content-length
11980
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 14:59:54 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
arrow.png
xz3cs.cloud/assets/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/assets/arrow.png
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/assets/login2.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
e6d74b1fa656995627ce5e8b0839a62b0ffd54b8de7be4f2e40eae2c92b968c8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/assets/login2.css

Response headers

x-cache-status
BYPASS
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
REVALIDATED
etag
"66f033b2-447"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9PsA754Llhe4poy0BRyBo%2BmgJolavIdmxrg99iuyIDVZN0lO3sg02HRXipCKO6v4CUu3vMyeWkflp0OYNVe7RYGrp%2FT%2F30CIYqcyuQ5L58zV8PNmHv8976ipqCfDZRkCz5wcLKWs547yLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bd8d094cf-LHR
accept-ranges
bytes
content-length
1095
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
image/png
last-modified
Sun, 22 Sep 2024 15:11:46 GMT
x-powered-by
PleskLin
server
cloudflare
vary
Accept-Encoding
footer-bg.jpg
xz3cs.cloud/Content/Images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xz3cs.cloud/Content/Images/footer-bg.jpg
Requested by
Host: xz3cs.cloud
URL: https://xz3cs.cloud/assets/login.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
ff82f712fa71673563337eccef963a7e74d41691eea5bbce64ca38a66cd62908

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/assets/login.css

Response headers

cache-control
no-store, no-cache, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
BYPASS
pragma
no-cache
speculation-rules
"/cdn-cgi/speculation"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=604aE1lnHbbBkKls6W8xvR%2F23O8%2BQUBVTGl2HwvG7quBlzoJT9fe7qQCISJ%2FPTOV8tdi00prPLDHef4SEUG2YekKaXi%2BNMzxW7qQRIPCYiOtBrx1cViVbP%2BiXxuSuF0%2BGDy0vCmIMxVwHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bd8d294cf-LHR
expires
Thu, 19 Nov 1981 08:52:00 GMT
alt-svc
h3=":443"; ma=86400
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
server
cloudflare
process
xz3cs.cloud/ 		0
503 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/process
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://xz3cs.cloud/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*/*
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control
no-store, no-cache, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8MkIXfVkIO%2BMo567FypurSrhy%2FDPdvLjEc1pwvePGM8KrHESZQNdzoqoGqgv9Bf0qXjjaWnF4gVVLVAcN4eA3k4qDDeGZuUvK3xxxI7RwPt%2BU5CRYO%2FqBwwfxe6oNvniRRtppwcUDIvztg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1bd8d894cf-LHR
expires
Thu, 19 Nov 1981 08:52:00 GMT
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.33, PleskLin
server
cloudflare
favicon.ico
xz3cs.cloud/ 		23 KB
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
808b9ffb2b8d6667e1ae9caaf4398a137c66e5c635399e80401645141d0e5857

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://xz3cs.cloud/

Response headers

cache-control
no-store, no-cache, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
BYPASS
pragma
no-cache
speculation-rules
"/cdn-cgi/speculation"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hqxfxmv3YQq0ypDVvAEcUyYUBWgVvZJAuAsNJMB2eN2HNJv1XMwXlid1dSi%2FMYPrVcK%2BOfTZeDLl7Tr0qf1z1ozgyNo%2B5TDRKbE8Kpnm4bpEVd41wamuccIEuo6Uwt7%2FcT%2BX7bEzVlrz7A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d1d0a8594cf-LHR
expires
Thu, 19 Nov 1981 08:52:00 GMT
date
Mon, 23 Sep 2024 08:31:03 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.33
vary
Accept-Encoding
server
cloudflare
process
xz3cs.cloud/ 		0
505 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/process
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://xz3cs.cloud/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*/*
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control
no-store, no-cache, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lTTyk%2B6GLEHh4%2FjQEkg1qS41x2hZ%2BQxE7jFEuq5jWPNeKBbqU9TdMD30nWwTJb1hdnuiDFdtrVYE2hu3VxXlYIm1PhPUXgCjZeIYjyTPkWY4Rz4J%2Bz7Gw7%2FQBMrabiLUG22vCR8jUhSZ1A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d28692794cf-LHR
expires
Thu, 19 Nov 1981 08:52:00 GMT
date
Mon, 23 Sep 2024 08:31:05 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.33, PleskLin
server
cloudflare
process
xz3cs.cloud/ 		0
502 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://xz3cs.cloud/process
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:c05a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://xz3cs.cloud/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
*/*
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control
no-store, no-cache, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdrgbaWi8pHOeUbjButRjJJNKq5qPc0rJgBwCcaNT0nMoCFeJv5gCRGRpVCKPGUTGUXwkSISmD%2B2EjL3kc4Xb9YTG%2FrOnfVYc6BnMLMNz1rRqw1t%2BdBZcyh0HAgOPqf%2BhecV1M45DEc98w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c792d34da2a94cf-LHR
expires
Thu, 19 Nov 1981 08:52:00 GMT
date
Mon, 23 Sep 2024 08:31:07 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.4.33, PleskLin
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Finansbank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| send object| isMobile object| userPass

1 Cookies

Domain/Path Name / Value
xz3cs.cloud/ Name: PHPSESSID
Value: hog672lp6vrrbhh7b37v0dvvsr

2 Console Messages

Source Level URL
Text
network error URL: https://xz3cs.cloud/Content/Images/footer-bg.jpg
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://xz3cs.cloud/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()