www.kingsgarden.com.tr Open in urlscan Pro
85.114.134.71 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mastergroup.com.pk/submit.php
Effective URL:
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php
Submission: On September 05 via api (September 5th 2021, 2:18:06 pm UTC) from IE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 85.114.134.71, located in Germany and belongs to MYLOC-AS IP Backbone of myLoc managed IT AG, DE. The main domain is www.kingsgarden.com.tr.
TLS certificate: Issued by R3 on August 20th 2021. Valid for: 3 months.

This is the only time www.kingsgarden.com.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.215.253.210 162.215.253.210	394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY)
8 20	85.114.134.71 85.114.134.71	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
12	1

1 162.215.253.210 (United States) 1 redirects

ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: bh-73.webhostbox.net

mastergroup.com.pk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 85.114.134.71 (Germany) 8 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: sunucu.bilisimdunyasi.org

www.kingsgarden.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	kingsgarden.com.tr 8 redirects www.kingsgarden.com.tr	126 KB
1	mastergroup.com.pk 1 redirects mastergroup.com.pk	270 B
12	2

	Domain	Requested by
20	www.kingsgarden.com.tr	8 redirects www.kingsgarden.com.tr
1	mastergroup.com.pk	1 redirects
12	2

This site contains no links.

Subject Issuer	Validity	Valid
kingsgarden.com.tr R3	`2021-08-20` - `2021-11-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php
Frame ID: 27A4010B13CA9E0BA993907E69FE60C0
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL - Track and Trace

Page URL History Show full URLs

http://mastergroup.com.pk/submit.php HTTP 302
https://www.kingsgarden.com.tr/czs/mama.php HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/in... HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/in... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

125 kB
Transfer

641 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mastergroup.com.pk/submit.php HTTP 302
https://www.kingsgarden.com.tr/czs/mama.php HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116 HTTP 301
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/ HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/index.php HTTP 302
https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request info.php Show response www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/ Redirect Chain http://mastergroup.com.pk/submit.php https://www.kingsgarden.com.tr/czs/mama.php https://www.kingsgarden.com.tr/czs/0000000-39 https://www.kingsgarden.com.tr/czs/0000000-39/ https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389 https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/ https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116 https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/ https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/index.php https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php	25 KB 6 KB	152ms 152ms	Document text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash `a3d76a96ca2c8f3791ff9126451ba114a80c5248d33c482425b84aeb14885718` Request headers :method GET :authority www.kingsgarden.com.tr :scheme https :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 vary Accept-Encoding,User-Agent content-encoding gzip content-length 6570 content-type text/html; charset=UTF-8 Redirect headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 location ./info.php vary User-Agent content-length 0 content-type text/html; charset=UTF-8
GET H2	200	main.css www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/	529 KB 88 KB	61ms 60ms	Stylesheet text/css	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / Resource Hash `e54dd298ee361f35577e0c3325eaa503c9e0f82c5a5bd29a274eb9c709185484` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT content-encoding gzip last-modified Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 etag W/"84525-5cb40328db0f3-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes
GET H2	200	jquery.js Show response www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/js/	85 KB 30 KB	41ms 41ms	Script application/javascript	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/js/jquery.js Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / Resource Hash `8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/js/jquery.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT content-encoding gzip last-modified Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 etag W/"15339-5cb40328d9d6b-gzip" vary Accept-Encoding,User-Agent content-type application/javascript accept-ranges bytes content-length 30248
GET H2	200	dhl-logo.svg www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/	2 KB 789 B	40ms 40ms	Image image/svg+xml	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/dhl-logo.svg Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / Resource Hash `362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/dhl-logo.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT content-encoding gzip last-modified Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 etag W/"643-5cb40328dc47b-gzip" vary Accept-Encoding,User-Agent content-type image/svg+xml accept-ranges bytes content-length 722
GET H2	200	glo.svg www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/	1 KB 683 B	34ms 34ms	Image image/svg+xml	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/glo.svg Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / Resource Hash `7b7e4adb65aa53b1bc731f15511c53d5beb73f187d5c5f35f19ebbfaf0decbbd` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/pica/glo.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT content-encoding gzip last-modified Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 etag W/"450-5cb40328dbcab-gzip" vary Accept-Encoding,User-Agent content-type image/svg+xml accept-ranges bytes content-length 628
GET H2	500	5132a7ca80ea9e18ec8cecc618cf5a0b.woff www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/	0 0	35ms 34ms	Font text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/5132a7ca80ea9e18ec8cecc618cf5a0b.woff Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/5132a7ca80ea9e18ec8cecc618cf5a0b.woff pragma no-cache origin https://www.kingsgarden.com.tr accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Origin https://www.kingsgarden.com.tr Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	arrow.svg www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/img/	0 28 B	37ms 37ms	Image text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/img/arrow.svg Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/img/arrow.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	c2d3739d2debffea340a58b7b8ab3c61.woff www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/	0 0	35ms 34ms	Font text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/c2d3739d2debffea340a58b7b8ab3c61.woff Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/c2d3739d2debffea340a58b7b8ab3c61.woff pragma no-cache origin https://www.kingsgarden.com.tr accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Origin https://www.kingsgarden.com.tr Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	d2c082a9f78e61ea7ccefecaca4da8a3.woff www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/	0 0	34ms 33ms	Font text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/d2c082a9f78e61ea7ccefecaca4da8a3.woff Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/d2c082a9f78e61ea7ccefecaca4da8a3.woff pragma no-cache origin https://www.kingsgarden.com.tr accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Origin https://www.kingsgarden.com.tr Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	lod.gif www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/	0 28 B	34ms 34ms	Image text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/lod.gif Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/lod.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/info.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	03f859bf58e4d37841070de34be7d978.woff www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/	0 0	35ms 35ms	Font text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/03f859bf58e4d37841070de34be7d978.woff Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/03f859bf58e4d37841070de34be7d978.woff pragma no-cache origin https://www.kingsgarden.com.tr accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Origin https://www.kingsgarden.com.tr Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H2	500	e39bd2e2657ce5dd6f9c33df18529233.woff www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/	0 0	37ms 37ms	Font text/html	85.114.134.71 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/e39bd2e2657ce5dd6f9c33df18529233.woff Requested by Host: www.kingsgarden.com.tr URL: https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 85.114.134.71 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS sunucu.bilisimdunyasi.org Software Apache/2 / PHP/5.6.40 Resource Hash Request headers :path /czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/assets/fonts/e39bd2e2657ce5dd6f9c33df18529233.woff pragma no-cache origin https://www.kingsgarden.com.tr accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority www.kingsgarden.com.tr referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css :scheme https sec-fetch-site same-origin :method GET Origin https://www.kingsgarden.com.tr Referer https://www.kingsgarden.com.tr/czs/0000000-39/customer_center/customer-IDPP00C389/039242398116/hyjawowy=/scrpts/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 05 Sep 2021 14:17:50 GMT server Apache/2 x-powered-by PHP/5.6.40 content-length 0 vary User-Agent content-type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mastergroup.com.pk
www.kingsgarden.com.tr
162.215.253.210
85.114.134.71
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
7b7e4adb65aa53b1bc731f15511c53d5beb73f187d5c5f35f19ebbfaf0decbbd
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
a3d76a96ca2c8f3791ff9126451ba114a80c5248d33c482425b84aeb14885718
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e54dd298ee361f35577e0c3325eaa503c9e0f82c5a5bd29a274eb9c709185484

www.kingsgarden.com.tr Open in urlscan Pro 85.114.134.71 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

125 kBTransfer

641 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

www.kingsgarden.com.tr Open in urlscan Pro
85.114.134.71 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

125 kB
Transfer

641 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!