hasbelbasvurulari.com Open in urlscan Pro
2606:4700:3034::ac43:bb80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/
Submission Tags: @ecarlesi threat phishing trcert Search All
Submission: On February 02 via api (February 2nd 2024, 9:12:31 am UTC) from IT — Scanned from IT

Summary HTTP 1 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2606:4700:3034::ac43:bb80, located in United States and belongs to CLOUDFLARENET, US. The main domain is hasbelbasvurulari.com.
TLS certificate: Issued by GTS CA 1P5 on February 1st 2024. Valid for: 3 months.

This is the only time hasbelbasvurulari.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BDDK (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 2	2606:4700:303... 2606:4700:3034::ac43:bb80		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2

2 2606:4700:3034::ac43:bb80 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

hasbelbasvurulari.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	hasbelbasvurulari.com 1 redirects hasbelbasvurulari.com	236 KB
1	1

	Domain	Requested by
2	hasbelbasvurulari.com	1 redirects
1	1

This site contains links to these domains. Also see Links.

Domain
giris.turkiye.gov.tr
cdn.e-devlet.gov.tr
www.turkiye.gov.tr

Subject Issuer	Validity	Valid
hasbelbasvurulari.com GTS CA 1P5	`2024-02-01` - `2024-05-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/
Frame ID: 310ED94FD912136479DA8AC735A2F315
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

e-Devlet Kapısı

Page URL History Show full URLs

https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti HTTP 301
https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/ Page URL

Page Statistics

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

332 kB
Transfer

763 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://giris.turkiye.gov.tr/
Title: Ä°çeriğe Git

Search URL Search Domain Scan URL

URL: https://cdn.e-devlet.gov.tr/downloads/e-kimlik/edevlet-ekimlik.jnlp
Title: tıklayınız

Search URL Search Domain Scan URL

URL: https://www.turkiye.gov.tr/iletisim?hizli=CozumMerkezi2
Title: Hızlı Çözüm Merkezi

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti HTTP 301
https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/ Redirect Chain https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/	650 KB 236 KB	82ms 81ms	Document text/html	2606:4700:3034::ac43:bb80 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:bb80 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PleskLin Resource Hash `9f1e3944bd029a5533230fbc69fae2d347628d233bf3e1960210655bd1a110e0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 84f14ffb99640e03-MXP content-encoding br content-type text/html date Fri, 02 Feb 2024 09:12:26 GMT last-modified Sun, 25 Jun 2023 19:27:12 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8STQKRuRrO7%2BqKlOcZPtronwZnizyoDM6LRMyBbn%2FcD2VRrYh%2F3naLzk2LGqMPZxojPH25O%2BgqI1%2BWIEjx5GQB%2F9zpz%2BzfM4fuoiHbKAPB0HtEk0rWK8x5G7XRs4aUf0nJqaM6qFmagUSimZJfgb6CxIY2c%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PleskLin Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 84f14ffae81e0e03-MXP content-type text/html; charset=iso-8859-1 date Fri, 02 Feb 2024 09:12:26 GMT location https://hasbelbasvurulari.com/edevlet/T-C-Kimlik-Karti/ nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aUfZElgl7l7%2Bbk0s5hhW9iqXRhyAeIfM8MjO92y9leoXqVMafxfk4x5Wo1oXAMLEARlrpH0WIwHOffasng%2Fzw6YjWbV3WcVtEpV3zJYvL6vlYTIAyLW5Ug3rL%2B5GYa2dYKtoHsDEZm1BqeleqqfBUjCi93g%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PleskLin
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `537d46273fe124bbced2f098f26222fa3155741e9d76f906c3c39e7fa09bf6a8` Request headers Referer Origin https://hasbelbasvurulari.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `473f0d637169b8b400874ffb0c487dfc5f4bc544e8bfebe98502a6a5ceb781e7` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ff7498da718b1f50faeefae71e24ceadf4575da0692b84c9a1ad359daa1f2ff2` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `39966ec7eea8f508184cef9f98895a0e8d74e3328a43cc8a93c528cfca888691` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `27292f1f2138adbd114fa0463bec7cfcb3475c08477f79554da42d858be68d70` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	448 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `14e8e481e7afcaae3200f172bd49bf7146ea2a23d3fdf0ba71d5fdbbd0c8c5a4` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	393 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `945f7d25e8f885da3c77668f74ecacefa894dc535ac048f57a56e2b2fc2560df` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	20 KB 20 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0b155ade172e77bc397377c1856af15289b509590b332b351e48f5c11f73a35e` Request headers Referer Origin https://hasbelbasvurulari.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `814a3f4f20f812103033c8345c9bbd27f561a5462f34843e88c94f6f5dc4092c` Request headers Referer Origin https://hasbelbasvurulari.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	38 KB 38 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `78e78c58a6dab82f460252e9a0dcdcb5d0c0eb2f2307998764dea1dc1796a4f0` Request headers Referer Origin https://hasbelbasvurulari.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BDDK (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hasbelbasvurulari.com
2606:4700:3034::ac43:bb80
0b155ade172e77bc397377c1856af15289b509590b332b351e48f5c11f73a35e
14e8e481e7afcaae3200f172bd49bf7146ea2a23d3fdf0ba71d5fdbbd0c8c5a4
27292f1f2138adbd114fa0463bec7cfcb3475c08477f79554da42d858be68d70
39966ec7eea8f508184cef9f98895a0e8d74e3328a43cc8a93c528cfca888691
473f0d637169b8b400874ffb0c487dfc5f4bc544e8bfebe98502a6a5ceb781e7
537d46273fe124bbced2f098f26222fa3155741e9d76f906c3c39e7fa09bf6a8
78e78c58a6dab82f460252e9a0dcdcb5d0c0eb2f2307998764dea1dc1796a4f0
814a3f4f20f812103033c8345c9bbd27f561a5462f34843e88c94f6f5dc4092c
945f7d25e8f885da3c77668f74ecacefa894dc535ac048f57a56e2b2fc2560df
9f1e3944bd029a5533230fbc69fae2d347628d233bf3e1960210655bd1a110e0
ff7498da718b1f50faeefae71e24ceadf4575da0692b84c9a1ad359daa1f2ff2

hasbelbasvurulari.com Open in urlscan Pro 2606:4700:3034::ac43:bb80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

332 kBTransfer

763 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

hasbelbasvurulari.com Open in urlscan Pro
2606:4700:3034::ac43:bb80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

332 kB
Transfer

763 kB
Size

0
Cookies

1 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!