www.buyukhanli.com
Open in
urlscan Pro
172.67.129.116
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On October 16 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by WE1 on August 27th 2024. Valid for: 3 months.
This is the only time www.buyukhanli.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 172.67.129.116 172.67.129.116 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 142.250.185.163 142.250.185.163 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
32 | 10 |
ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net
www.gstatic.com |
ASN15169 (GOOGLE, US)
translate.googleapis.com |
ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com | |
stackpath.bootstrapcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
buyukhanli.com
www.buyukhanli.com |
34 KB |
5 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220 |
34 KB |
4 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1113 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3270 |
31 KB |
4 |
googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 941 ajax.googleapis.com — Cisco Umbrella Rank: 412 |
111 KB |
4 |
gstatic.com
www.gstatic.com |
6 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 311 |
1 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
24 KB |
0 |
clearbit.com
Failed
logo.clearbit.com Failed |
|
32 | 8 |
Domain | Requested by | |
---|---|---|
9 | www.buyukhanli.com |
cdnjs.cloudflare.com
www.buyukhanli.com |
5 | cdnjs.cloudflare.com |
www.buyukhanli.com
|
4 | www.gstatic.com |
www.buyukhanli.com
www.gstatic.com |
2 | cdn.jsdelivr.net |
www.buyukhanli.com
|
2 | stackpath.bootstrapcdn.com |
www.buyukhanli.com
|
2 | ajax.googleapis.com |
www.buyukhanli.com
|
2 | maxcdn.bootstrapcdn.com |
www.buyukhanli.com
|
2 | code.jquery.com |
www.buyukhanli.com
|
2 | translate.googleapis.com |
www.buyukhanli.com
|
0 | logo.clearbit.com Failed |
www.buyukhanli.com
cdnjs.cloudflare.com |
32 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
buyukhanli.com WE1 |
2024-08-27 - 2024-11-25 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-09-28 - 2024-12-27 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-09-30 - 2024-12-23 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-09-30 - 2024-12-23 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
bootstrapcdn.com WE1 |
2024-09-20 - 2024-12-19 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://www.buyukhanli.com/update/Accounts/index.html
Frame ID: BFD34CD01593A9F5DA481569E9F39704
Requests: 5 HTTP requests in this frame
Frame:
https://www.buyukhanli.com/update/Accounts/alln.html?cms=null
Frame ID: AB658647FE77EFB44E14D765C912A11A
Requests: 18 HTTP requests in this frame
Frame:
https://www.buyukhanli.com/update/Accounts/alln.html?cms=null
Frame ID: 7D113E13088E356535B3660FE992D1AE
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Verify your credentialsDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Popper (Miscellaneous) Expand
Detected patterns
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
index.html
www.buyukhanli.com/update/Accounts/ |
18 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
www.buyukhanli.com/cdn-cgi/ |
128 B 587 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dnsChecker.php
www.buyukhanli.com/update/Accounts/ |
30 B 583 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
www.buyukhanli.com/ |
32 KB 12 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
alln.html
www.buyukhanli.com/update/Accounts/ Frame AB65 |
39 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
www.buyukhanli.com/cdn-cgi/ Frame AB65 |
128 B 582 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/ Frame AB65 |
22 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_GB.bVrrHzcI_Bc.O/d=1/exm=el_conf/ed=1/rs=AN8SPfrphYdH14BfDiS2I-_4kFKoDbr0iw/ Frame AB65 |
228 KB 81 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css;base64,Cmh0bWwgewogIGZvbnQtZmFtaWx5OiBzYW5zLXNlcmlmOwogIC1tcy10ZXh0LXNpemUtYWRqdXN0OiAxMDAlOwogIC13ZWJraXQtdGV4dC1zaXplLWFkanVzdDogMTAwJTsKfQoKYm9keSB7CiAgbWFyZ2luOiAwOwp9CgphIHsKICBiYWNrZ3JvdW...
www.buyukhanli.com/update/Accounts/url(%22data:text/ Frame AB65 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ Frame AB65 |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ Frame AB65 |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ Frame AB65 |
48 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame AB65 |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ Frame AB65 |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.session.min.js
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ Frame AB65 |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ Frame AB65 |
85 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
alln.html
www.buyukhanli.com/update/Accounts/ Frame 7D11 |
39 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame AB65 |
23 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame AB65 |
778 B 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame AB65 |
795 B 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame AB65 |
7 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ Frame AB65 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
www.buyukhanli.com/cdn-cgi/ Frame 7D11 |
128 B 585 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/ Frame 7D11 |
22 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_GB.bVrrHzcI_Bc.O/d=1/exm=el_conf/ed=1/rs=AN8SPfrphYdH14BfDiS2I-_4kFKoDbr0iw/ Frame 7D11 |
228 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ Frame 7D11 |
68 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ Frame 7D11 |
19 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ Frame 7D11 |
48 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 7D11 |
84 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ Frame 7D11 |
50 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.session.min.js
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ Frame 7D11 |
2 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ Frame 7D11 |
85 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
null
logo.clearbit.com/ Frame AB65 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 7D11 |
23 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 7D11 |
778 B 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ Frame 7D11 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
null
logo.clearbit.com/ Frame 7D11 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- logo.clearbit.com
- URL
- https://logo.clearbit.com/null
- Domain
- logo.clearbit.com
- URL
- https://logo.clearbit.com/null
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery function| getParameterByName2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.buyukhanli.com/ | Name: __session:0.8178231831526739: Value: https: |
|
www.buyukhanli.com/ | Name: __session:0.653997917422797: Value: https: |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
logo.clearbit.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
translate.googleapis.com
www.buyukhanli.com
www.gstatic.com
logo.clearbit.com
104.17.24.14
104.18.10.207
142.250.185.163
172.67.129.116
2606:4700::6811:180e
2a00:1450:4001:812::200a
2a00:1450:4001:830::200a
2a04:4e42:400::485
2a04:4e42::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0dc832e5d7d91407ee31e4c0b78f54b74b233ff2fd8cea117583fd2313605d45
112f08b87c5353387baf521c2a1a779e8c58a20e7c839d246e7443d73f8aeeb8
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
2ffbd9fc04edbcd3cd9b0c1920b062e644543b0710a706992167d767024b2099
31e8058dac4f801fff11adbd33f077e9b078d49e80034a7d0e8a4cd70e9f2b44
35e38c13207686ff7836fb1a81e55beffc957037981ca72e663973ba300616af
4835ace30be2bd3bb165b45d72d96349db9132340540656143c16f03ba01a60a
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60b8f9e46fb308e91fe1db2c640bbf612be817021b2b33ca7bba99bf886ff687
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9e51942720527dfabdb69ba393e7999b4cb8dad3e44e813f2fcd88d749e4205b
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
bc1f955ab71c1457c41706e5196ac406477e3c29793913f3514200f59dfa4407
d52fa992f6521d11a1e8170b957340018bf982b09bbafb52af8d3f612751ed54
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b