liking.com.tr Open in urlscan Pro
2606:4700:3032::ac43:9e28 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://liking.com.tr/
Submission Tags: https://phish.report @phish_report Search All
Submission: On June 29 via api (June 29th 2023, 6:00:53 pm UTC) from FI — Scanned from FI

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3032::ac43:9e28, located in United States and belongs to CLOUDFLARENET, US. The main domain is liking.com.tr.

This is the only time liking.com.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Cuscatlan de El Salvador (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3032::ac43:9e28	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	104.237.62.211 104.237.62.211	18450 (WEBNX) (WEBNX)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	5

9 2606:4700:3032::ac43:9e28 (United States)

ASN13335 (CLOUDFLARENET, US)

liking.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.237.62.211 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	liking.com.tr liking.com.tr	789 KB
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 6130	538 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2382	109 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 433	31 KB
12	4

	Domain	Requested by
9	liking.com.tr	liking.com.tr
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	ajax.googleapis.com	liking.com.tr
12	4

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
ipinfo.io R3	`2023-06-25` - `2023-09-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://liking.com.tr/
Frame ID: 900D20F6ECAEB96F44BBC5657282F8E7
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Digital

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

25 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

821 kB
Transfer

3057 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
liking.com.tr/ 1 MB
104 KB 527ms
385ms Document
text/html 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9af0960dd8c09899e40b5a80148419e4642db6bfdd856e207526a51b8b99fa9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7df0122dcccab4f1-OSL
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 29 Jun 2023 18:00:47 GMT
Last-Modified: Tue, 09 Aug 2022 19:38:46 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ro0xa49j1%2FgKPQ%2F9PxeRR9mWHqe%2F2pptftr%2FOdsLTaKMJGXA%2BUsjae5bdU7vczxaSs8iXm2%2B7WrBH1ENgwo1EUDJiEuIuthfgIKM6U97ksHcmoYgiU%2BY%2FN6uaqxPU7N%2FD8VcMEDalTmsRSjW"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 249ms
79ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: liking.com.tr
URL: http://liking.com.tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 08:18:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34964
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 28 Jun 2024 08:18:03 GMT

GET
H/1.1 200
OK styles.39921502ffc3308e5cf0.bundle.css
liking.com.tr/css/ 103 KB
20 KB 139ms
83ms Stylesheet
text/css 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/css/styles.39921502ffc3308e5cf0.bundle.css
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6e29922e8467a5db6fcd491ab7fa38ee746992abbf39db4db06d59d53bb20b2

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:47 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 05:01:32 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nXpSDbu5iRQ2h5UVeiYUULoyXXjsICkDAeQ7Qzj35FipBuxTSoZWQJvrcoOEX4SGDn%2B7p5W2by4ePGhIPgjdG%2FErYxYyEg5Z82opS281gUymNYIMT1PFMia7iD5azM5ar64cySGRf%2FddJTU5"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7df0123098c8b509-OSL
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK estilos.css
liking.com.tr/css/ 1 MB
98 KB 131ms
75ms Stylesheet
text/css 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/css/estilos.css
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d77e17eff7ff31b8e3fd2871efd8806a4d037aa2b4c7f196e7aa765dfc692fb

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:47 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 04:06:44 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RTkY0f7F4WaripPJiwLkbrjTfp%2BISfkFjjxNKYMfkEjRAHAWvM2VA1D2Lvca4odKDPwwAb3irs0%2BnUF%2FvVLcLPe9ft%2F7YFvONKKZU4IfhtvtJDH77Vj5AOOQDhHAHMesMA7f0bH5SeFMhJUm"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7df012309bc3b4eb-OSL
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
api.ipify.org/ 22 B
109 B 1165ms
202ms XHR
application/json 104.237.62.211
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.237.62.211 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS: hosted-by.racknerd.com
Software: /
Resource Hash: b063c005355c502ddc2036839fee0104b9002b6b07ef7df7efd2f6c1aa1e6850

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://liking.com.tr/
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: http://liking.com.tr
date: Thu, 29 Jun 2023 18:00:48 GMT
content-length: 22
vary: Origin
content-type: application/json

GET
H2 200 / Show response
ipinfo.io/ 294 B
538 B 285ms
171ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

b9f921f30e9af7e1b0c10a6a020acda68c93a2040567b9e33aca90cc8008f5e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://liking.com.tr/
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 18:00:47 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK prismaWeb.css
liking.com.tr/css/ 123 KB
16 KB 75ms
75ms Stylesheet
text/css 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/css/prismaWeb.css
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b08aa0320bab8817e3d30ecfe71a01eff590881794d735282bf1558f4a1a6d69

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 03:19:20 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6904
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dg9TeoVdZ8Eb6QHHiyw2u2wpW2KKPdlyOlpNnjVVkKZG2AbH%2BYpZ4Xe1cbb%2BggMSRVdq40GwSX0sJU69lCb5tvlI0DS%2FM8rxuj0QSoVEnhhSYGDTkO4ySmvpoJq2cZHd7wO9herwOLjvPkXG"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7df0123628edb4f1-OSL
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK keyboardLowerCaseLowContrast.png
liking.com.tr/img/ 6 KB
6 KB 71ms
71ms Image
image/png 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liking.com.tr/img/keyboardLowerCaseLowContrast.png
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 03:19:20 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MTLikKcMKfY%2FdPPjWmRj2Lj17orp%2FgyIUb4vAWgsMUKAtOpImvkNqXz7w1LvL7qp8KO2P72H%2Bmjue3dutvQZwaJT1SnSQMo%2BSDQDNkq9qd2hQZeRpSq%2BeurlB5tOnO3dWb%2FmPWD1GuHRG56d"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7df012362c1db4eb-OSL
alt-svc: h3=":443"; ma=86400
Content-Length: 5633

GET
H/1.1 200
OK 6f851c1f8a2197e8215bfba708791e38.jpg
liking.com.tr/img/ 104 KB
105 KB 65ms
64ms Image
image/jpeg 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liking.com.tr/img/6f851c1f8a2197e8215bfba708791e38.jpg
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3eada35f785744654e96d7143682e90809fbe1c856be4868597d1bd27edb6a9

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 03:19:24 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B%2BwS2KDxMSHq%2F6MoxySlc%2B5bFOu8GPQRvSyi03YlWWxVijZRfXHrc5Qa6lDruY%2Bf%2B5Q3uBxmPqGxixxeo8SfpUTzULCSUFnHhAY%2B%2BrwTT9c%2B2MBpaL6U9VX%2BWWb4IG%2BOm8%2FcWi4PXDrkgccH"}],"group":"cf-nel","max_age":604800}
Content-Type: image/jpeg
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7df01236283db509-OSL
alt-svc: h3=":443"; ma=86400
Content-Length: 106498

GET
H/1.1 200
OK sax.js Show response
liking.com.tr/js/ 1 KB
1 KB 128ms
72ms Script
application/javascript 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/js/sax.js
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ab274d7e08dfcb63602ea2585016aeed815fc8c7470be79ffbb17142d72bc09

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Sat, 20 May 2023 14:08:38 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BP5UG2yZf6PMVJLfiW401W1uXOl4ikEmJHzzbZgA6XlVPsQGro9uR%2Fc3%2B5cKhqfQV5bObyRsBdHVAAZJi9WwkpkfWCghr6S%2BafYnR8n7mj2IP4wnRRzXJ3C8zrF4%2FLKfWUVMMtA2%2F9h6bFLN"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7df012368f850b49-OSL
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c8b35760fefe68e1ef1fd3859aebffd5aa4cc485cddd5cc9c53c57142269609

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://liking.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK OpenSans-Regular.14077b877bbfbc815a94.woff2
liking.com.tr/css/ 50 KB
51 KB 65ms
65ms Font
font/woff2 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/css/OpenSans-Regular.14077b877bbfbc815a94.woff2
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/css/styles.39921502ffc3308e5cf0.bundle.css
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2f4ead06057e7ced0b5cbc89280a655ba66ea4d6fe54fa2c8381d35e278c4f9

Request headers

Referer: http://liking.com.tr/css/styles.39921502ffc3308e5cf0.bundle.css
Origin: http://liking.com.tr
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 04:00:14 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WRTq4HlhjX3IEil1eZMCwoAZJppGbUtnGvFWNAKDr2v5Xj3Li3d%2B3acw0oVLi0Vxapm33KABlvVZx8FgfMGcTY94V%2FcQnKF16L0%2BAHmAFzCrBPLn1FO0lL1H8AJXihDuidULkG3TakFmWtnu"}],"group":"cf-nel","max_age":604800}
Content-Type: font/woff2
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7df01236c9cfb4f1-OSL
alt-svc: h3=":443"; ma=86400
Content-Length: 51044

GET
H/1.1 200
OK streamline.7b5e048cdbd03151c26c.woff
liking.com.tr/css/ 387 KB
388 KB 74ms
74ms Font
font/woff 2606:4700:3032::ac43:9e28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://liking.com.tr/css/streamline.7b5e048cdbd03151c26c.woff?19c5cw
Requested by: Host: liking.com.tr
URL: http://liking.com.tr/css/styles.39921502ffc3308e5cf0.bundle.css
Protocol: HTTP/1.1
Server: 2606:4700:3032::ac43:9e28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9250e188e59d4a24ca87e42656357f7a0669a31d0f330939078acf7f3cd882d

Request headers

Referer: http://liking.com.tr/css/styles.39921502ffc3308e5cf0.bundle.css
Origin: http://liking.com.tr
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 29 Jun 2023 18:00:48 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 04 Aug 2022 04:00:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 6903
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sqaj9MhGSMjcGS4cnniUz%2Bfp8Y5t1PCeBNbqW9HP4ommHrenJCrKEWk5UfTnyHfTF7y2PcxACnDGs8XpOs%2F1Yb%2BA5m2Aqq%2BxisWuh%2FaMEv5qxDDScxZLXOWMk3bXNs9X5qnStBhc%2FbEIE8Vv"}],"group":"cf-nel","max_age":604800}
Content-Type: font/woff
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7df01236ddadb4eb-OSL
alt-svc: h3=":443"; ma=86400
Content-Length: 396336

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Cuscatlan de El Salvador (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
ipinfo.io
liking.com.tr
104.237.62.211
2606:4700:3032::ac43:9e28
2a00:1450:4001:813::200a
34.117.59.81
3ab274d7e08dfcb63602ea2585016aeed815fc8c7470be79ffbb17142d72bc09
3d77e17eff7ff31b8e3fd2871efd8806a4d037aa2b4c7f196e7aa765dfc692fb
6c8b35760fefe68e1ef1fd3859aebffd5aa4cc485cddd5cc9c53c57142269609
a9250e188e59d4a24ca87e42656357f7a0669a31d0f330939078acf7f3cd882d
b063c005355c502ddc2036839fee0104b9002b6b07ef7df7efd2f6c1aa1e6850
b08aa0320bab8817e3d30ecfe71a01eff590881794d735282bf1558f4a1a6d69
b9f921f30e9af7e1b0c10a6a020acda68c93a2040567b9e33aca90cc8008f5e1
c9af0960dd8c09899e40b5a80148419e4642db6bfdd856e207526a51b8b99fa9
d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025
e2f4ead06057e7ced0b5cbc89280a655ba66ea4d6fe54fa2c8381d35e278c4f9
e6e29922e8467a5db6fcd491ab7fa38ee746992abbf39db4db06d59d53bb20b2
f3eada35f785744654e96d7143682e90809fbe1c856be4868597d1bd27edb6a9
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

liking.com.tr Open in urlscan Pro 2606:4700:3032::ac43:9e28 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

25 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

821 kBTransfer

3057 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

liking.com.tr Open in urlscan Pro
2606:4700:3032::ac43:9e28 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

25 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

821 kB
Transfer

3057 kB
Size

0
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!