katilmobilacikdenizv2denizbank.co.vu Open in urlscan Pro
20.123.145.250 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://katilmobilacikdenizv2denizbank.co.vu/
Submission: On February 02 via manual (February 2nd 2022, 12:08:14 pm UTC) from TR — Scanned from NL

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 4 countries across 5 domains to perform 16 HTTP transactions. The main IP is 20.123.145.250, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is katilmobilacikdenizv2denizbank.co.vu.

This is the only time katilmobilacikdenizv2denizbank.co.vu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Denizbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	20.123.145.250 20.123.145.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700:20:... 2606:4700:20::681a:407	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	158.69.139.237 158.69.139.237	16276 (OVH) (OVH)
1	67.202.94.94 67.202.94.94	32748 (STEADFAST) (STEADFAST)
1	104.18.29.199 104.18.29.199	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	67.202.105.31 67.202.105.31	32748 (STEADFAST) (STEADFAST)
1	67.202.105.34 67.202.105.34	32748 (STEADFAST) (STEADFAST)
16	8

3 20.123.145.250 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

katilmobilacikdenizv2denizbank.co.vu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:407 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.69.139.237 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ip237.ip-158-69-139.net

t.dtscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.94 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.29.199 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 67.202.105.31 (United States)

ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net

ic.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.34 (United States)

ASN32748 (STEADFAST, US)
PTR: ip34.67-202-105.static.steadfastdns.net

de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tynt.com cdn.tynt.com — Cisco Umbrella Rank: 7672 ic.tynt.com — Cisco Umbrella Rank: 5045 de.tynt.com — Cisco Umbrella Rank: 1328	8 KB
3	co.vu katilmobilacikdenizv2denizbank.co.vu	2 MB
2	dtscout.com t.dtscout.com — Cisco Umbrella Rank: 11585	3 KB
1	amung.us whos.amung.us — Cisco Umbrella Rank: 12727	212 B
1	waust.at waust.at — Cisco Umbrella Rank: 36672	4 KB
16	5

	Domain	Requested by
7	ic.tynt.com	katilmobilacikdenizv2denizbank.co.vu
3	katilmobilacikdenizv2denizbank.co.vu	katilmobilacikdenizv2denizbank.co.vu
2	t.dtscout.com	waust.at t.dtscout.com
1	de.tynt.com	cdn.tynt.com
1	cdn.tynt.com	waust.at
1	whos.amung.us	waust.at
1	waust.at	katilmobilacikdenizv2denizbank.co.vu
16	7

This site contains no links.

Subject Issuer	Validity	Valid
*.dtscout.com Sectigo RSA Domain Validation Secure Server CA	`2021-10-28` - `2022-11-27`	a year	crt.sh
*.tynt.com Sectigo RSA Domain Validation Secure Server CA	`2021-09-23` - `2022-09-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://katilmobilacikdenizv2denizbank.co.vu/
Frame ID: 962A0BACDAFDB1F5BAA72188152B2972
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DenizBank İnternet Bankacılığı

Page Statistics

16
Requests

69 %
HTTPS

14 %
IPv6

5
Domains

7
Subdomains

8
IPs

4
Countries

1835 kB
Transfer

2275 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response katilmobilacikdenizv2denizbank.co.vu/	2 MB 2 MB	166ms 40ms	Document text/html	20.123.145.250 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://katilmobilacikdenizv2denizbank.co.vu/ Protocol HTTP/1.1 Server 20.123.145.250 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `852c91851b42a721f88a0e4f732f9b558ac205eb7cc32ba6947b8e4382bd3538` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers Date Wed, 02 Feb 2022 12:08:07 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	== katilmobilacikdenizv2denizbank.co.vu/	315 B 315 B	15ms 15ms	Image text/html	20.123.145.250 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://katilmobilacikdenizv2denizbank.co.vu/== Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol HTTP/1.1 Server 20.123.145.250 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Wed, 02 Feb 2022 12:08:07 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logo-light.svg katilmobilacikdenizv2denizbank.co.vu/img/	176 KB 177 KB	31ms 15ms	Image image/svg+xml	20.123.145.250 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://katilmobilacikdenizv2denizbank.co.vu/img/logo-light.svg Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol HTTP/1.1 Server 20.123.145.250 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `3da913d79fff46cfe4d58d56e141cfcb31865606284507f7a530db69394330fb` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Wed, 02 Feb 2022 12:08:07 GMT Last-Modified Fri, 14 Jan 2022 15:29:24 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 180545
GET H/1.1	200 OK	s.js Show response waust.at/	8 KB 4 KB	112ms 79ms	Script application/x-javascript	2606:4700:20::681a:407 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://waust.at/s.js Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol HTTP/1.1 Server 2606:4700:20::681a:407 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Wed, 02 Feb 2022 12:08:08 GMT content-encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 1264 Transfer-Encoding chunked Connection keep-alive last-modified Mon, 03 May 2021 17:48:21 GMT Server cloudflare etag W/"60903765-1ed7" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nbPfvxzGiR4O9jn29e%2B%2BtM72bAcASRl%2F7JSJ77MWAjN6GMRnlEQ2NUEWVTg6cTRR3%2BaKrSdoSDscMF%2Fvh3LFbV4DgMagBs5MVi3HQajAlzvpl9yfPDOwYWOQ7vdBOkFXxBtEeMUV"}],"group":"cf-nel","max_age":604800} Content-Type application/x-javascript access-control-allow-origin * cache-control max-age=86400 CF-RAY 6d734d9a1a6e6940-FRA expires Thu, 03 Feb 2022 11:47:04 GMT
GET DATA	200 OK	truncated /	379 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7278ca494d765eab007679ace9914b237327326d7cd2840660dc8140a8b5542` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	39 KB 39 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7eb704d9b4ca582fa56c8f610af81afdf6773b3c0a8a40362befc94b3b70dbc6` Request headers Referer http://katilmobilacikdenizv2denizbank.co.vu/ Origin http://katilmobilacikdenizv2denizbank.co.vu Accept-Language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	12 KB 12 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a085c2f1e7df8cdded779fa68b0ce2e0d31d3352ed8d8238cb540f35fa20cf0d` Request headers Referer http://katilmobilacikdenizv2denizbank.co.vu/ Origin http://katilmobilacikdenizv2denizbank.co.vu Accept-Language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	12 KB 12 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b582e5e36135cfe697ec9cfbb06ff7407a7d89a9e4a1287cfdd905cc3f9669e5` Request headers Referer http://katilmobilacikdenizv2denizbank.co.vu/ Origin http://katilmobilacikdenizv2denizbank.co.vu Accept-Language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	12 KB 12 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `be3979aa66ab98b74f4c323b1c194cba444de65913e489d5786e0c7fd8f310c0` Request headers Referer http://katilmobilacikdenizv2denizbank.co.vu/ Origin http://katilmobilacikdenizv2denizbank.co.vu Accept-Language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	38 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `74ded04044e0ea5035452097608c57828b228d0201feda6055c58029fff87f29` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	8 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `54e92ad9930ef375b8f4e1a1fe7fe5c86d43d7ad00a955c5df818e26489049b8` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `59c1a112d5d610c1399aa46d5b549c5aad1e4b283aaf785545e818d053f25378` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1b74331ad061c583ad54561f95596a8481b95d863a431fc4daf3a9ee7d151975` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	2 KB 3 KB	305ms 98ms	Script application/javascript	158.69.139.237 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/i/?l=http%3A%2F%2Fkatilmobilacikdenizv2denizbank.co.vu%2F&j= Requested by Host: waust.at URL: http://waust.at/s.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.237 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip237.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash `9285a80d8ab5865b3c84926cf203f1b3d15667d275a88f64dcfeb83d9ed2d316` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Wed, 02 Feb 2022 12:08:08 GMT X-T 0.649 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache Connection close X-S mtl2 Expires Wed, 02 Feb 2022 12:08:07 GMT
GET H/1.1	200 OK	/ Show response whos.amung.us/pingjs/	28 B 212 B	222ms 108ms	Script text/javascript	67.202.94.94 STEADFAST
General Check archive.org Show headers Download Go to Full URL http://whos.amung.us/pingjs/?k=z7wb8uzumz&t=DenizBank%20%C4%B0nternet%20Bankac%C4%B1l%C4%B1%C4%9F%C4%B1&c=s&x=http%3A%2F%2Fkatilmobilacikdenizv2denizbank.co.vu%2F&y=&a=0&d=0.395&v=27&r=9265 Requested by Host: waust.at URL: http://waust.at/s.js Protocol HTTP/1.1 Server 67.202.94.94 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash `5a669f51edbd981fed6eae210fdf26a4a095d9aba39d5973bee7fa1c225eef09` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:08 GMT content-encoding gzip transfer-encoding chunked content-type text/javascript;charset=UTF-8
GET H2	200	tc.js Show response cdn.tynt.com/	17 KB 7 KB	176ms 33ms	Script application/javascript	104.18.29.199 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.tynt.com/tc.js Requested by Host: waust.at URL: http://waust.at/s.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.29.199 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:08 GMT content-encoding gzip cf-cache-status HIT last-modified Fri, 27 Aug 2021 20:58:45 GMT server cloudflare age 187955 etag W/"61295205-431d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 6d734d9d2b1f9112-FRA expires Sat, 05 Feb 2022 12:08:08 GMT
GET DATA	200 OK	truncated /	439 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	/ Show response t.dtscout.com/pv/	50 B 318 B	293ms 98ms	Script application/javascript	158.69.139.237 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/pv/?_a=v&_h=katilmobilacikdenizv2denizbank.co.vu&_ss=1d7n5x8k27&_pv=1&_ls=0&_u1=1&_u3=1&_cc=nl&_pl=d&_cbid=7102&_cb=_dtspv.c Requested by Host: t.dtscout.com URL: https://t.dtscout.com/i/?l=http%3A%2F%2Fkatilmobilacikdenizv2denizbank.co.vu%2F&j= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.237 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip237.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash `4149f4fe201f100616f615e19220b6294cad72b746055e891dfbb6636e0e05ea` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Wed, 02 Feb 2022 12:08:08 GMT X-T 0.192 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked X-C 0 Content-Type application/javascript Cache-Control no-cache Connection close Expires Wed, 02 Feb 2022 12:08:07 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	308ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0&t=DenizBank%20%C4%B0nternet%20Bankac%C4%B1l%C4%B1%C4%9F%C4%B1 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	200	v2 Show response de.tynt.com/deb/	4 B 202 B	313ms 102ms	Script application/javascript	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://de.tynt.com/deb/v2?id=w!z7wb8uzumz&dn=TC&cc=1&r= Requested by Host: cdn.tynt.com URL: https://cdn.tynt.com/tc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software / Resource Hash `d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:08 GMT cache-control max-age=86400 content-type application/javascript p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" content-length 4 expires Thu, 03 Feb 2022 12:08:08 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	100ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0&t=DenizBank%20%C4%B0nternet%20Bankac%C4%B1l%C4%B1%C4%9F%C4%B1 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	101ms 101ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0&t=DenizBank%20%C4%B0nternet%20Bankac%C4%B1l%C4%B1%C4%9F%C4%B1 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	100ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	100ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	100ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	100ms 100ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!z7wb8uzumz&lm=0&ts=1643803688533&dn=TC&iso=0 Requested by Host: katilmobilacikdenizv2denizbank.co.vu URL: http://katilmobilacikdenizv2denizbank.co.vu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://katilmobilacikdenizv2denizbank.co.vu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 02 Feb 2022 12:08:09 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Denizbank (Banking)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
katilmobilacikdenizv2denizbank.co.vu/	1969-12-31 23:59:59	Name: PHPSESSID Value: 21c15b70a8039546c0e36015dc49bc43
.dtscout.com/	1970-01-20 00:36:48	Name: m Value: 1
.dtscout.com/	1970-01-20 00:37:01	Name: b Value: 1
.dtscout.com/	1970-01-20 00:36:58	Name: oa Value: 1
.dtscout.com/	1970-01-20 03:00:43	Name: df Value: 1643803688

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://katilmobilacikdenizv2denizbank.co.vu/== Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
de.tynt.com
ic.tynt.com
katilmobilacikdenizv2denizbank.co.vu
t.dtscout.com
waust.at
whos.amung.us
104.18.29.199
158.69.139.237
20.123.145.250
2606:4700:20::681a:407
67.202.105.31
67.202.105.34
67.202.94.94
0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84
1b74331ad061c583ad54561f95596a8481b95d863a431fc4daf3a9ee7d151975
2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62
3da913d79fff46cfe4d58d56e141cfcb31865606284507f7a530db69394330fb
4149f4fe201f100616f615e19220b6294cad72b746055e891dfbb6636e0e05ea
54e92ad9930ef375b8f4e1a1fe7fe5c86d43d7ad00a955c5df818e26489049b8
59c1a112d5d610c1399aa46d5b549c5aad1e4b283aaf785545e818d053f25378
5a669f51edbd981fed6eae210fdf26a4a095d9aba39d5973bee7fa1c225eef09
74ded04044e0ea5035452097608c57828b228d0201feda6055c58029fff87f29
7eb704d9b4ca582fa56c8f610af81afdf6773b3c0a8a40362befc94b3b70dbc6
852c91851b42a721f88a0e4f732f9b558ac205eb7cc32ba6947b8e4382bd3538
9285a80d8ab5865b3c84926cf203f1b3d15667d275a88f64dcfeb83d9ed2d316
a085c2f1e7df8cdded779fa68b0ce2e0d31d3352ed8d8238cb540f35fa20cf0d
b582e5e36135cfe697ec9cfbb06ff7407a7d89a9e4a1287cfdd905cc3f9669e5
be3979aa66ab98b74f4c323b1c194cba444de65913e489d5786e0c7fd8f310c0
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac
f7278ca494d765eab007679ace9914b237327326d7cd2840660dc8140a8b5542

katilmobilacikdenizv2denizbank.co.vu Open in urlscan Pro 20.123.145.250 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

16 Requests

69 %HTTPS

14 %IPv6

5 Domains

7 Subdomains

8 IPs

4 Countries

1835 kBTransfer

2275 kBSize

5 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

23 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

katilmobilacikdenizv2denizbank.co.vu Open in urlscan Pro
20.123.145.250 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

69 %
HTTPS

14 %
IPv6

5
Domains

7
Subdomains

8
IPs

4
Countries

1835 kB
Transfer

2275 kB
Size

5
Cookies

16 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!