teknolojitrend.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 84.54.13.97, located in Turkey and belongs to SIBERDC, TR. The main domain is teknolojitrend.com.
TLS certificate: Issued by R3 on November 28th 2022. Valid for: 3 months.

This is the only time teknolojitrend.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 3	84.54.13.97 84.54.13.97	61084 (SIBERDC) (SIBERDC)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
2	104.18.27.27 104.18.27.27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3

3 84.54.13.97 (Turkey) 1 redirects

ASN61084 (SIBERDC, TR)
PTR: vea.com.tr

teknolojitrend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.27.27 (None, )

ASN13335 (CLOUDFLARENET, US)

www.visaprepaidprocessing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	teknolojitrend.com 1 redirects teknolojitrend.com	26 KB
2	visaprepaidprocessing.com www.visaprepaidprocessing.com — Cisco Umbrella Rank: 259383	16 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 51	964 B
5	3

	Domain	Requested by
3	teknolojitrend.com	1 redirects teknolojitrend.com
2	www.visaprepaidprocessing.com	teknolojitrend.com
1	fonts.googleapis.com	teknolojitrend.com
5	3

This site contains links to these domains. Also see Links.

Domain
www.visaprepaidprocessing.com
usa.visa.com
www.fdic.gov

Subject Issuer	Validity	Valid
teknolojitrend.com R3	`2022-11-28` - `2023-02-26`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
www.visaprepaidprocessing.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://teknolojitrend.com/eddreactivate/
Frame ID: 5A00740FFEBA732F9D15FEE17E88D242
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://teknolojitrend.com/eddreactivate HTTP 301
https://teknolojitrend.com/eddreactivate/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

42 kB
Transfer

225 kB
Size

2
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.visaprepaidprocessing.com/eddcard/home/index

Search URL Search Domain Scan URL

URL: https://usa.visa.com/legal/global-privacy-notice.html
Title: Visa Global Privacy Notice.

Search URL Search Domain Scan URL

URL: https://www.fdic.gov/deposit/deposits/prepaid.html
Title: fdic.gov/deposit/deposits/prepaid.html

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://teknolojitrend.com/eddreactivate HTTP 301
https://teknolojitrend.com/eddreactivate/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
teknolojitrend.com/eddreactivate/
Redirect Chain

https://teknolojitrend.com/eddreactivate
https://teknolojitrend.com/eddreactivate/

208 KB
25 KB

87ms
86ms

Document
text/html

84.54.13.97
SIBERDC

General

Check archive.org

Show headers Download Go to

Full URL: https://teknolojitrend.com/eddreactivate/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 84.54.13.97 , Turkey, ASN61084 (SIBERDC, TR),
Reverse DNS: vea.com.tr
Software: Apache /
Resource Hash: 7635d6eb620b7ad7e8cff9b9a5379e5fb6c48cb12b4780bb49203b8dcf050dbc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 25674
Content-Type: text/html
Date: Sun, 04 Dec 2022 13:06:49 GMT
Keep-Alive: timeout=5, max=99
Last-Modified: Fri, 22 Apr 2022 02:26:32 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent

Redirect headers

Connection: Keep-Alive
Content-Length: 249
Content-Type: text/html; charset=iso-8859-1
Date: Sun, 04 Dec 2022 13:06:49 GMT
Keep-Alive: timeout=5, max=100
Location: https://teknolojitrend.com/eddreactivate/
Server: Apache

GET
H2 200 css
fonts.googleapis.com/ 1 KB
964 B 41ms
17ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

Requested by

Host: teknolojitrend.com
URL: https://teknolojitrend.com/eddreactivate/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b740bb4e2de3bd58f0251ba4493c9f8f547d699235500c4d6bb8979fa201022f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://teknolojitrend.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 04 Dec 2022 13:08:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 04 Dec 2022 13:07:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 04 Dec 2022 13:08:03 GMT

GET
H2 200 logo.png
www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Images/ 8 KB
8 KB 129ms
68ms Image
image/png 104.18.27.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Images/logo.png

Requested by

Host: teknolojitrend.com
URL: https://teknolojitrend.com/eddreactivate/

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.18.27.27 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad62eb85667532488d032273c196c7ea1c10e0897223c4b66cd38b8c5e5215a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://teknolojitrend.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 13:08:03 GMT
strict-transport-security: max-age=3153600; includeSubDomains
cf-cache-status: HIT
last-modified: Tue, 15 Oct 2019 14:27:22 GMT
server: cloudflare
age: 4465
etag: "d8d87ca86483d51:0"
x-opnet-transaction-trace: a2_df55e276-96ed-464a-bf34-c0af3c5ffb8d-8132-1212680
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7744c4c2d8c4907c-FRA
content-length: 7719
expires: Sun, 04 Dec 2022 17:08:03 GMT

GET
H2 200 logo.png
www.visaprepaidprocessing.com/content/PRC384/_images/ 8 KB
8 KB 124ms
63ms Image
image/png 104.18.27.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.visaprepaidprocessing.com/content/PRC384/_images/logo.png

Requested by

Host: teknolojitrend.com
URL: https://teknolojitrend.com/eddreactivate/

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.18.27.27 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=3153600; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://teknolojitrend.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date: Sun, 04 Dec 2022 13:08:03 GMT
strict-transport-security: max-age=3153600; includeSubDomains
cf-cache-status: HIT
last-modified: Thu, 03 Sep 2020 15:21:41 GMT
server: cloudflare
age: 4014
etag: "80709aec582d61:0"
x-opnet-transaction-trace: a2_d4b77a84-6072-4282-b1f8-db2c95e4d093-10384-1964258
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7744c4c2d8c8907c-FRA
content-length: 7719
expires: Sun, 04 Dec 2022 17:08:03 GMT

GET
H/1.1 404
Not Found rocket-loader.min.js
teknolojitrend.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 0
0 86ms
86ms Script
text/html 84.54.13.97
SIBERDC

General

Check archive.org

Show headers Download Go to

Full URL: https://teknolojitrend.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by: Host: teknolojitrend.com
URL: https://teknolojitrend.com/eddreactivate/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 84.54.13.97 , Turkey, ASN61084 (SIBERDC, TR),
Reverse DNS: vea.com.tr
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://teknolojitrend.com/eddreactivate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 13:06:49 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.visaprepaidprocessing.com/	1969-12-31 23:59:59	Name: __cfruid Value: aa726bc130c048e2fc4d3b4c2b84c95d9b2ac6e1-1670159283
			.visaprepaidprocessing.com/	1970-01-20 07:56:01	Name: __cf_bm Value: RGOCQJUBwQxcty8keiOBi0LA8jfU4srZbluRNM0yKiQ-1670159283-0-AYX6TTuaKA7FFDTtw5ZlaCdBuICJ07mgU4pjyOKtU6RzEl1oEGQ2Wr7sXSKwHj2m5mdKZTCmdbgN7KSe6T8nyoY=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://teknolojitrend.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
teknolojitrend.com
www.visaprepaidprocessing.com
104.18.27.27
2a00:1450:4001:831::200a
84.54.13.97
7635d6eb620b7ad7e8cff9b9a5379e5fb6c48cb12b4780bb49203b8dcf050dbc
880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7
ad62eb85667532488d032273c196c7ea1c10e0897223c4b66cd38b8c5e5215a4
b740bb4e2de3bd58f0251ba4493c9f8f547d699235500c4d6bb8979fa201022f

teknolojitrend.com Open in urlscan Pro 84.54.13.97 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

42 kBTransfer

225 kBSize

2 Cookies

3 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

teknolojitrend.com Open in urlscan Pro
84.54.13.97 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

42 kB
Transfer

225 kB
Size

2
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!