finans-2019ozelkampanya.com Open in urlscan Pro
2606:4700:30::681b:a308 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://finans-2019ozelkampanya.com/
Effective URL:
https://finans-2019ozelkampanya.com/
Submission: On May 11 via manual (May 11th 2019, 9:02:20 am UTC) from TR

Summary HTTP 19 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 2606:4700:30::681b:a308, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is finans-2019ozelkampanya.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 11th 2019. Valid for: a year.

This is the only time finans-2019ozelkampanya.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Finansbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:30:... 2606:4700:30::681b:a208	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
11	2606:4700:30:... 2606:4700:30::681b:a308	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2606:4700::68... 2606:4700::6812:14e2	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	62.108.64.94 62.108.64.94	8831 (FINANSBAN...) (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad.)
19	3

1 2606:4700:30::681b:a208 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

finans-2019ozelkampanya.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:30::681b:a308 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

finans-2019ozelkampanya.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:14e2 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ssif1.globalsign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
seal.globalsign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 62.108.64.94 (Istanbul, Turkey)

ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR)

internetsubesi.qnbfinansbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	finans-2019ozelkampanya.com 1 redirects finans-2019ozelkampanya.com	39 KB
5	qnbfinansbank.com internetsubesi.qnbfinansbank.com	53 KB
3	globalsign.com ssif1.globalsign.com seal.globalsign.com	5 KB
19	3

	Domain	Requested by
12	finans-2019ozelkampanya.com	1 redirects finans-2019ozelkampanya.com
5	internetsubesi.qnbfinansbank.com	finans-2019ozelkampanya.com
2	ssif1.globalsign.com	finans-2019ozelkampanya.com
1	seal.globalsign.com	finans-2019ozelkampanya.com
19	4

This site contains links to these domains. Also see Links.

Domain
internetsubesi.qnbfinansbank.com
www.qnbfinansbank.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-05-11` - `2020-05-11`	a year	crt.sh
www.globalsign.com GlobalSign Extended Validation CA - SHA256 - G3	`2019-03-28` - `2020-06-26`	a year	crt.sh
internetsubesi.qnbfinansbank.com GlobalSign Extended Validation CA - SHA256 - G3	`2018-01-29` - `2020-04-29`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://finans-2019ozelkampanya.com/
Frame ID: 2A5A70CFD5FC908347C9D3791B5818F0
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://finans-2019ozelkampanya.com/ HTTP 301
https://finans-2019ozelkampanya.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

19
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

98 kB
Transfer

141 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://internetsubesi.qnbfinansbank.com/Login/LoginPage.aspx
Title: tıklayınız

Search URL Search Domain Scan URL

URL: https://www.qnbfinansbank.com/bankacilik/alternatif-dagitim-kanallari/internet-bankaciligi/internet-bankaciligi-kullaniminda-guvenlik.aspx
Title: buraya

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://finans-2019ozelkampanya.com/ HTTP 301
https://finans-2019ozelkampanya.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response finans-2019ozelkampanya.com/ Redirect Chain http://finans-2019ozelkampanya.com/ https://finans-2019ozelkampanya.com/	13 KB 4 KB	137ms 93ms	Document text/html	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `2d799d601797e0d95d6e0e3e6371a14ea0a9a2858a0cc4ce292a6b61901e78b6` Request headers :method GET :authority finans-2019ozelkampanya.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Sat, 11 May 2019 09:02:04 GMT content-type text/html set-cookie __cfduid=d3e71cfd32718dbeed30f5627a2ce3dd71557565324; expires=Sun, 10-May-20 09:02:04 GMT; path=/; domain=.finans-2019ozelkampanya.com; HttpOnly; Secure x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4d52f8d04e6ebeb0-FRA content-encoding br Redirect headers Date Sat, 11 May 2019 09:02:04 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Sat, 11 May 2019 10:02:04 GMT Location https://finans-2019ozelkampanya.com/ Vary Accept-Encoding Server cloudflare CF-RAY 4d52f8cfcbe7973c-FRA
GET H2	200	FinansbankLoginStyle.css finans-2019ozelkampanya.com/index_files/	25 KB 3 KB	19ms 16ms	Stylesheet text/css	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `a900fda991cc346407c33cbc88ce237afc6c76d91962e49de1bbf30e1c3b9e23` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT content-encoding br etag W/"5a9b0de2-6440" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:04:34 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 4d52f8d0ef92beb0-FRA expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	loginmain.css finans-2019ozelkampanya.com/index_files/	15 KB 2 KB	25ms 23ms	Stylesheet text/css	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://finans-2019ozelkampanya.com/index_files/loginmain.css Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `25e9a8613f27a1ef95b69fde6317e012e51168db94a6cca207a7eff6d76d69ab` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT content-encoding br etag W/"5a9b0d0a-3cdd" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:00:58 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 4d52f8d0ef95beb0-FRA expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	loader.gif finans-2019ozelkampanya.com/index_files/	7 KB 7 KB	14ms 12ms	Image image/gif	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/loader.gif Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `8f0ce7a451aca53c1c25686de641067fd9eef2c40298e847593b52079da46c4b` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-1bbe" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef96beb0-FRA content-length 7102 expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	siteSeal.do Show response ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/	0 80 B	370ms 270ms	Script text/html	2606:4700::6812:14e2 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/siteSeal.do?p1=internetsubesi.qnbfinansbank.com&p2=SZ110-45&p3=image&p4=en&p5=V0023&p6=S001&p7=https Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14e2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Sat, 11 May 2019 09:02:05 GMT content-encoding gzip server cloudflare cf-ray 4d52f8d18d4bc2ef-FRA expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html
GET H2	200	siteSealImage.do ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/	4 KB 4 KB	381ms 281ms	Image image/png	2606:4700::6812:14e2 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/siteSealImage.do?p1=internetsubesi.qnbfinansbank.com&p2=SZ110-45&p3=image&p4=en&p5=V0023&p6=S001&p7=https&deterDn= Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14e2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `875d526ba0fe340d3643353968c5d19bfad603af7b35d25f74c15e47704e7610` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:05 GMT via AX-CACHE-2.7:45 server cloudflare age 366 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type image/png status 200 cf-ray 4d52f8d18d51c2ef-FRA content-length 4087
GET H2	200	gmogs_image_110-45_en_dblue.js Show response seal.globalsign.com/SiteSeal/	2 KB 1 KB	137ms 12ms	Script application/javascript	2606:4700::6812:14e2 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://seal.globalsign.com/SiteSeal/gmogs_image_110-45_en_dblue.js Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14e2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `a05826090ec74ff3f28479211fd28065237aa75fb9c7ba2bb320c731a5e45f70` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:05 GMT via AX-CACHE-2.7:34 cf-cache-status HIT last-modified Mon, 30 Jul 2018 22:29:04 GMT server cloudflare etag W/"1652-1532989744000" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 content-encoding gzip cache-control public, max-age=43200 cf-ray 4d52f8d1adeec2ef-FRA expires Sat, 11 May 2019 21:02:05 GMT
GET H2	200	content_title_left.png finans-2019ozelkampanya.com/index_files/	15 KB 15 KB	12ms 11ms	Image image/png	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/content_title_left.png Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `9a2765ce8c2c1b3ab845aa9d69528351bf4f9bce5c1142479be9a5c7a7865577` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-3bbe" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef98beb0-FRA content-length 15294 expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	content_title_right.png finans-2019ozelkampanya.com/index_files/	1 KB 1 KB	14ms 13ms	Image image/png	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/content_title_right.png Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `4288f17db6c0ddf260f7a73a8d40ddd2dbde9b0ce30fef8b7b4844c291a4a041` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-482" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef99beb0-FRA content-length 1154 expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	content_ok.png finans-2019ozelkampanya.com/index_files/	1 KB 1 KB	11ms 10ms	Image image/png	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/content_ok.png Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `7f9856451b35e2bdad8f886132298558d91a43acdf686f40e18d3d95ba01eb32` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-428" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef9bbeb0-FRA content-length 1064 expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	guvenlik_top.png finans-2019ozelkampanya.com/index_files/	1 KB 1 KB	14ms 13ms	Image image/png	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/guvenlik_top.png Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `1add688782519f1f33deaf5a1a2042b51a6c25db796af48796ff4eada25231e9` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-529" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef9dbeb0-FRA content-length 1321 expires Sat, 11 May 2019 13:02:04 GMT
GET H2	200	guvenlik_bottom.png finans-2019ozelkampanya.com/index_files/	2 KB 2 KB	13ms 12ms	Image image/png	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/index_files/guvenlik_bottom.png Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `8b0bd6f54d36ad05ec14dda8b2450a9af826ac4030f304c6efbe460a679fc6ac` Request headers Referer https://finans-2019ozelkampanya.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:04 GMT etag "5a9b0d0c-865" cf-cache-status HIT last-modified Sat, 03 Mar 2018 21:01:00 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4d52f8d0ef9ebeb0-FRA content-length 2149 expires Sat, 11 May 2019 13:02:04 GMT
GET H/1.1	200 OK	header.jpg internetsubesi.qnbfinansbank.com/Content/Images/	32 KB 32 KB	349ms 74ms	Image image/jpeg	62.108.64.94 FINANSBANK Inkila...
General Check archive.org Show headers Download Go to Show image Full URL https://internetsubesi.qnbfinansbank.com/Content/Images/header.jpg?uid=508864734 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR), Reverse DNS Software / Resource Hash `206e053d7f227b837c7bcf4ec3a6289e1e0ba6eca6d4cd5f73a55f13d0974911` Request headers Referer https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 11 May 2019 09:02:05 GMT Cache-Control public Content-Type image/jpeg Transfer-Encoding chunked Expires Sun, 10 May 2020 09:02:05 GMT
GET H/1.1	200 OK	content_title_middle.png internetsubesi.qnbfinansbank.com/Content/Images/	940 B 1 KB	355ms 77ms	Image image/png	62.108.64.94 FINANSBANK Inkila...
General Check archive.org Show headers Download Go to Show image Full URL https://internetsubesi.qnbfinansbank.com/Content/Images/content_title_middle.png?uid=508864734 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR), Reverse DNS Software / Resource Hash `6808ca18e58479c6cbcdba51591d3bfa58f4cb75c6a23f13afa418ceec50f650` Request headers Referer https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 11 May 2019 09:02:05 GMT Cache-Control public Content-Type image/png Transfer-Encoding chunked Expires Sun, 10 May 2020 09:02:05 GMT
GET H2	404	alert-icon.png finans-2019ozelkampanya.com/Content/Images/	1 KB 1 KB	12ms 11ms	Image text/html	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/Content/Images/alert-icon.png?uid=508864750 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `ba72ea09960888c02c1665a1ffb99cb94fdacbbf7e880240a64dc44cc831837e` Request headers Referer https://finans-2019ozelkampanya.com/index_files/loginmain.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:05 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 May 2019 19:23:04 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control public, max-age=14400 cf-ray 4d52f8d33b10beb0-FRA expires Sat, 11 May 2019 13:02:05 GMT
GET H/1.1	200 OK	subcontentbackground.jpg internetsubesi.qnbfinansbank.com/Content/Images/	17 KB 17 KB	355ms 78ms	Image image/jpeg	62.108.64.94 FINANSBANK Inkila...
General Check archive.org Show headers Download Go to Show image Full URL https://internetsubesi.qnbfinansbank.com/Content/Images/subcontentbackground.jpg?uid=508864734 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR), Reverse DNS Software / Resource Hash `c63fb77054d1a2ccffdd32fcffff802e34543cc6d28fa2580e29d2c05f271f64` Request headers Referer https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 11 May 2019 09:02:05 GMT Cache-Control public Content-Type image/jpeg Transfer-Encoding chunked Expires Sun, 10 May 2020 09:02:05 GMT
GET H/1.1	200 OK	guvenlik_middle.png internetsubesi.qnbfinansbank.com/Content/Images/	1011 B 1 KB	356ms 77ms	Image image/png	62.108.64.94 FINANSBANK Inkila...
General Check archive.org Show headers Download Go to Show image Full URL https://internetsubesi.qnbfinansbank.com/Content/Images/guvenlik_middle.png?uid=508864734 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR), Reverse DNS Software / Resource Hash `78f5f2bc9315d1c7371fb1a4d6480a9e7625bafe95e84fcda47e3552c561c02a` Request headers Referer https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 11 May 2019 09:02:05 GMT Cache-Control public Content-Type image/png Transfer-Encoding chunked Expires Sun, 10 May 2020 09:02:05 GMT
GET H/1.1	200 OK	arrow.png internetsubesi.qnbfinansbank.com/Content/Images/	1 KB 1 KB	357ms 78ms	Image image/png	62.108.64.94 FINANSBANK Inkila...
General Check archive.org Show headers Download Go to Show image Full URL https://internetsubesi.qnbfinansbank.com/Content/Images/arrow.png?uid=508864734 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR), Reverse DNS Software / Resource Hash `e6d74b1fa656995627ce5e8b0839a62b0ffd54b8de7be4f2e40eae2c92b968c8` Request headers Referer https://finans-2019ozelkampanya.com/index_files/FinansbankLoginStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 11 May 2019 09:02:04 GMT Cache-Control public Content-Type image/png Transfer-Encoding chunked Expires Sun, 10 May 2020 09:02:05 GMT
GET H2	404	footer-bg.jpg finans-2019ozelkampanya.com/Content/Images/	1 KB 1 KB	11ms 10ms	Image text/html	2606:4700:30::681b:a308 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://finans-2019ozelkampanya.com/Content/Images/footer-bg.jpg?uid=508864750 Requested by Host: finans-2019ozelkampanya.com URL: https://finans-2019ozelkampanya.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:a308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `ba72ea09960888c02c1665a1ffb99cb94fdacbbf7e880240a64dc44cc831837e` Request headers Referer https://finans-2019ozelkampanya.com/index_files/loginmain.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 11 May 2019 09:02:05 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 May 2019 19:23:04 GMT server cloudflare x-powered-by PleskLin expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control public, max-age=14400 cf-ray 4d52f8d33b15beb0-FRA expires Sat, 11 May 2019 13:02:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Finansbank (Banking)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.finans-2019ozelkampanya.com/	1970-01-19 09:25:01	Name: __cfduid Value: d3e71cfd32718dbeed30f5627a2ce3dd71557565324

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

finans-2019ozelkampanya.com
internetsubesi.qnbfinansbank.com
seal.globalsign.com
ssif1.globalsign.com
2606:4700:30::681b:a208
2606:4700:30::681b:a308
2606:4700::6812:14e2
62.108.64.94
1add688782519f1f33deaf5a1a2042b51a6c25db796af48796ff4eada25231e9
206e053d7f227b837c7bcf4ec3a6289e1e0ba6eca6d4cd5f73a55f13d0974911
25e9a8613f27a1ef95b69fde6317e012e51168db94a6cca207a7eff6d76d69ab
2d799d601797e0d95d6e0e3e6371a14ea0a9a2858a0cc4ce292a6b61901e78b6
4288f17db6c0ddf260f7a73a8d40ddd2dbde9b0ce30fef8b7b4844c291a4a041
6808ca18e58479c6cbcdba51591d3bfa58f4cb75c6a23f13afa418ceec50f650
78f5f2bc9315d1c7371fb1a4d6480a9e7625bafe95e84fcda47e3552c561c02a
7f9856451b35e2bdad8f886132298558d91a43acdf686f40e18d3d95ba01eb32
875d526ba0fe340d3643353968c5d19bfad603af7b35d25f74c15e47704e7610
8b0bd6f54d36ad05ec14dda8b2450a9af826ac4030f304c6efbe460a679fc6ac
8f0ce7a451aca53c1c25686de641067fd9eef2c40298e847593b52079da46c4b
9a2765ce8c2c1b3ab845aa9d69528351bf4f9bce5c1142479be9a5c7a7865577
a05826090ec74ff3f28479211fd28065237aa75fb9c7ba2bb320c731a5e45f70
a900fda991cc346407c33cbc88ce237afc6c76d91962e49de1bbf30e1c3b9e23
ba72ea09960888c02c1665a1ffb99cb94fdacbbf7e880240a64dc44cc831837e
c63fb77054d1a2ccffdd32fcffff802e34543cc6d28fa2580e29d2c05f271f64
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d74b1fa656995627ce5e8b0839a62b0ffd54b8de7be4f2e40eae2c92b968c8

finans-2019ozelkampanya.com Open in urlscan Pro 2606:4700:30::681b:a308 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

98 kBTransfer

141 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

1 Cookies

Indicators

finans-2019ozelkampanya.com Open in urlscan Pro
2606:4700:30::681b:a308 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

98 kB
Transfer

141 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!