opticool.com.tr
Open in
urlscan Pro
185.171.24.22
Malicious Activity!
Public Scan
URL:
https://opticool.com.tr/macmoci/
Submission: On March 16 via manual from AU — Scanned from US
Submission: On March 16 via manual from AU — Scanned from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 185.171.24.22, located in
Turkey and
belongs to BURSABIL, TR.
The main domain is opticool.com.tr.
TLS certificate: Issued by R3 on January 23rd 2023. Valid for: 3 months.
This is the only time opticool.com.tr was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 23rd 2023. Valid for: 3 months.
This is the only time opticool.com.tr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication) Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 6 | 185.171.24.22 185.171.24.22 | 60721 (BURSABIL) (BURSABIL) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 6 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
opticool.com.tr
1 redirects
opticool.com.tr |
2 MB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 686 |
30 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | opticool.com.tr |
1 redirects
opticool.com.tr
|
| 1 | code.jquery.com |
opticool.com.tr
|
| 6 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| opticool.com.tr R3 |
2023-01-23 - 2023-04-23 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://opticool.com.tr/macmoci/
Frame ID: 414C2E35932748910CAACD28AF4D06D6
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://opticool.com.tr/macmoci
HTTP 301
https://opticool.com.tr/macmoci/ Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://opticool.com.tr/macmoci
HTTP 301
https://opticool.com.tr/macmoci/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
opticool.com.tr/macmoci/ Redirect Chain
|
195 KB 41 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
micr.svg
opticool.com.tr/macmoci/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
arrow.svg
opticool.com.tr/macmoci/ |
513 B 686 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
back.svg
opticool.com.tr/macmoci/ |
2 MB 2 MB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
opticool.com.tr/macmoci/ |
0 41 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication) Microsoft (Consumer)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| $Debug object| $Do function| $Loader function| GetString function| GetErrorString function| GetUrl object| $B object| StringRepository object| PROOF boolean| __ function| $ function| jQuery function| showLog function| showPss function| showCd function| Send string| $chat string| $token string| $url0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
opticool.com.tr
185.171.24.22
2001:4de0:ac18::1:a:3b
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
7fa8902a0eab478d31da7d5af7f6f44934b388c6695ef7bea2c115632e8389a4
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
aa5cd34d736b5c8993b516d52211748d3248830f720d4e5a5f4defc64b59db0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f305fa79c01f4cccf0c97a5149814e31ccd166a48cc7bfe5cce7972d282431e9