urlscan.io logo urlscan.io
SecurityTrails logo

sahibinden.aktifsatisim.com.tr Open in urlscan Pro
2606:4700:3036::6815:5e49  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc
Effective URL: https://sahibinden.aktifsatisim.com.tr/404
Submission: On February 28 via api from TR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3036::6815:5e49, located in United States and belongs to CLOUDFLARENET, US. The main domain is sahibinden.aktifsatisim.com.tr.
TLS certificate: Issued by GTS CA 1P5 on February 28th 2024. Valid for: 3 months.
This is the only time sahibinden.aktifsatisim.com.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sahibinden (Classifieds)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
6 85.153.147.73 34984 (TELLCOM-AS)
7 2
Apex Domain
Subdomains		 Transfer
6 shbdn.com
s0.shbdn.com — Cisco Umbrella Rank: 111715
185 KB
3 aktifsatisim.com.tr
sahibinden.aktifsatisim.com.tr
3 KB
7 2
Domain Requested by
6 s0.shbdn.com sahibinden.aktifsatisim.com.tr
s0.shbdn.com
3 sahibinden.aktifsatisim.com.tr 2 redirects
7 2

This site contains links to these domains. Also see Links.

Domain
www.sahibinden.com
banaozel.sahibinden.com
yardim.sahibinden.com
Subject Issuer Validity Valid
aktifsatisim.com.tr
GTS CA 1P5		 2024-02-28 -
2024-05-28		 3 months crt.sh
*.shbdn.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-28 -
2024-10-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://sahibinden.aktifsatisim.com.tr/404
Frame ID: 4E2026C349E682443228F29ECF16B862
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

sahibinden.com Hata Sayfası

Page URL History Show full URLs

  1. http://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc HTTP 301
    https://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc HTTP 302
    https://sahibinden.aktifsatisim.com.tr/404 Page URL

Page Statistics

7
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

186 kB
Transfer

388 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc HTTP 301
    https://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc HTTP 302
    https://sahibinden.aktifsatisim.com.tr/404 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 404
sahibinden.aktifsatisim.com.tr/
Redirect Chain
  • http://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc
  • https://sahibinden.aktifsatisim.com.tr/ilan/dyson-sekillendirici/L5cHioif0upOAc
  • https://sahibinden.aktifsatisim.com.tr/404
4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sahibinden.aktifsatisim.com.tr/404
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6815:5e49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
377298cc3fdcfea4fbd7534e74b3293282d9e405a563d4fca71a405dbdcb975e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
85cbb0d84aca7832-CDG
content-encoding
br
content-type
text/html
date
Wed, 28 Feb 2024 21:16:49 GMT
last-modified
Sun, 18 Feb 2024 03:56:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jPGh4ZQoQxp7bziIYYqTAGyXPR1D9dvhWtpXsRv1IgemToUv%2BdvN2mfHuR1zF5rRdtJ5FlNScSwR98BKMB2UnTR9fDur36%2BBreC0L1dLvvyFDIMlMb1z7ekLJmiJhFIqPSmDlrhVTryW2p8JdzBufdUBRK5nznzmjTVDbvo%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
85cbb0d61fb57832-CDG
content-type
text/html; charset=UTF-8
date
Wed, 28 Feb 2024 21:16:49 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
/404
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8OL%2FdpcbcX1gUaNfvHvqQhVon6zGmTQLR8z8iqhDKhzxtd0JuGUFEl28Y%2B26Aj5OS6%2FIr7EjCPfDYHtHTdt77lLXAHVcjxFULfPeKZDWbCpAyJt9fSpcTPIq8jkGOH1qE8GA4E87T1ZXnk4fiXPCDysuj8NpMu9Qo2VMMTI%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.2.16 PleskLin
common:26dbad3a4f2a4a13327e03aadaadc7c6.css
s0.shbdn.com/assets/ 		227 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.shbdn.com/assets/common:26dbad3a4f2a4a13327e03aadaadc7c6.css
Requested by
Host: sahibinden.aktifsatisim.com.tr
URL: https://sahibinden.aktifsatisim.com.tr/404
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
39b445ea263c71448e9d0880dd10a7d5556e147385661df0baf11d4773eb0620
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sahibinden.aktifsatisim.com.tr/404
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 4,8080
date
Wed, 14 Feb 2024 04:41:19 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
content-encoding
gzip
age
1269483
content-length
40299
x-secure-option
secure
last-modified
Tue, 13 Feb 2024 21:04:14 GMT
server
Sahibinden Web Servers
etag
W/"65cbd94e-38afa"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
x-frame-options
SAMEORIGIN
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
errors:e7fe36c939561abcb9663a33eda55be8.css
s0.shbdn.com/assets/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.shbdn.com/assets/errors:e7fe36c939561abcb9663a33eda55be8.css
Requested by
Host: sahibinden.aktifsatisim.com.tr
URL: https://sahibinden.aktifsatisim.com.tr/404
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
308e62e6970872c437acfeb409b0a9fa131b7363930ba794ff9e0c133e1f8ea1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sahibinden.aktifsatisim.com.tr/404
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 3,8080
date
Fri, 24 Nov 2023 00:01:39 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
content-encoding
gzip
age
8371057
content-length
3211
x-secure-option
secure
last-modified
Thu, 23 Nov 2023 04:11:22 GMT
server
Sahibinden Web Servers
etag
W/"655ed0ea-4723"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
x-frame-options
SAMEORIGIN
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
header:62f94b4d0cde1436b82fbd54c07a34cb.png
s0.shbdn.com/assets/images/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.shbdn.com/assets/images/header:62f94b4d0cde1436b82fbd54c07a34cb.png
Requested by
Host: s0.shbdn.com
URL: https://s0.shbdn.com/assets/errors:e7fe36c939561abcb9663a33eda55be8.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
dc9e1be25bfde9e96b2d29d9b21ef9f05ba42187ee388bd0549269e448efc3df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.shbdn.com/assets/errors:e7fe36c939561abcb9663a33eda55be8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 4,8080
date
Wed, 11 Oct 2023 12:50:23 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
age
12126531
content-length
47706
last-modified
Tue, 10 Oct 2023 15:06:36 GMT
server
Sahibinden Web Servers
etag
"6525687c-ba5a"
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
accept-ranges
bytes
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
SHBGroteskLegacy-Regular:072af6e51ea47968612a13a6a8522f59.woff2
s0.shbdn.com/assets/blob/ 		37 KB
37 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.shbdn.com/assets/blob/SHBGroteskLegacy-Regular:072af6e51ea47968612a13a6a8522f59.woff2
Requested by
Host: s0.shbdn.com
URL: https://s0.shbdn.com/assets/common:26dbad3a4f2a4a13327e03aadaadc7c6.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
85c5dfa70de41604f75673c2dadcc8411d5d163d3775284e40ab025cee817ed6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://s0.shbdn.com/assets/common:26dbad3a4f2a4a13327e03aadaadc7c6.css
Origin
https://sahibinden.aktifsatisim.com.tr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 6,8080
date
Fri, 24 Nov 2023 00:01:29 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
age
8371068
content-length
37404
x-secure-option
secure
last-modified
Thu, 23 Nov 2023 04:10:22 GMT
server
Sahibinden Web Servers
etag
"655ed0ae-921c"
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
accept-ranges
bytes
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
categoryIcons:8cf1aed1d423abe04a21da2ef7582ea0.png
s0.shbdn.com/assets/images/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.shbdn.com/assets/images/categoryIcons:8cf1aed1d423abe04a21da2ef7582ea0.png
Requested by
Host: s0.shbdn.com
URL: https://s0.shbdn.com/assets/errors:e7fe36c939561abcb9663a33eda55be8.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
23e96075fc46caa9cda337afadbb4d36faa55dc0def8d911b4b762d31f55e15d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.shbdn.com/assets/errors:e7fe36c939561abcb9663a33eda55be8.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 5,8080
date
Sun, 21 Jan 2024 12:31:23 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
age
3314878
content-length
20648
x-secure-option
secure
last-modified
Fri, 19 Jan 2024 10:29:24 GMT
server
Sahibinden Web Servers
etag
"65aa4f04-50a8"
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
accept-ranges
bytes
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
SHBGroteskLegacy-Bold:0db3249d6e7b5cc4180b9056fe813d20.woff2
s0.shbdn.com/assets/blob/ 		36 KB
37 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.shbdn.com/assets/blob/SHBGroteskLegacy-Bold:0db3249d6e7b5cc4180b9056fe813d20.woff2
Requested by
Host: s0.shbdn.com
URL: https://s0.shbdn.com/assets/common:26dbad3a4f2a4a13327e03aadaadc7c6.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.153.147.73 , Turkey, ASN34984 (TELLCOM-AS, TR),
Reverse DNS
Software
Sahibinden Web Servers /
Resource Hash
d601848a4291446de173464a729921ef3f70d37ac0c3b6709ef6ba132ab30d9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://s0.shbdn.com/assets/common:26dbad3a4f2a4a13327e03aadaadc7c6.css
Origin
https://sahibinden.aktifsatisim.com.tr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-proxy
tzla-204 3,8080
date
Fri, 24 Nov 2023 00:01:38 GMT
via
www.sahibinden.com(c)
x-content-type-options
nosniff
age
8371059
content-length
37212
x-secure-option
secure
last-modified
Thu, 23 Nov 2023 04:10:22 GMT
server
Sahibinden Web Servers
etag
"655ed0ae-915c"
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control
max-age=31536000,public
accept-ranges
bytes
access-control-allow-headers
Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sahibinden (Classifieds)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
sahibinden.aktifsatisim.com.tr/ Name: PHPSESSID
Value: i0vq1mu8514efo694jkb8muvjc