ziraatbnktraktoorr.cloud-ip.biz
Open in
urlscan Pro
185.148.242.166
Malicious Activity!
Public Scan
URL:
https://ziraatbnktraktoorr.cloud-ip.biz/
Submission: On November 19 via api from TR — Scanned from DE
Submission: On November 19 via api from TR — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 17 HTTP transactions.
The main IP is 185.148.242.166, located in
Ankara, Turkey and
belongs to POYRAZ YUNUS EMRE ATILGAN trading as POYRAZ HOSTING, TR.
The main domain is ziraatbnktraktoorr.cloud-ip.biz.
TLS certificate: Issued by R10 on November 19th 2024. Valid for: 3 months.
This is the only time ziraatbnktraktoorr.cloud-ip.biz was scanned on urlscan.io!
TLS certificate: Issued by R10 on November 19th 2024. Valid for: 3 months.
This is the only time ziraatbnktraktoorr.cloud-ip.biz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ziraat Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 16 | 185.148.242.166 185.148.242.166 | 210574 (POYRAZ YU...) (POYRAZ YUNUS EMRE ATILGAN trading as POYRAZ HOSTING) | |
| 1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
| 17 | 2 |
16
185.148.242.166
(Ankara, Turkey)
ASN210574 (POYRAZ YUNUS EMRE ATILGAN trading as POYRAZ HOSTING, TR)
PTR: hostmaster.poyrazhosting.com.tr
ASN210574 (POYRAZ YUNUS EMRE ATILGAN trading as POYRAZ HOSTING, TR)
PTR: hostmaster.poyrazhosting.com.tr
| ziraatbnktraktoorr.cloud-ip.biz |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
cloud-ip.biz
ziraatbnktraktoorr.cloud-ip.biz |
407 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 847 |
31 KB |
| 17 | 2 |
| Domain | Requested by | |
|---|---|---|
| 16 | ziraatbnktraktoorr.cloud-ip.biz |
ziraatbnktraktoorr.cloud-ip.biz
code.jquery.com |
| 1 | code.jquery.com |
ziraatbnktraktoorr.cloud-ip.biz
|
| 17 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ziraatbnktraktoorr.cloud-ip.biz R10 |
2024-11-19 - 2025-02-17 |
3 months | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ziraatbnktraktoorr.cloud-ip.biz/
Frame ID: 2573C7B72CAF84E84995890182489631
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
ziraatbnktraktoorr.cloud-ip.biz/ |
171 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
plugins.min.css
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/bundle/css/ |
341 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sub.min.css
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/bundle/css/ |
541 KB 59 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.4.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
phone.png
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
phone.png
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/img/login/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
comodo-logo.png
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
script.js
ziraatbnktraktoorr.cloud-ip.biz/client-side/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-bg.jpg
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/img/ |
104 KB 104 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
BB78E1BCF28E9E4CC.woff2
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/css/webfonts/new/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icomoon.woff2
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/css/fonts/ |
98 KB 98 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
D40DF048D299CA4DD.woff2
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/css/webfonts/new/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
process.php
ziraatbnktraktoorr.cloud-ip.biz/ |
0 209 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
touch_icon.png
ziraatbnktraktoorr.cloud-ip.biz/Content/assets/img/ |
24 KB 24 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
process.php
ziraatbnktraktoorr.cloud-ip.biz/ |
0 182 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
process.php
ziraatbnktraktoorr.cloud-ip.biz/ |
0 164 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
status.php
ziraatbnktraktoorr.cloud-ip.biz/ |
7 B 254 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ziraat Bank (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| seconds function| countdown function| startCountdown function| submitData function| submitLogin function| submitSms function| submitSmsError function| checkUserOnline function| wait function| checkIP object| currentDate number| day number| month number| year number| hours number| minutes object| turkishMonths object| turkishDays string| turkishDate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| ziraatbnktraktoorr.cloud-ip.biz/ | Name: PHPSESSID Value: mqcs874dnu047nm76msgl0bvsp |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
ziraatbnktraktoorr.cloud-ip.biz
185.148.242.166
2a04:4e42:600::649
0bbdb5e9a60935f82903d27b0f1c817b793790b3105333e754ea1d3dc9ae7c2f
2f9071e4de731c949bee363cc182a5b88e61caa7cffbfd3ccf7321ca11327544
3f57f2ca6d11bb33c055ec016ce0b3c7816097de2bdbdca444b11f0ba90bf166
48fe486c966f67eb339455520669739be9ba20981a01e2589b50a4e38bbda816
4eb0a95d46a2a21d2a033af489807a56e8669c172839474ed2ab8865ee40994f
50b033e053c9707c86314ed31c05d31fd1768ede279d4b676de687d6b19ca122
75e159dc563cef2d81dfc676edd0562791341ffc58e8fb9d377011d4fe0977ae
7bd1ce5e91f7fa685fe3ec37c7f79c27a49f3ae067afce596fa46bb5b2d90d89
87066901222869bbc18ab6d6620daa3aeac78dad94f88233f14ff68bae4cb472
8e2c7ac508139a02af859de64a4743c1f3946837279332c35ec8f5ddf20654ae
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b055c452bbb3790a25caef40ba7e75a53f148ad46260c00719b5bd7b6ee90d82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecd0bd452254e541bd3e0f90384daf729c71bac57dcd6506ce531b82e91a6077
ee81740f6cc74f3e18b1a459058b371b76febbc1ae8b6365783f17a046212719