050500-2024.com Open in urlscan Pro
2606:4700:3031::6815:2f92 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://050500-2024.com/
Submission: On May 06 via api (May 6th 2024, 6:29:57 am UTC) from TR — Scanned from DE

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3031::6815:2f92, located in United States and belongs to CLOUDFLARENET, US. The main domain is 050500-2024.com.
TLS certificate: Issued by E1 on May 5th 2024. Valid for: 3 months.

This is the only time 050500-2024.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ziraat Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:303... 2606:4700:3031::6815:2f92	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.148.115 172.67.148.115	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

3 2606:4700:3031::6815:2f92 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

050500-2024.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.148.115 (United States)

ASN13335 (CLOUDFLARENET, US)

050500-2024.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	050500-2024.com 1 redirects 050500-2024.com	546 KB
3	1

	Domain	Requested by
4	050500-2024.com	1 redirects 050500-2024.com
3	1

This site contains no links.

Subject Issuer	Validity	Valid
050500-2024.com E1	`2024-05-05` - `2024-08-03`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://050500-2024.com/
Frame ID: 84BB3FA27C635FD452219F353EC81C6C
Requests: 8 HTTP requests in this frame

Frame: https://050500-2024.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js
Frame ID: A815BF208A6F43327A9A441728A1F60B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hoş Geldiniz | Ziraat Bankası İnternet Bankacılığı

Page Statistics

3
Requests

67 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

669 kB
Transfer

1844 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://050500-2024.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://050500-2024.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js

3 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
050500-2024.com/ 2 MB
541 KB 116ms
78ms Document
text/html 2606:4700:3031::6815:2f92
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://050500-2024.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:2f92 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.18
Resource Hash: c2011023fc71eeba2e05073109fbbb153b23d2fa5b03169c02e85703281b2850

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87f6eb18eb1118cd-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 06 May 2024 06:29:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bjyog7dzxO2mnyKE%2BIckkmvkVAmEb1rZ3bjtrZikjZM7SWuikqtkj9Y2bIEN7nA%2B%2B%2Bl2knNRcgVMoU5NHPf83UFxFtOTNkD2ZYJmUSG%2FF3EYYITPP71eL4eoPTg5KDYP3z8Y6EJl3hD%2B5%2FQXrrE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/8.2.18

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ecd0bd452254e541bd3e0f90384daf729c71bac57dcd6506ce531b82e91a6077

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75e159dc563cef2d81dfc676edd0562791341ffc58e8fb9d377011d4fe0977ae

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7bd1ce5e91f7fa685fe3ec37c7f79c27a49f3ae067afce596fa46bb5b2d90d89

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 104 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b055c452bbb3790a25caef40ba7e75a53f148ad46260c00719b5bd7b6ee90d82

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 13 KB
13 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f9071e4de731c949bee363cc182a5b88e61caa7cffbfd3ccf7321ca11327544

Request headers

Referer
Origin: https://050500-2024.com
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 98 KB
98 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4eb0a95d46a2a21d2a033af489807a56e8669c172839474ed2ab8865ee40994f

Request headers

Referer
Origin: https://050500-2024.com
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 13 KB
13 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87066901222869bbc18ab6d6620daa3aeac78dad94f88233f14ff68bae4cb472

Request headers

Referer
Origin: https://050500-2024.com
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H2

200

main.js Show response
050500-2024.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/ Frame A815
Redirect Chain

https://050500-2024.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://050500-2024.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js

8 KB
4 KB

13ms
12ms

Script
application/javascript

2606:4700:3031::6815:2f92
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://050500-2024.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js

Protocol

Server

2606:4700:3031::6815:2f92 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a7691e0222b7192c69eab21ad84e12ec0b9b453ea4ecb47d1213f85ad3b1ff2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Mon, 06 May 2024 06:29:52 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=znXeYDK1foXJMtxyhVPq%2FAfjUb2eSzA0QozLTzMopXcK3MGGDpHHI07N%2FrWuRTsT2kCbXtw7Ab7RKlxbq8z6YunoOxhum49PissVJCxbh8nGng4KoNNty0%2FMeu8R3Q9sxqbE9zeKL3AmzJXEZv4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 87f6eb1a9d8d18cd-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Mon, 06 May 2024 06:29:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yCjdjMQ%2BflDDfbrppbzntO4s1jRoAkmogFH34DLycKaOeAVIo6Ea2UmsUaIqPXG4vsLPGMVTFjoKFt%2FsMyc1OMhq%2F1y4ueoE6xv7h47RKnKaAdnlwNVuprWdxZpmQ35gMNy%2B7pk4n7KDkIiLd0I%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 87f6eb1a8d7b18cd-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H3 200 87f6eb18eb1118cd Show response
050500-2024.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame A815 0
616 B 49ms
49ms XHR
text/plain 172.67.148.115
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://050500-2024.com/cdn-cgi/challenge-platform/h/g/jsd/r/87f6eb18eb1118cd
Requested by: Host: 050500-2024.com
URL: https://050500-2024.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.148.115 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 06 May 2024 06:29:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=azVjLGdLtLqivjto3UBZlEBK0bFS7crei2fVb2oFc9PQU3Vm1TOhRxQxZMChaCUPSeDOEvhzYQwn79DNS%2BSEqzUioa926uPbR%2FTWp9r0Yc1P5DeUQxJh6zO6KFRprumtGak%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 87f6eb1b0da55d50-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ziraat Bank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| getCookie function| savepage_ShadowLoader function| isValidTCKN

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.050500-2024.com/	1970-01-21 05:08:32	Name: cf_clearance Value: _Z11ODBzTnK5hweTL.ZI6bMnHYaaywO3bMQ.NduLLZY-1714976992-1.0.1.1-pM0rha48DDZJvYSq4bAlnyJujNt112vO0zOG.GSp_67DvLMyUn8PWaaAREQQwnmhWd96p_RZA.5IarIhK957gw

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

050500-2024.com
172.67.148.115
2606:4700:3031::6815:2f92
2f9071e4de731c949bee363cc182a5b88e61caa7cffbfd3ccf7321ca11327544
4eb0a95d46a2a21d2a033af489807a56e8669c172839474ed2ab8865ee40994f
75e159dc563cef2d81dfc676edd0562791341ffc58e8fb9d377011d4fe0977ae
7bd1ce5e91f7fa685fe3ec37c7f79c27a49f3ae067afce596fa46bb5b2d90d89
87066901222869bbc18ab6d6620daa3aeac78dad94f88233f14ff68bae4cb472
8a7691e0222b7192c69eab21ad84e12ec0b9b453ea4ecb47d1213f85ad3b1ff2
b055c452bbb3790a25caef40ba7e75a53f148ad46260c00719b5bd7b6ee90d82
c2011023fc71eeba2e05073109fbbb153b23d2fa5b03169c02e85703281b2850
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecd0bd452254e541bd3e0f90384daf729c71bac57dcd6506ce531b82e91a6077

050500-2024.com Open in urlscan Pro 2606:4700:3031::6815:2f92 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

3 Requests

67 %HTTPS

50 %IPv6

1 Domains

1 Subdomains

3 IPs

1 Countries

669 kBTransfer

1844 kBSize

1 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

050500-2024.com Open in urlscan Pro
2606:4700:3031::6815:2f92 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

669 kB
Transfer

1844 kB
Size

1
Cookies

3 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!