urlscan.io logo urlscan.io
SecurityTrails logo

basvursu.com Open in urlscan Pro
104.21.12.160  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://basvursu.com/edevlet.php
Submission Tags: @ecarlesi threat #phishing #trcert Search All
Submission: On October 31 via api from PL — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 104.21.12.160, located in and belongs to CLOUDFLARENET, US. The main domain is basvursu.com.
TLS certificate: Issued by GTS CA 1P5 on October 30th 2023. Valid for: 3 months.
This is the only time basvursu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BDDK (Banking)

Domain & IP information

IP Address AS Autonomous System
1 104.21.12.160 13335 (CLOUDFLAR...)
1 2
Apex Domain
Subdomains		 Transfer
1 basvursu.com
basvursu.com
237 KB
1 1
Domain Requested by
1 basvursu.com
1 1

This site contains links to these domains. Also see Links.

Domain
giris.turkiye.gov.tr
yesilkart.online
www.turkiye.gov.tr
Subject Issuer Validity Valid
basvursu.com
GTS CA 1P5		 2023-10-30 -
2024-01-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://basvursu.com/edevlet.php
Frame ID: 189414BEC33CF8103E27680EA0A910E2
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

e-Devlet Kapısı

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

333 kB
Transfer

768 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request edevlet.php
basvursu.com/ 		655 KB
237 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://basvursu.com/edevlet.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.12.160 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d29bfb369f1825aee7543f2be9666a04b25952b7d22444d9f204ed42685f375a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
81ef1182eeed349e-WAW
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 31 Oct 2023 21:42:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SaiWomBcSa%2B6mjf5BFkH41jqGDNSsUHQ9ucJMTBTJmdAR1F1ra2rAj7qsgEg5mzjlBwtzpXsBXbsexNhahmlYa4uDJYn1uA%2BPDXffVIX40oIZFPjs1qPPV9gCXCyJag%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
473f0d637169b8b400874ffb0c487dfc5f4bc544e8bfebe98502a6a5ceb781e7

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ff7498da718b1f50faeefae71e24ceadf4575da0692b84c9a1ad359daa1f2ff2

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
39966ec7eea8f508184cef9f98895a0e8d74e3328a43cc8a93c528cfca888691

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27292f1f2138adbd114fa0463bec7cfcb3475c08477f79554da42d858be68d70

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
537d46273fe124bbced2f098f26222fa3155741e9d76f906c3c39e7fa09bf6a8

Request headers

Referer
Origin
https://basvursu.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		448 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14e8e481e7afcaae3200f172bd49bf7146ea2a23d3fdf0ba71d5fdbbd0c8c5a4

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		393 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
945f7d25e8f885da3c77668f74ecacefa894dc535ac048f57a56e2b2fc2560df

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b155ade172e77bc397377c1856af15289b509590b332b351e48f5c11f73a35e

Request headers

Referer
Origin
https://basvursu.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
814a3f4f20f812103033c8345c9bbd27f561a5462f34843e88c94f6f5dc4092c

Request headers

Referer
Origin
https://basvursu.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78e78c58a6dab82f460252e9a0dcdcb5d0c0eb2f2307998764dea1dc1796a4f0

Request headers

Referer
Origin
https://basvursu.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type
application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BDDK (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| savepage_ShadowLoader

0 Cookies