haticeutkan.com Open in urlscan Pro
77.245.159.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.ko.gl/YcRbu
Effective URL:
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Submission: On October 28 via manual (October 28th 2022, 6:40:28 pm UTC) from ES — Scanned from ES

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 18 HTTP transactions. The main IP is 77.245.159.99, located in Turkey and belongs to NIOBEBILISIMHIZMETLERI, TR. The main domain is haticeutkan.com.
TLS certificate: Issued by R3 on October 13th 2022. Valid for: 3 months.

This is the only time haticeutkan.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3035::6815:5262	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	170.10.160.115 170.10.160.115	32748 (STEADFAST) (STEADFAST)
1	2606:4700::68... 2606:4700::6811:480e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
1 15	77.245.159.99 77.245.159.99	42868 (NIOBEBILI...) (NIOBEBILISIMHIZMETLERI)
1	158.69.251.190 158.69.251.190	16276 (OVH) (OVH)
18	5

2 2606:4700:3035::6815:5262 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.ko.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ko.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 170.10.160.115 (United States)

ASN32748 (STEADFAST, US)
PTR: 3nomic.digital

sidtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:480e (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 77.245.159.99 (Turkey) 1 redirects

ASN42868 (NIOBEBILISIMHIZMETLERI, TR)
PTR: 77-245-159-99.ptr.wlsrv.com

haticeutkan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 158.69.251.190 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns546644.ip-158-69-251.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	haticeutkan.com 1 redirects haticeutkan.com	784 KB
2	histats.com s10.histats.com — Cisco Umbrella Rank: 18443 s4.histats.com — Cisco Umbrella Rank: 15595	5 KB
2	ko.gl 2 redirects www.ko.gl ko.gl	1010 B
1	cloudflare.com ajax.cloudflare.com — Cisco Umbrella Rank: 3914	4 KB
1	sidtube.com sidtube.com	723 B
18	5

	Domain	Requested by
15	haticeutkan.com	1 redirects haticeutkan.com
1	s4.histats.com	s10.histats.com
1	s10.histats.com	sidtube.com
1	ajax.cloudflare.com	sidtube.com
1	sidtube.com
1	ko.gl	1 redirects
1	www.ko.gl	1 redirects
18	7

This site contains no links.

Subject Issuer	Validity	Valid
sidtube.com cPanel, Inc. Certification Authority	`2022-10-26` - `2023-01-24`	3 months	crt.sh
ajax.cloudflare.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-09` - `2023-08-16`	a year	crt.sh
histats.com R3	`2022-09-30` - `2022-12-29`	3 months	crt.sh
haticeutkan.com R3	`2022-10-13` - `2023-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Frame ID: 292454B051E7FF66A111A3B276AA5147
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home Banking

Page URL History Show full URLs

https://www.ko.gl/YcRbu HTTP 301
https://ko.gl/YcRbu HTTP 301
https://sidtube.com/wp-content/themes/ Page URL
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/ HTTP 302
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

7
Subdomains

5
IPs

4
Countries

793 kB
Transfer

1453 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.ko.gl/YcRbu HTTP 301
https://ko.gl/YcRbu HTTP 301
https://sidtube.com/wp-content/themes/ Page URL
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/ HTTP 302
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.ko.gl/YcRbu HTTP 301
https://ko.gl/YcRbu HTTP 301
https://sidtube.com/wp-content/themes/

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
sidtube.com/wp-content/themes/
Redirect Chain

https://www.ko.gl/YcRbu
https://ko.gl/YcRbu
https://sidtube.com/wp-content/themes/

966 B
723 B

477ms
150ms

Document
text/html

170.10.160.115
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://sidtube.com/wp-content/themes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 170.10.160.115 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: 3nomic.digital
Software: LiteSpeed /
Resource Hash: 5cde7fa47b48980f34ac54cc5d39d0f78f4c2959c77f4f68ad1d5dcb73a62828

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: es-ES,es;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 479
content-type: text/html; charset=UTF-8
date: Fri, 28 Oct 2022 18:40:22 GMT
server: LiteSpeed
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7615cca14aba6666-MAD
content-type: text/html; charset=UTF-8
date: Fri, 28 Oct 2022 18:40:21 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://sidtube.com/wp-content/themes/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YgLAzx5iP4DwFuhKhObGuxiOVJz5cPwClCnxo7792fOFBrKJnaavcnAu%2B2QtCiCHVZZlPBBOln6r4jsU6JubBoVXMNY4PU7eXrt5VbJtNWVFhh3Vg38i%2ButiZytuGl0gNejL3A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ 12 KB
4 KB 117ms
39ms Script
application/javascript 2606:4700::6811:480e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/rocket-loader.min.js

Requested by

Host: sidtube.com
URL: https://sidtube.com/wp-content/themes/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:480e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://sidtube.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:22 GMT
strict-transport-security: max-age=15780000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 26 Oct 2022 23:39:35 GMT
server: cloudflare
content-encoding: gzip
etag: W/"6359c537-302c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 7615ccab4b5b6617-MAD
expires: Sun, 30 Oct 2022 18:40:22 GMT

GET
H2 200 js15_as.js
s10.histats.com/ 11 KB
4 KB 162ms
51ms Script
text/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s10.histats.com/js15_as.js
Requested by: Host: sidtube.com
URL: https://sidtube.com/wp-content/themes/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://sidtube.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:32:32 GMT
content-encoding: br
last-modified: Thu, 16 Apr 2020 10:44:16 GMT
x-cacheable: Matched cache
x-cdn-pop-ip: 51.254.41.128/25
etag: "-375139978"
content-type: text/javascript
x-cdn-pop: rbx1
accept-ranges: bytes
content-length: 4364
x-request-id: 526845041

GET
H2

200

Primary Request particulares Show response
haticeutkan.com/wp-includes/ID3/x/Iogin/home/
Redirect Chain

https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/
https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares

12 KB
4 KB

432ms
431ms

Document
text/html

77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed / PHP/7.2.34
Resource Hash: 3e21c94998260564b92159961ccff13302200b3fa65b7b5c271038166aad7638

Request headers

Referer: https://sidtube.com/wp-content/themes/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: es-ES,es;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 28 Oct 2022 18:40:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.2.34

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 28 Oct 2022 18:40:19 GMT
location: particulares
server: LiteSpeed
vary: User-Agent
x-powered-by: PHP/7.2.34

GET
H/1.1 200
OK 0.php
s4.histats.com/stats/ 50 B
184 B 509ms
135ms Script
text/html 158.69.251.190
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s4.histats.com/stats/0.php?4299303&@f16&@g1&@h1&@i1&@j1666982422470&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:160503212&@b3:1666982422&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fsidtube.com%2Fwp-content%2Fthemes%2F&@w
Requested by: Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.251.190 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns546644.ip-158-69-251.net
Software: /
Resource Hash

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://sidtube.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 28 Oct 2022 18:40:22 GMT
Connection: close
Content-Length: 50
Content-Type: text/html;charset=UTF-8

GET
H3 200 main.a5beaad1.css
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 314 KB
39 KB 102ms
101ms Stylesheet
text/css 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 65b5e9af6fe2f36bf2978fb062ac3f0844156e1b4880c01f615fba2354ddfa87

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:19 GMT
content-encoding: br
last-modified: Thu, 23 May 2019 18:37:04 GMT
server: LiteSpeed
etag: "4e9fe-5ce6e850-dffa6e4ea9cb34b6;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 39879
expires: Fri, 04 Nov 2022 18:40:19 GMT

GET
H3 200 angular.min.js Show response
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/ 163 KB
55 KB 362ms
361ms Script
application/javascript 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/angular.min.js
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:19 GMT
content-encoding: br
last-modified: Mon, 20 Nov 2017 07:55:28 GMT
server: LiteSpeed
etag: "28cdb-5a128a70-2f691e0c8740a476;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 56667
expires: Fri, 04 Nov 2022 18:40:19 GMT

GET
H3 200 jquery.min.js Show response
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/ 286 KB
81 KB 244ms
243ms Script
application/javascript 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/jquery.min.js
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:19 GMT
content-encoding: br
last-modified: Mon, 04 Dec 2017 08:11:38 GMT
server: LiteSpeed
etag: "478d0-5a25033a-7746f26ddec46072;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 82379
expires: Fri, 04 Nov 2022 18:40:19 GMT

GET
H3 200 jquery.validate.min.js Show response
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/ 49 KB
13 KB 343ms
343ms Script
application/javascript 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/jquery.validate.min.js
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: ce0fe7f95d80802ce6db03b2d255ca1878f0f4be17048aaed326946d30804b61

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:19 GMT
content-encoding: br
last-modified: Sun, 30 Dec 2018 04:19:14 GMT
server: LiteSpeed
etag: "c3f1-5c284742-72789c352a8d3389;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 12700
expires: Fri, 04 Nov 2022 18:40:19 GMT

GET
H3 200 jquery.mask.js Show response
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/ 18 KB
5 KB 357ms
356ms Script
application/javascript 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/js/jquery.mask.js
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:19 GMT
content-encoding: br
last-modified: Sun, 31 Jan 2016 17:57:28 GMT
server: LiteSpeed
etag: "47fe-56ae4b08-2d5c7df23a2f1336;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4687
expires: Fri, 04 Nov 2022 18:40:19 GMT

GET
H3 404 smarbannerimg.png
haticeutkan.com/wp-includes/ID3/x/Iogin/home/images/ 524 B
524 B 106ms
105ms Image
text/html 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/images/smarbannerimg.png
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: c0dd7d43d9e76c3d2ec57c1b2875b486c6a28ebd55faf928cb6ac88af0f04447

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
content-encoding: gzip
server: LiteSpeed
content-length: 273
vary: Accept-Encoding,User-Agent
content-type: text/html

GET
H3 200 spring_afternoon_p.jpg
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/ 371 KB
372 KB 101ms
101ms Image
image/jpeg 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style/spring_afternoon_p.jpg
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 1b52e8efb42bc0849b0f75fb64eea8c25035d624a4bd507db661b41ba89bd552

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Wed, 01 Jul 2020 11:50:00 GMT
server: LiteSpeed
etag: "5cdc3-5efc7868-4ffbe0534c4094e6;;;"
vary: User-Agent
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 380355
expires: Fri, 04 Nov 2022 18:40:20 GMT

GET
H3 200 ico3.ttf
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 41 KB
41 KB 156ms
156ms Font
application/x-font-ttf 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//ico3.ttf
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 1845ede5d9bfae1cae119fe3a69e89ab429421712ad1623c5fbc8f29e7146366

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:56:58 GMT
server: LiteSpeed
etag: "a560-5ce6c2ca-5d95c9975c991519;;;"
vary: User-Agent
content-type: application/x-font-ttf
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 42336
expires: Fri, 04 Nov 2022 18:40:20 GMT

GET
H3 200 ico.ttf
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 27 KB
28 KB 173ms
172ms Font
application/x-font-ttf 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//ico.ttf?xshdhgx
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: ee25342f45423d2d69e15fdfda470f1dc1fa575087642ee7cab540cd28fe9055

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:56:12 GMT
server: LiteSpeed
etag: "6dd0-5ce6c29c-4c8532cc4ef0b5da;;;"
vary: User-Agent
content-type: application/x-font-ttf
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 28112
expires: Fri, 04 Nov 2022 18:40:20 GMT

GET
H3 200 Lato-Regular.woff
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 37 KB
37 KB 184ms
183ms Font
application/x-font-woff 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//Lato-Regular.woff
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 34a85643617aca507bef2c232955d2b27a131b39dd8cff33d567148024e7b460

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:50:02 GMT
server: LiteSpeed
etag: "9368-5ce6c12a-191034efa24de189;;;"
vary: User-Agent
content-type: application/x-font-woff
accept-ranges: bytes
content-length: 37736

GET
H3 200 Lato-Light.woff
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 35 KB
35 KB 214ms
214ms Font
application/x-font-woff 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//Lato-Light.woff
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 47378272154e50107f0f3ffa755ca6fcd1495fdc931e922f880d7240f998029c

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:54:58 GMT
server: LiteSpeed
etag: "8ba4-5ce6c252-fa61f11ced516eea;;;"
vary: User-Agent
content-type: application/x-font-woff
accept-ranges: bytes
content-length: 35748

GET
H3 200 Lato-Semibold.woff
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 38 KB
38 KB 230ms
229ms Font
application/x-font-woff 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//Lato-Semibold.woff
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 15f0dbfdc7e0142e35e0cfad279b9162494ebe5d2d2f0dcd19b079c4e4a48682

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:52:10 GMT
server: LiteSpeed
etag: "9690-5ce6c1aa-32060b8ac0c6e190;;;"
vary: User-Agent
content-type: application/x-font-woff
accept-ranges: bytes
content-length: 38544

GET
H3 200 Lato-Bold.woff
haticeutkan.com/wp-includes/ID3/x/Iogin/home/style// 36 KB
36 KB 235ms
235ms Font
application/x-font-woff 77.245.159.99
NIOBEBILISIMHIZME...

General

Check archive.org

Show headers Download Go to

Full URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//Lato-Bold.woff
Requested by: Host: haticeutkan.com
URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 77.245.159.99 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS: 77-245-159-99.ptr.wlsrv.com
Software: LiteSpeed /
Resource Hash: 8194873b3cd30305dda0b8b5e8db89e48a977f086b7f22781f2e53e34fe362e5

Request headers

Referer: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/style//main.a5beaad1.css
Origin: https://haticeutkan.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 28 Oct 2022 18:40:20 GMT
last-modified: Thu, 23 May 2019 15:51:10 GMT
server: LiteSpeed
etag: "9038-5ce6c16e-5905e59f82bfcc26;;;"
vary: User-Agent
content-type: application/x-font-woff
accept-ranges: bytes
content-length: 36920

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ko.gl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 23c44i31i8lqr5a3ksb2ndq1l8
ko.gl/	1970-01-20 07:03:03	Name: short_311803 Value: 1
sidtube.com/	1970-01-20 15:48:38	Name: HstCfa4299303 Value: 1666982422470
sidtube.com/	1970-01-20 15:48:38	Name: HstCla4299303 Value: 1666982422470
sidtube.com/	1970-01-20 15:48:38	Name: HstCmu4299303 Value: 1666982422470
sidtube.com/	1970-01-20 15:48:38	Name: HstPn4299303 Value: 1
sidtube.com/	1970-01-20 15:48:38	Name: HstPt4299303 Value: 1
sidtube.com/	1970-01-20 15:48:38	Name: HstCnv4299303 Value: 1
sidtube.com/	1970-01-20 15:48:38	Name: HstCns4299303 Value: 1
haticeutkan.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b120986fa96bf1160d459bf0ad2673b5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/particulares(Line 17) Message: The key "target-densitydpi" is not supported.
network	error	URL: https://haticeutkan.com/wp-includes/ID3/x/Iogin/home/images/smarbannerimg.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
haticeutkan.com
ko.gl
s10.histats.com
s4.histats.com
sidtube.com
www.ko.gl
158.69.251.190
170.10.160.115
2606:4700:3035::6815:5262
2606:4700::6811:480e
46.105.201.240
77.245.159.99
15f0dbfdc7e0142e35e0cfad279b9162494ebe5d2d2f0dcd19b079c4e4a48682
1845ede5d9bfae1cae119fe3a69e89ab429421712ad1623c5fbc8f29e7146366
1b52e8efb42bc0849b0f75fb64eea8c25035d624a4bd507db661b41ba89bd552
34a85643617aca507bef2c232955d2b27a131b39dd8cff33d567148024e7b460
3e21c94998260564b92159961ccff13302200b3fa65b7b5c271038166aad7638
47378272154e50107f0f3ffa755ca6fcd1495fdc931e922f880d7240f998029c
5cde7fa47b48980f34ac54cc5d39d0f78f4c2959c77f4f68ad1d5dcb73a62828
65b5e9af6fe2f36bf2978fb062ac3f0844156e1b4880c01f615fba2354ddfa87
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
8194873b3cd30305dda0b8b5e8db89e48a977f086b7f22781f2e53e34fe362e5
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
c0dd7d43d9e76c3d2ec57c1b2875b486c6a28ebd55faf928cb6ac88af0f04447
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ce0fe7f95d80802ce6db03b2d255ca1878f0f4be17048aaed326946d30804b61
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
ee25342f45423d2d69e15fdfda470f1dc1fa575087642ee7cab540cd28fe9055

haticeutkan.com Open in urlscan Pro 77.245.159.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

33 %IPv6

5 Domains

7 Subdomains

5 IPs

4 Countries

793 kBTransfer

1453 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

10 Cookies

2 Console Messages

Indicators

haticeutkan.com Open in urlscan Pro
77.245.159.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

7
Subdomains

5
IPs

4
Countries

793 kB
Transfer

1453 kB
Size

10
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!