urlscan.io logo urlscan.io
SecurityTrails logo

semetu.com.31-169-94-13.dinamo.net.tr Open in urlscan Pro
31.169.94.13  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://tcog.hk/hMxHY
Effective URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Submission: On March 25 via manual from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 31.169.94.13, located in Turkey and belongs to NETFACTOR-ASN, TR. The main domain is semetu.com.31-169-94-13.dinamo.net.tr.
This is the only time semetu.com.31-169-94-13.dinamo.net.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 6 31.169.94.13 56582 (NETFACTOR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
7 3
Apex Domain
Subdomains		 Transfer
6 dinamo.net.tr
semetu.com.31-169-94-13.dinamo.net.tr
118 KB
1 jquery.com
code.jquery.com
30 KB
1 tcog.hk
tcog.hk
1 KB
7 3
Domain Requested by
6 semetu.com.31-169-94-13.dinamo.net.tr 1 redirects tcog.hk
semetu.com.31-169-94-13.dinamo.net.tr
1 code.jquery.com semetu.com.31-169-94-13.dinamo.net.tr
1 tcog.hk
7 3

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-07 -
2021-07-07		 a year crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh

This page contains 1 frames:

Primary Page: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Frame ID: 3D52C61E38D4A3B47ABC9D018DB3D3D9
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://tcog.hk/hMxHY Page URL
  2. http://semetu.com.31-169-94-13.dinamo.net.tr/ref/ HTTP 302
    http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

7
Requests

29 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

149 kB
Transfer

207 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tcog.hk/hMxHY Page URL
  2. http://semetu.com.31-169-94-13.dinamo.net.tr/ref/ HTTP 302
    http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
hMxHY
tcog.hk/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tcog.hk/hMxHY
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:9cf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b8066b3718b48659f416a4e415c3c8342e1d849e6fe0f1cf00ab2b3b8e15759

Request headers

:method
GET
:authority
tcog.hk
:scheme
https
:path
/hMxHY
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 25 Mar 2021 02:46:25 GMT
content-type
text/html
set-cookie
__cfduid=d451e5d11590bbc86ce8cd29c6fe36fae1616640384; expires=Sat, 24-Apr-21 02:46:24 GMT; path=/; domain=.tcog.hk; HttpOnly; SameSite=Lax; Secure
x-amz-id-2
isAPJtCTg6Fu+7+Mq/e5oVCfqu4E6Ld8Qnr/mcI1VAI77CcUgB4dfjsMwnRHyJb+eITtoxK/KIg=
x-amz-request-id
GGW1TCH3HBD5VVN7
last-modified
Wed, 24 Mar 2021 03:56:15 GMT
cf-cache-status
DYNAMIC
cf-request-id
0908dfb70200001e91ff3b7000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ui2yftcRYgoWAuJ2uZ4lvseBhrq%2Bv%2BIwYWS3mFEAPdRLIXXuGiF%2Fn77E56VgAA59FcjKcANs4LNTNSAeUpxd255ugMB%2FJSZUHp4magOmZxHdUoDT"}],"max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6354cf04cfa61e91-AMS
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Primary Request Cookie set index.php
semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/
Redirect Chain
  • http://semetu.com.31-169-94-13.dinamo.net.tr/ref/
  • http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Requested by
Host: tcog.hk
URL: https://tcog.hk/hMxHY
Protocol
HTTP/1.1
Server
31.169.94.13 , Turkey, ASN56582 (NETFACTOR-ASN, TR),
Reverse DNS
host-31-169-94-13.reverse.dinamo.net.tr
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b2c7ee322acf7263d81e8052e6071f8c85b5476a936291c43f09240c67740269

Request headers

Host
semetu.com.31-169-94-13.dinamo.net.tr
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://tcog.hk/hMxHY

Response headers

Cache-Control
private
Pragma
no-cache
Content-Type
text/html; charset=UTF-8
Content-Encoding
gzip
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
Set-Cookie
PHPSESSID=b53gqp3mco2rf7bbbc27ih5419; path=/
X-Powered-By
ASP.NET
X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Content-Length
2439

Redirect headers

Content-Type
text/html; charset=UTF-8
Location
d53946d8c3d4e5840df91da9dc086bab/index.php
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Content-Length
0
image.css
semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/image.css
Requested by
Host: semetu.com.31-169-94-13.dinamo.net.tr
URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Protocol
HTTP/1.1
Server
31.169.94.13 , Turkey, ASN56582 (NETFACTOR-ASN, TR),
Reverse DNS
host-31-169-94-13.reverse.dinamo.net.tr
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
f8663632e01dc47537ca44469fd83d03ba4234e1d32f7d8fb44b04e3c4bc128d

Request headers

Referer
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Mar 2021 02:42:24 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
W/"d9936b7c2021d71:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
942
user.png
semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/user.png
Requested by
Host: semetu.com.31-169-94-13.dinamo.net.tr
URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Protocol
HTTP/1.1
Server
31.169.94.13 , Turkey, ASN56582 (NETFACTOR-ASN, TR),
Reverse DNS
host-31-169-94-13.reverse.dinamo.net.tr
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4

Request headers

Referer
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Last-Modified
Thu, 25 Mar 2021 02:42:24 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
W/"35bc727c2021d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
3121
pass.png
semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/pass.png
Requested by
Host: semetu.com.31-169-94-13.dinamo.net.tr
URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Protocol
HTTP/1.1
Server
31.169.94.13 , Turkey, ASN56582 (NETFACTOR-ASN, TR),
Reverse DNS
host-31-169-94-13.reverse.dinamo.net.tr
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f

Request headers

Referer
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Last-Modified
Thu, 25 Mar 2021 02:42:24 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
W/"2b58707c2021d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
7695
jquery-3.4.1.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: semetu.com.31-169-94-13.dinamo.net.tr
URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer
http://semetu.com.31-169-94-13.dinamo.net.tr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 25 Mar 2021 02:46:26 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 21:14:27 GMT
server
nginx
etag
W/"5cca0c33-15851"
vary
Accept-Encoding
x-hw
1616640386.dop166.fr8.t,1616640386.cds231.fr8.hc,1616640386.cds236.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30638
backlog.png
semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/backlog.png
Requested by
Host: semetu.com.31-169-94-13.dinamo.net.tr
URL: http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/image.css
Protocol
HTTP/1.1
Server
31.169.94.13 , Turkey, ASN56582 (NETFACTOR-ASN, TR),
Reverse DNS
host-31-169-94-13.reverse.dinamo.net.tr
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c4cc933872f10b2d6f77cb739b1737d34b9c8e9045357058c86b0776e44e077f

Request headers

Referer
http://semetu.com.31-169-94-13.dinamo.net.tr/ref/d53946d8c3d4e5840df91da9dc086bab/img/image.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Powered-By-Plesk
PleskWin
Date
Thu, 25 Mar 2021 02:42:24 GMT
Last-Modified
Thu, 25 Mar 2021 02:42:23 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
W/"24e45a7c2021d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
104582

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| submit object| el_down string| Name function| GFG_Fun function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
semetu.com.31-169-94-13.dinamo.net.tr/ Name: PHPSESSID
Value: b53gqp3mco2rf7bbbc27ih5419