urlscan.io logo urlscan.io
SecurityTrails logo

underonesix.cfd Open in urlscan Pro
185.215.180.48  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://underonesix.cfd/?u=1
Submission: On September 25 via api from TR — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 28 HTTP transactions. The main IP is 185.215.180.48, located in Düsseldorf, Germany and belongs to CONTABO, DE. The main domain is underonesix.cfd.
TLS certificate: Issued by R11 on September 24th 2024. Valid for: 3 months.
This is the only time underonesix.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Finansbank (Banking)

Domain & IP information

IP Address AS Autonomous System
9 185.215.180.48 51167 (CONTABO)
16 62.108.64.94 8831 (FINANSBAN...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2 178.18.193.121 50941 (VARGONEN)
28 4
9    185.215.180.48 (Düsseldorf, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi2052670.contaboserver.net
underonesix.cfd
16    62.108.64.94 (Istanbul, Turkey)

ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR)
internetsubesi.qnbfinansbank.com
2    2606:4700::6812:15e2 (United States)

ASN13335 (CLOUDFLARENET, US)
ssif1.globalsign.com
seal.globalsign.com
2    178.18.193.121 (Turkey)

ASN50941 (VARGONEN, TR)
PTR: wpf02.vargonen.net
www.globalsign.com.tr
globalsign.com.tr
Apex Domain
Subdomains		 Transfer
16 qnbfinansbank.com
internetsubesi.qnbfinansbank.com
148 KB
9 underonesix.cfd
underonesix.cfd
11 KB
2 globalsign.com.tr
www.globalsign.com.tr
globalsign.com.tr
10 KB
2 globalsign.com
ssif1.globalsign.com — Cisco Umbrella Rank: 96290
seal.globalsign.com — Cisco Umbrella Rank: 64864
1 KB
28 4
Domain Requested by
16 internetsubesi.qnbfinansbank.com underonesix.cfd
internetsubesi.qnbfinansbank.com
9 underonesix.cfd underonesix.cfd
1 seal.globalsign.com underonesix.cfd
1 globalsign.com.tr underonesix.cfd
1 www.globalsign.com.tr 1 redirects
1 ssif1.globalsign.com underonesix.cfd
28 6

This site contains links to these domains. Also see Links.

Domain
www.qnbfinansbank.com
Subject Issuer Validity Valid
underonesix.cfd
R11		 2024-09-24 -
2024-12-23		 3 months crt.sh
internetsubesi.qnbfinansbank.com
GlobalSign RSA OV SSL CA 2018		 2024-06-04 -
2025-07-06		 a year crt.sh
www.globalsign.com
GlobalSign Extended Validation CA - SHA256 - G3		 2024-06-20 -
2024-11-04		 5 months crt.sh

This page contains 1 frames:

Primary Page: https://underonesix.cfd/?u=1
Frame ID: D3F85831984752F531DA31D16AA3C42E
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

QNB Finansbank İnternet Şubesi

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <input[^>]+name="__VIEWSTATE
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

28
Requests

96 %
HTTPS

25 %
IPv6

4
Domains

6
Subdomains

4
IPs

3
Countries

170 kB
Transfer

440 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • https://www.globalsign.com.tr/Content/Images/v4/dv-image-seal.png HTTP 301
  • https://globalsign.com.tr/Content/Images/v4/dv-image-seal.png

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
underonesix.cfd/ 		32 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx / PHP/8.3.11 PleskLin
Resource Hash
4e587fdbd951fad7f1f26cbcf714b6978878c3fc5c6e26a528a6fb7baf97f623

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 25 Sep 2024 13:23:59 GMT
server
nginx
x-powered-by
PHP/8.3.11 PleskLin
jquery.smartbanner.css
internetsubesi.qnbfinansbank.com/Content/Devices/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Devices/jquery.smartbanner.css
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
eea379e3b3ee2dda27918c96365281b1e2bb1c82c9543912d956ce4bcb0416b1
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
private
Content-Encoding
gzip
Connection
Keep-Alive
Via
NS-CACHE-10.0: 80
Expires
Wed, 25 Sep 2024 14:02:15 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
1630
Date
Wed, 25 Sep 2024 12:02:14 GMT
X-XSS-Protection
1; mode=block
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="jquery.smartbanner.css"
FinansbankDropDownList.css
internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/ 		17 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/FinansbankDropDownList.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
6d0e94be3cf2011227566d5a0d48888f40817562d726c209705b0dd17d9c3559
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:03 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Cheac-Control
private
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:02 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="FinansbankDropDownList.css"
Content-Length
3613
FBDialog.css
internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/FBDialog.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
d37f1e136291f5aece875f6e397961df091d4dfd99c4ce1e7cbb2d8cbe68ea2d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:04 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Cheac-Control
private
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:03 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="FBDialog.css"
Content-Length
4948
FBTooltip.css
internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/ 		5 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/FinansbankTheme/FBTooltip.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
10f9da27e6bfc62eec468c71fa676305712bf8aeb30f024c9f4ff2c9f7aa6fcd
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:00 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
chCae-Control
private
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
1579
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:00 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="FBTooltip.css"
FinansbankLoginStyle.css
internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/ 		54 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/FinansbankLoginStyle.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
1a15229a29216564313b1ed4c988f3f77b788326b7983875442cdb26e84ac703
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:00 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Cheac-Control
private
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:00 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="FinansbankLoginStyle.css"
Content-Length
9045
warning.css
internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/warning.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
63488384a74463c05e4050ad8108435854659a1d8ab8eaa2535bd843b6a4c7f6
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:00 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
chCae-Control
private
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
611
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:00 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="warning.css"
loginmain.css
internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/ 		16 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/loginmain.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
5377dcd6ee83576bc843a639a868f33cc8f8ceeb98bb2036e4ce845b692d9ff9
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:00 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
chCae-Control
private
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
3545
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:23:59 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="loginmain.css"
bootstrap.css
internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/ 		202 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/bootstrap.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
e1bc8b5658f16ea8945a2281db1f2c95cbb5ab9256c7400987e5d9b456213c2d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:01 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
chCae-Control
private
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
43886
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:00 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="bootstrap.css"
bootstrap-ie11.css
internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/ 		10 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/bootstrap-ie11.css?20240225071508
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
005e7276b6346022d9311d6dd61a2ffd5f7b84ee14f94ce28ba569fbe6cb2c20
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:03 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Cheac-Control
private
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:03 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="bootstrap-ie11.css"
Content-Length
3213
cordale.min.css
internetsubesi.qnbfinansbank.com/Content/Fonts/Cordale/ 		186 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Fonts/Cordale/cordale.min.css?20240225071506
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
e1c784b966e7cb2985fbcc42b5362987c076dfc9d347d3286ed131ea26c6dcd6
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:00 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
chCae-Control
private
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Content-Length
132
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:00 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="cordale.min.css"
muli.min.css
internetsubesi.qnbfinansbank.com/Content/Fonts/Muli/ 		304 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Fonts/Muli/muli.min.css?20240225071506
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
9c882904b4c57ec2761920df6798ea9cd23296151f1d6e79a0aa8805dbcae706
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Content-Encoding
gzip
piExres
Thu, 25 Sep 2025 13:24:03 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Cheac-Control
private
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:03 GMT
Content-Type
text/css; charset=utf-8
content-disposition
attachment; filename="muli.min.css"
Content-Length
152
jquery.smartbanner.js
underonesix.cfd/Content/Devices/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://underonesix.cfd/Content/Devices/jquery.smartbanner.js
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:00 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
loader.gif
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/loader.gif
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:03 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
content_title_left.png
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/content_title_left.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:06 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
content_title_right.png
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/content_title_right.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:06 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
qr_disabled.png
internetsubesi.qnbfinansbank.com/Content/Images/ 		39 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Images/qr_disabled.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
323524115e60df7e7e094de9388e553bf8f7e87c8ef934d50ad1b99841c735e6
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
public
Connection
Keep-Alive
Via
NS-CACHE-10.0: 80
Expires
Wed, 25 Sep 2024 14:38:00 GMT
Access-Control-Allow-Origin
*
Content-Length
39858
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Date
Wed, 25 Sep 2024 12:37:59 GMT
X-XSS-Protection
1; mode=block
Content-Type
image/png
captcha-refresh.jpg
internetsubesi.qnbfinansbank.com/Content/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Images/captcha-refresh.jpg
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
6722e1471c13f7e3365469775fe0a6c39b1df6a5b4f6dff08b4f113ab545a163
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
public
Connection
Keep-Alive
Via
NS-CACHE-10.0: 80
Expires
Wed, 25 Sep 2024 14:27:09 GMT
Access-Control-Allow-Origin
*
Content-Length
5559
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Date
Wed, 25 Sep 2024 12:27:08 GMT
X-XSS-Protection
1; mode=block
Content-Type
image/jpeg
content_ok.png
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/content_ok.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:06 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
guvenlik_top.png
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/guvenlik_top.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:06 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
guvenlik_bottom.png
underonesix.cfd/Content/Images/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://underonesix.cfd/Content/Images/guvenlik_bottom.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:06 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx
siteSeal.do
ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/ 		0
157 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ssif1.globalsign.com/SiteSeal/siteSeal/siteSeal/siteSeal.do?p1=internetsubesi.qnbfinansbank.com&p2=SZ110-45&p3=image&p4=en&p5=V0023&p6=S001&p7=https
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:15e2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

x-cache-status
MISS
cf-ray
8c8b551c6d4b08cc-LAX
content-encoding
gzip
cf-cache-status
DYNAMIC
date
Wed, 25 Sep 2024 13:24:05 GMT
content-type
text/html
server
cloudflare
dv-image-seal.png
globalsign.com.tr/Content/Images/v4/
Redirect Chain
  • https://www.globalsign.com.tr/Content/Images/v4/dv-image-seal.png
  • https://globalsign.com.tr/Content/Images/v4/dv-image-seal.png
9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://globalsign.com.tr/Content/Images/v4/dv-image-seal.png
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Server
178.18.193.121 , Turkey, ASN50941 (VARGONEN, TR),
Reverse DNS
wpf02.vargonen.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
fedf4740b9ae487ac387afe5ac91b724a7a0c9fc05680b9f024ccc37ebb7772b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

strict-transport-security
max-age=31536000
etag
"38b4236b1c5cda1:0"
accept-ranges
bytes
x-powered-by-plesk
PleskWin
content-length
9727
date
Wed, 25 Sep 2024 13:24:06 GMT
content-type
image/png
last-modified
Sat, 10 Feb 2024 12:26:48 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET

Redirect headers

strict-transport-security
max-age=31536000
location
https://globalsign.com.tr/Content/Images/v4/dv-image-seal.png
x-powered-by-plesk
PleskWin
content-length
184
date
Wed, 25 Sep 2024 13:24:06 GMT
content-type
text/html; charset=UTF-8
x-powered-by
ASP.NET
server
Microsoft-IIS/10.0
gmogs_image_110-45_en_dblue.js
seal.globalsign.com/SiteSeal/ 		2 KB
913 B 		Script
General
Check archive.org
Download Go to
Full URL
https://seal.globalsign.com/SiteSeal/gmogs_image_110-45_en_dblue.js
Requested by
Host: underonesix.cfd
URL: https://underonesix.cfd/?u=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:15e2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a05826090ec74ff3f28479211fd28065237aa75fb9c7ba2bb320c731a5e45f70

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/

Response headers

x-cache-status
MISS
cache-control
public, max-age=43200
content-encoding
gzip
cf-cache-status
HIT
etag
W/"1652-1712018860000"
age
24522
cf-ray
8c8b5522cb7f08cc-LAX
expires
Thu, 26 Sep 2024 01:24:06 GMT
date
Wed, 25 Sep 2024 13:24:06 GMT
content-type
application/javascript
last-modified
Tue, 02 Apr 2024 00:47:40 GMT
vary
Accept-Encoding
server
cloudflare
kusakli_web.png
internetsubesi.qnbfinansbank.com/Content/Images/ResponsiveLogin/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Images/ResponsiveLogin/kusakli_web.png?uid=703680717
Requested by
Host: internetsubesi.qnbfinansbank.com
URL: https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/FinansbankLoginStyle.css?20240225071508
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
20f8ed2bf854270b68617662902cf145554cd87ba4ff29d800879978bbb2d92a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/FinansbankLoginStyle.css?20240225071508

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Connection
Keep-Alive
Via
NS-CACHE-10.0: 80
Expires
Sun, 21 Sep 2025 08:36:26 GMT
Access-Control-Allow-Origin
*
Content-Length
11980
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
Date
Sat, 21 Sep 2024 08:36:26 GMT
X-XSS-Protection
1; mode=block
Content-Type
image/png
arrow.png
internetsubesi.qnbfinansbank.com/Content/Images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Images/arrow.png?uid=1513178468
Requested by
Host: internetsubesi.qnbfinansbank.com
URL: https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/FinansbankLoginStyle.css?20240225071508
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
e6d74b1fa656995627ce5e8b0839a62b0ffd54b8de7be4f2e40eae2c92b968c8
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/FinansbankLoginStyle.css?20240225071508

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Eirxpes
Thu, 25 Sep 2025 13:24:06 GMT
Access-Control-Allow-Origin
*
Cheac-Control
public
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:06 GMT
Content-Type
image/png
content-length
1095
footer-bg.jpg
internetsubesi.qnbfinansbank.com/Content/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internetsubesi.qnbfinansbank.com/Content/Images/footer-bg.jpg?uid=1513214937
Requested by
Host: internetsubesi.qnbfinansbank.com
URL: https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/loginmain.css?20240225071508
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.108.64.94 Istanbul, Turkey, ASN8831 (FINANSBANK Inkilap Mahallesi Dr. Fazil Kucuk Cad., TR),
Reverse DNS
Software
/
Resource Hash
2d3d0ffc095f087278741a02ec1348d656e1647d3ca54960d30022adfb0e9154
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Strict-Transport-Security max-age=3600
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://internetsubesi.qnbfinansbank.com/Content/Themes/LoginTheme/loginmain.css?20240225071508

Response headers

Strict-Transport-Security
max-age=3600
Content-Security-Policy
frame-ancestors https://tagmanager.google.com https://fonts.googleapis.com *.googletagmanager.com *.google-analytics.com *.googleapis.com *.facebook.net *.yandex.ru *.twitter.com *.ads-twitter.com *.googleadservices.com *.qnbfinansbank.com *.finansbank.com.tr https://*.turkiye.gov.tr https://*.qnbfi.com *.doubleclick.net *.google.com https://tagmanager.google.com
Cache-Control
max-age=31536000,public
piExres
Thu, 25 Sep 2025 13:24:06 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Access-Control-Allow-Origin
*
Cheac-Control
public
X-UA-Compatible
IE=11; IE=10; IE=9; IE=8; IE=7
X-XSS-Protection
1; mode=block
Date
Wed, 25 Sep 2024 13:24:06 GMT
Content-Type
image/jpeg
content-length
4762
favicon.ico
underonesix.cfd/ 		808 B
501 B 		Other
General
Check archive.org
Download Go to
Full URL
https://underonesix.cfd/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.215.180.48 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi2052670.contaboserver.net
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://underonesix.cfd/?u=1

Response headers

content-encoding
br
date
Wed, 25 Sep 2024 13:24:07 GMT
etag
W/"328-622cfc4fa6bfd"
content-type
text/html
last-modified
Mon, 23 Sep 2024 21:06:58 GMT
server
nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Finansbank (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| validateForm function| ss_js_sealTagStr function| ss_js_seal string| ss_ua string| ss_fqdn string| ss_size string| ss_type string| ss_lang string| ss_ver string| ss_service string| ss_protocol string| ss_jspUrl

0 Cookies

9 Console Messages

Source Level URL
Text
network error URL: https://underonesix.cfd/Content/Devices/jquery.smartbanner.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/Content/Images/loader.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://underonesix.cfd/?u=1
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://underonesix.cfd/Content/Images/content_ok.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/Content/Images/guvenlik_top.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/Content/Images/content_title_right.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/Content/Images/content_title_left.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/Content/Images/guvenlik_bottom.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://underonesix.cfd/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

globalsign.com.tr
internetsubesi.qnbfinansbank.com
seal.globalsign.com
ssif1.globalsign.com
underonesix.cfd
www.globalsign.com.tr
178.18.193.121
185.215.180.48
2606:4700::6812:15e2
62.108.64.94
005e7276b6346022d9311d6dd61a2ffd5f7b84ee14f94ce28ba569fbe6cb2c20
10f9da27e6bfc62eec468c71fa676305712bf8aeb30f024c9f4ff2c9f7aa6fcd
1a15229a29216564313b1ed4c988f3f77b788326b7983875442cdb26e84ac703
20f8ed2bf854270b68617662902cf145554cd87ba4ff29d800879978bbb2d92a
2d3d0ffc095f087278741a02ec1348d656e1647d3ca54960d30022adfb0e9154
323524115e60df7e7e094de9388e553bf8f7e87c8ef934d50ad1b99841c735e6
4e587fdbd951fad7f1f26cbcf714b6978878c3fc5c6e26a528a6fb7baf97f623
5377dcd6ee83576bc843a639a868f33cc8f8ceeb98bb2036e4ce845b692d9ff9
63488384a74463c05e4050ad8108435854659a1d8ab8eaa2535bd843b6a4c7f6
6722e1471c13f7e3365469775fe0a6c39b1df6a5b4f6dff08b4f113ab545a163
6d0e94be3cf2011227566d5a0d48888f40817562d726c209705b0dd17d9c3559
9c882904b4c57ec2761920df6798ea9cd23296151f1d6e79a0aa8805dbcae706
a05826090ec74ff3f28479211fd28065237aa75fb9c7ba2bb320c731a5e45f70
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
d37f1e136291f5aece875f6e397961df091d4dfd99c4ce1e7cbb2d8cbe68ea2d
e1bc8b5658f16ea8945a2281db1f2c95cbb5ab9256c7400987e5d9b456213c2d
e1c784b966e7cb2985fbcc42b5362987c076dfc9d347d3286ed131ea26c6dcd6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d74b1fa656995627ce5e8b0839a62b0ffd54b8de7be4f2e40eae2c92b968c8
eea379e3b3ee2dda27918c96365281b1e2bb1c82c9543912d956ce4bcb0416b1
fedf4740b9ae487ac387afe5ac91b724a7a0c9fc05680b9f024ccc37ebb7772b