fermuarhastanesi.com Open in urlscan Pro
194.31.64.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://alezenismakineleri.com/lnt
Effective URL:
https://fermuarhastanesi.com/web/intesaxtrot/
Submission Tags: phishing malicious Search All
Submission: On March 14 via api (March 14th 2024, 3:44:41 pm UTC) from NL — Scanned from NL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 194.31.64.1, located in Turkey and belongs to SFCTEK www.sfctek.com.tr, TR. The main domain is fermuarhastanesi.com.
TLS certificate: Issued by R3 on February 26th 2024. Valid for: 3 months.

This is the only time fermuarhastanesi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3036::6815:3ad5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3037::ac43:cfb6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	194.31.64.1 194.31.64.1	212598 (SFCTEK ww...) (SFCTEK www.sfctek.com.tr)
13	2

2 2606:4700:3036::6815:3ad5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

alezenismakineleri.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:cfb6 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

alezenismakineleri.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 194.31.64.1 (Turkey)

ASN212598 (SFCTEK www.sfctek.com.tr, TR)
PTR: sunucu.al

fermuarhastanesi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	fermuarhastanesi.com fermuarhastanesi.com	499 KB
3	alezenismakineleri.com 2 redirects alezenismakineleri.com	2 KB
13	2

	Domain	Requested by
12	fermuarhastanesi.com	fermuarhastanesi.com
3	alezenismakineleri.com	2 redirects
13	2

This site contains no links.

Subject Issuer	Validity	Valid
alezenismakineleri.com GTS CA 1P5	`2024-01-16` - `2024-04-15`	3 months	crt.sh
fermuarhastanesi.com R3	`2024-02-26` - `2024-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fermuarhastanesi.com/web/intesaxtrot/
Frame ID: 3957405A4A6BF0E23D68D4CE1D48A443
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

i8ntesaxtr

Page URL History Show full URLs

https://alezenismakineleri.com/lnt HTTP 301
http://alezenismakineleri.com/lnt/ HTTP 301
https://alezenismakineleri.com/lnt/ Page URL
https://fermuarhastanesi.com/web/intesaxtrot/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

499 kB
Transfer

783 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://alezenismakineleri.com/lnt HTTP 301
http://alezenismakineleri.com/lnt/ HTTP 301
https://alezenismakineleri.com/lnt/ Page URL
https://fermuarhastanesi.com/web/intesaxtrot/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://alezenismakineleri.com/lnt HTTP 301
http://alezenismakineleri.com/lnt/ HTTP 301
https://alezenismakineleri.com/lnt/

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response alezenismakineleri.com/lnt/ Redirect Chain https://alezenismakineleri.com/lnt http://alezenismakineleri.com/lnt/ https://alezenismakineleri.com/lnt/	309 B 537 B	80ms 80ms	Document text/html	2606:4700:3036::6815:3ad5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alezenismakineleri.com/lnt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:3ad5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d6c4e6f17dbf3ce5aec78d93619486b6aeeba78051532e089d2892478413f83c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 864562cb6ee10bab-AMS content-encoding br content-type text/html date Thu, 14 Mar 2024 15:44:35 GMT last-modified Wed, 13 Mar 2024 16:08:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ItPcs9MZx4hpr1cQEI1rJHKDX%2FytMdENsnNoiyPGum13jmPNt96FZGGf62XSWQNgMFTK4V%2BZRCmsTnoplzmAEnN20N0jQysrfJAIEHZJrs9BkHJt7H%2BJIWpmBNwMHIICqwIorvFBhvvVxk14%2Bho5dw%2Fkzvd6"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent Redirect headers CF-Cache-Status DYNAMIC CF-RAY 864562c9be99b90f-AMS Connection keep-alive Content-Type text/html; charset=iso-8859-1 Date Thu, 14 Mar 2024 15:44:35 GMT Location https://alezenismakineleri.com/lnt/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ODwOVtItmmVaBqNC0XtV8xSfmO6Y%2Bs5e8z33qcLfPD%2BmSCYsKv1Yt5%2B5dZkv1VPX2hXZnm2W8XI57fsHbZLnKW8Nq3pZLw8UyyZ%2Fghq%2Bw5yPI3qsrY%2FW7qTeLQo93s51MZH4Y48zi7s02l2sfr%2B7VLaZEnS%2F"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked alt-svc h3=":443"; ma=86400
GET H2	200	Primary Request / Show response fermuarhastanesi.com/web/intesaxtrot/	8 KB 3 KB	256ms 66ms	Document text/html	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `0f0d96a3792601d4eb37daa99e309acda41b7352a524b8dbdc8d67ce7c8e386d` Request headers Referer https://alezenismakineleri.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 2726 content-type text/html date Thu, 14 Mar 2024 15:44:44 GMT etag "208f-5f91a1d15ff00-gzip" last-modified Wed, 12 Apr 2023 02:10:36 GMT server Apache/2 vary Accept-Encoding,User-Agent
GET H2	200	bootstrap.min.css fermuarhastanesi.com/web/intesaxtrot/assets/bootstrap/css/	190 KB 27 KB	273ms 272ms	Stylesheet text/css	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/bootstrap/css/bootstrap.min.css Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `600b588354f9e17a356c8beb56a909eeb070ec2502ca2b0bc4abd4d44631848f` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "2f928-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 27477
GET H2	200	fontawesome-all.min.css fermuarhastanesi.com/web/intesaxtrot/assets/fonts/	56 KB 12 KB	333ms 333ms	Stylesheet text/css	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/fontawesome-all.min.css Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `19bc4712bca32db280000f294e2d0c1dc178063a9dd4278fc22d30a39c068846` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "df26-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 12402
GET H2	200	typicons.min.css fermuarhastanesi.com/web/intesaxtrot/assets/fonts/	15 KB 3 KB	273ms 273ms	Stylesheet text/css	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/typicons.min.css Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "3a89-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 2623
GET H2	200	Login-Form-Basic-icons.css fermuarhastanesi.com/web/intesaxtrot/assets/css/	967 B 362 B	274ms 273ms	Stylesheet text/css	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/css/Login-Form-Basic-icons.css Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `e70b03eec37d9c4ba1bcdac4af99a47e0281860c88f015c2902e0b0949445b27` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "3c7-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 310
GET H2	200	styles.css fermuarhastanesi.com/web/intesaxtrot/assets/css/	4 KB 1 KB	274ms 273ms	Stylesheet text/css	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/css/styles.css Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `9a8c072ba27f8b94b08fe3c724b11e97bd5ae2cbd0a19b4494ef317257856302` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "1159-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 1129
GET H2	200	bQByclAxJygF.png fermuarhastanesi.com/web/intesaxtrot/assets/img/	5 KB 5 KB	274ms 274ms	Image image/png	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Show image Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/img/bQByclAxJygF.png Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 accept-ranges bytes etag "146d-5f91c72531000" content-length 5229 content-type image/png
GET H2	200	gpJ5EIhqemq9.png fermuarhastanesi.com/web/intesaxtrot/assets/img/	2 KB 2 KB	277ms 277ms	Image image/png	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Show image Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/img/gpJ5EIhqemq9.png Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `af48163da7ed2b30cde51f80f1000ea670cedfe33ae6c9fbbb020c3e90da9727` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 accept-ranges bytes etag "947-5f91c72531000" content-length 2375 content-type image/png
GET H2	200	bootstrap.min.js Show response fermuarhastanesi.com/web/intesaxtrot/assets/bootstrap/js/	78 KB 23 KB	327ms 327ms	Script application/javascript	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/bootstrap/js/bootstrap.min.js Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `0ff3cadb509482ccb23bb600c5c01eb721877a5cd7187d96c8b0af2135c29ca7` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "139f4-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type application/javascript accept-ranges bytes content-length 23275
GET H2	200	Home-Computer-Business.jpg fermuarhastanesi.com/web/intesaxtrot/assets/img/	290 KB 290 KB	63ms 63ms	Image image/jpeg	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Show image Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/img/Home-Computer-Business.jpg Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `9cef654d6ddef27c675f61e68b6e3ff66e78e12bb7f42580c9cbb0427d1f4107` Request headers accept-language nl-NL,nl;q=0.9 Referer https://fermuarhastanesi.com/web/intesaxtrot/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 accept-ranges bytes etag "48673-5f91c72531000" content-length 296563 content-type image/jpeg
GET H2	200	fa-solid-900.woff2 fermuarhastanesi.com/web/intesaxtrot/assets/fonts/	74 KB 74 KB	312ms 311ms	Font application/octet-stream	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/fa-solid-900.woff2 Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/fontawesome-all.min.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4` Request headers Referer https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/fontawesome-all.min.css Origin https://fermuarhastanesi.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 accept-ranges bytes etag "12934-5f91c72531000-gzip" vary Accept-Encoding,User-Agent
GET H2	200	typicons.woff fermuarhastanesi.com/web/intesaxtrot/assets/fonts/	58 KB 58 KB	369ms 369ms	Font application/x-font-woff	194.31.64.1 SFCTEK www.sfctek...
General Check archive.org Show headers Download Go to Full URL https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/typicons.woff Requested by Host: fermuarhastanesi.com URL: https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/typicons.min.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.31.64.1 , Turkey, ASN212598 (SFCTEK www.sfctek.com.tr, TR), Reverse DNS sunucu.al Software Apache/2 / Resource Hash `c2430aad2b6a33948dc064cfaee8ad65ff9e3ca439834f3aaa84abec3d10dea8` Request headers Referer https://fermuarhastanesi.com/web/intesaxtrot/assets/fonts/typicons.min.css Origin https://fermuarhastanesi.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Thu, 14 Mar 2024 15:44:44 GMT content-encoding gzip last-modified Wed, 12 Apr 2023 04:57:36 GMT server Apache/2 etag "e9e0-5f91c72531000-gzip" vary Accept-Encoding,User-Agent content-type application/x-font-woff accept-ranges bytes content-length 59506

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alezenismakineleri.com
fermuarhastanesi.com
194.31.64.1
2606:4700:3036::6815:3ad5
2606:4700:3037::ac43:cfb6
0f0d96a3792601d4eb37daa99e309acda41b7352a524b8dbdc8d67ce7c8e386d
0ff3cadb509482ccb23bb600c5c01eb721877a5cd7187d96c8b0af2135c29ca7
19bc4712bca32db280000f294e2d0c1dc178063a9dd4278fc22d30a39c068846
559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8
600b588354f9e17a356c8beb56a909eeb070ec2502ca2b0bc4abd4d44631848f
787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200
9a8c072ba27f8b94b08fe3c724b11e97bd5ae2cbd0a19b4494ef317257856302
9cef654d6ddef27c675f61e68b6e3ff66e78e12bb7f42580c9cbb0427d1f4107
af48163da7ed2b30cde51f80f1000ea670cedfe33ae6c9fbbb020c3e90da9727
c2430aad2b6a33948dc064cfaee8ad65ff9e3ca439834f3aaa84abec3d10dea8
d6c4e6f17dbf3ce5aec78d93619486b6aeeba78051532e089d2892478413f83c
e70b03eec37d9c4ba1bcdac4af99a47e0281860c88f015c2902e0b0949445b27

fermuarhastanesi.com Open in urlscan Pro 194.31.64.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

499 kBTransfer

783 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

fermuarhastanesi.com Open in urlscan Pro
194.31.64.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

499 kB
Transfer

783 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!