finanssifirfaizle.online Open in urlscan Pro
94.156.105.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://finanssifirfaizle.online/
Effective URL:
https://finanssifirfaizle.online/
Submission: On December 26 via api (December 26th 2024, 6:02:26 pm UTC) from TR — Scanned from NZ

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 94.156.105.78, located in Dospat, Bulgaria and belongs to CHEAPY-HOST, US. The main domain is finanssifirfaizle.online.
TLS certificate: Issued by R10 on December 26th 2024. Valid for: 3 months.

This is the only time finanssifirfaizle.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ziraat Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
16	94.156.105.78 94.156.105.78	401120 (CHEAPY-HOST) (CHEAPY-HOST)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
17	2

16 94.156.105.78 (Dospat, Bulgaria)

ASN401120 (CHEAPY-HOST, US)

finanssifirfaizle.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	finanssifirfaizle.online finanssifirfaizle.online	407 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 847	31 KB
17	2

	Domain	Requested by
16	finanssifirfaizle.online	finanssifirfaizle.online code.jquery.com
1	code.jquery.com	finanssifirfaizle.online
17	2

This site contains no links.

Subject Issuer	Validity	Valid
finanssifirfaizle.online R10	`2024-12-26` - `2025-03-26`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://finanssifirfaizle.online/
Frame ID: 8F58F6672C5087C4B365D5832E1472E6
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hoş Geldiniz | Ziraat Bankası İnternet Bankacılığı

Page URL History Show full URLs

http://finanssifirfaizle.online/ HTTP 307
https://finanssifirfaizle.online/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

438 kB
Transfer

1422 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://finanssifirfaizle.online/ HTTP 307
https://finanssifirfaizle.online/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response finanssifirfaizle.online/ Redirect Chain http://finanssifirfaizle.online/ https://finanssifirfaizle.online/	171 KB 20 KB	2997ms 469ms	Document text/html	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PHP/8.2.26 PleskLin Resource Hash `0bbdb5e9a60935f82903d27b0f1c817b793790b3105333e754ea1d3dc9ae7c2f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 20606 content-type text/html; charset=UTF-8 date Thu, 26 Dec 2024 18:02:19 GMT server nginx vary Accept-Encoding x-powered-by PHP/8.2.26 PleskLin Redirect headers Location https://finanssifirfaizle.online/ Non-Authoritative-Reason HttpsUpgrades
GET H2	200	plugins.min.css finanssifirfaizle.online/Content/assets/bundle/css/	341 KB 48 KB	461ms 460ms	Stylesheet text/css	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/bundle/css/plugins.min.css Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `ee81740f6cc74f3e18b1a459058b371b76febbc1ae8b6365783f17a046212719` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers content-encoding br date Thu, 26 Dec 2024 18:02:19 GMT etag W/"66070c08-555ae" content-type text/css last-modified Fri, 29 Mar 2024 18:44:24 GMT server nginx x-powered-by PleskLin
GET H2	200	sub.min.css finanssifirfaizle.online/Content/assets/bundle/css/	541 KB 59 KB	924ms 924ms	Stylesheet text/css	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `50b033e053c9707c86314ed31c05d31fd1768ede279d4b676de687d6b19ca122` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers content-encoding br date Thu, 26 Dec 2024 18:02:19 GMT etag W/"66204a52-8753c" content-type text/css last-modified Wed, 17 Apr 2024 22:16:50 GMT server nginx x-powered-by PleskLin
GET H2	200	jquery-3.6.4.min.js Show response code.jquery.com/	88 KB 31 KB	203ms 37ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.4.min.js Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Referer https://finanssifirfaizle.online/ Response headers content-encoding gzip etag W/"28feccc0-15ec3" age 2684437 x-cache HIT, HIT date Thu, 26 Dec 2024 18:02:19 GMT content-type application/javascript; charset=utf-8 last-modified Fri, 18 Oct 1991 12:00:00 GMT x-cache-hits 53513, 16063 x-served-by cache-lga21953-LGA, cache-akl10332-AKL vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=604800 x-timer S1735236140.834256,VS0,VE0 cross-origin-resource-policy cross-origin via 1.1 varnish, 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 31011 server nginx
GET H2	200	phone.png finanssifirfaizle.online/Content/assets/img/	8 KB 8 KB	1366ms 1365ms	Image image/png	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Show image Full URL https://finanssifirfaizle.online/Content/assets/img/phone.png Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `ecd0bd452254e541bd3e0f90384daf729c71bac57dcd6506ce531b82e91a6077` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers etag "66070c94-20ba" accept-ranges bytes content-length 8378 date Thu, 26 Dec 2024 18:02:19 GMT content-type image/png last-modified Fri, 29 Mar 2024 18:46:44 GMT server nginx x-powered-by PleskLin
GET H2	200	phone.png finanssifirfaizle.online/Content/assets/img/login/	10 KB 10 KB	1366ms 1365ms	Image image/png	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Show image Full URL https://finanssifirfaizle.online/Content/assets/img/login/phone.png Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `75e159dc563cef2d81dfc676edd0562791341ffc58e8fb9d377011d4fe0977ae` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers etag "66070c82-2637" accept-ranges bytes content-length 9783 date Thu, 26 Dec 2024 18:02:19 GMT content-type image/png last-modified Fri, 29 Mar 2024 18:46:26 GMT server nginx x-powered-by PleskLin
GET H2	200	comodo-logo.png finanssifirfaizle.online/Content/assets/img/	6 KB 6 KB	1367ms 1366ms	Image image/png	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Show image Full URL https://finanssifirfaizle.online/Content/assets/img/comodo-logo.png Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `7bd1ce5e91f7fa685fe3ec37c7f79c27a49f3ae067afce596fa46bb5b2d90d89` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers etag "66070c8a-1897" accept-ranges bytes content-length 6295 date Thu, 26 Dec 2024 18:02:19 GMT content-type image/png last-modified Fri, 29 Mar 2024 18:46:34 GMT server nginx x-powered-by PleskLin
GET H2	200	script.js Show response finanssifirfaizle.online/client-side/	4 KB 1 KB	1366ms 1366ms	Script application/javascript	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/client-side/script.js Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `48fe486c966f67eb339455520669739be9ba20981a01e2589b50a4e38bbda816` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers content-encoding br date Thu, 26 Dec 2024 18:02:19 GMT etag W/"6627b4ea-105a" content-type application/javascript last-modified Tue, 23 Apr 2024 13:17:30 GMT server nginx x-powered-by PleskLin
GET H2	200	login-bg.jpg finanssifirfaizle.online/Content/assets/img/	104 KB 104 KB	463ms 462ms	Image image/jpeg	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Show image Full URL https://finanssifirfaizle.online/Content/assets/img/login-bg.jpg?v=20181004 Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `b055c452bbb3790a25caef40ba7e75a53f148ad46260c00719b5bd7b6ee90d82` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Response headers etag "66070c8e-1a0dd" accept-ranges bytes content-length 106717 date Thu, 26 Dec 2024 18:02:21 GMT content-type image/jpeg last-modified Fri, 29 Mar 2024 18:46:38 GMT server nginx x-powered-by PleskLin
GET H2	200	BB78E1BCF28E9E4CC.woff2 finanssifirfaizle.online/Content/assets/css/webfonts/new/	13 KB 13 KB	865ms 864ms	Font font/woff2	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/css/webfonts/new/BB78E1BCF28E9E4CC.woff2 Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `2f9071e4de731c949bee363cc182a5b88e61caa7cffbfd3ccf7321ca11327544` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://finanssifirfaizle.online Referer https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Response headers etag "66070c54-349c" accept-ranges bytes content-length 13468 date Thu, 26 Dec 2024 18:02:21 GMT content-type font/woff2 last-modified Fri, 29 Mar 2024 18:45:40 GMT server nginx x-powered-by PleskLin
GET H2	200	icomoon.woff2 finanssifirfaizle.online/Content/assets/css/fonts/	98 KB 98 KB	464ms 464ms	Font font/woff2	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/css/fonts/icomoon.woff2 Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `4eb0a95d46a2a21d2a033af489807a56e8669c172839474ed2ab8865ee40994f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://finanssifirfaizle.online Referer https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Response headers etag "66070c30-186a0" accept-ranges bytes content-length 100000 date Thu, 26 Dec 2024 18:02:21 GMT content-type font/woff2 last-modified Fri, 29 Mar 2024 18:45:04 GMT server nginx x-powered-by PleskLin
GET H2	200	D40DF048D299CA4DD.woff2 finanssifirfaizle.online/Content/assets/css/webfonts/new/	13 KB 13 KB	865ms 864ms	Font font/woff2	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/css/webfonts/new/D40DF048D299CA4DD.woff2 Requested by Host: finanssifirfaizle.online URL: https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `87066901222869bbc18ab6d6620daa3aeac78dad94f88233f14ff68bae4cb472` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://finanssifirfaizle.online Referer https://finanssifirfaizle.online/Content/assets/bundle/css/sub.min.css Response headers etag "66070c58-34a4" accept-ranges bytes content-length 13476 date Thu, 26 Dec 2024 18:02:21 GMT content-type font/woff2 last-modified Fri, 29 Mar 2024 18:45:44 GMT server nginx x-powered-by PleskLin
POST H2	500	process.php Show response finanssifirfaizle.online/	0 209 B	861ms 858ms	XHR text/html	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/process.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.4.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PHP/8.2.26 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://finanssifirfaizle.online/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept / Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers cache-control no-store, no-cache, must-revalidate pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 0 date Thu, 26 Dec 2024 18:02:21 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/8.2.26 server nginx
GET H2	200	touch_icon.png finanssifirfaizle.online/Content/assets/img/	24 KB 24 KB	439ms 439ms	Other image/png	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/Content/assets/img/touch_icon.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PleskLin Resource Hash `3f57f2ca6d11bb33c055ec016ce0b3c7816097de2bdbdca444b11f0ba90bf166` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://finanssifirfaizle.online/ Response headers etag "660ab454-6066" accept-ranges bytes content-length 24678 date Thu, 26 Dec 2024 18:02:22 GMT content-type image/png last-modified Mon, 01 Apr 2024 13:19:16 GMT server nginx x-powered-by PleskLin
POST H2	200	process.php Show response finanssifirfaizle.online/	0 182 B	415ms 413ms	XHR text/html	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/process.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.4.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PHP/8.2.26, PleskLin Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://finanssifirfaizle.online/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept / Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers cache-control no-store, no-cache, must-revalidate pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 0 date Thu, 26 Dec 2024 18:02:24 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/8.2.26, PleskLin server nginx
POST H2	500	process.php Show response finanssifirfaizle.online/	0 164 B	422ms 413ms	XHR text/html	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/process.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.4.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PHP/8.2.26 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://finanssifirfaizle.online/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept / Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers cache-control no-store, no-cache, must-revalidate pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 0 date Thu, 26 Dec 2024 18:02:24 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/8.2.26 server nginx
POST H2	200	status.php Show response finanssifirfaizle.online/	7 B 254 B	456ms 456ms	XHR text/html	94.156.105.78 CHEAPY-HOST
General Check archive.org Show headers Download Go to Full URL https://finanssifirfaizle.online/status.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.4.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.156.105.78 Dospat, Bulgaria, ASN401120 (CHEAPY-HOST, US), Reverse DNS Software nginx / PHP/8.2.26, PleskLin Resource Hash `8e2c7ac508139a02af859de64a4743c1f3946837279332c35ec8f5ddf20654ae` Request headers Referer https://finanssifirfaizle.online/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept / Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 27 date Thu, 26 Dec 2024 18:02:24 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/8.2.26, PleskLin server nginx vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ziraat Bank (Banking)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			finanssifirfaizle.online/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8cvr7j1tvjl04p9388b1n6kjpr

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://finanssifirfaizle.online/(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://finanssifirfaizle.online/(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://finanssifirfaizle.online/process.php Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://finanssifirfaizle.online/process.php Message: Failed to load resource: the server responded with a status of 500 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
finanssifirfaizle.online
2a04:4e42:200::649
94.156.105.78
0bbdb5e9a60935f82903d27b0f1c817b793790b3105333e754ea1d3dc9ae7c2f
2f9071e4de731c949bee363cc182a5b88e61caa7cffbfd3ccf7321ca11327544
3f57f2ca6d11bb33c055ec016ce0b3c7816097de2bdbdca444b11f0ba90bf166
48fe486c966f67eb339455520669739be9ba20981a01e2589b50a4e38bbda816
4eb0a95d46a2a21d2a033af489807a56e8669c172839474ed2ab8865ee40994f
50b033e053c9707c86314ed31c05d31fd1768ede279d4b676de687d6b19ca122
75e159dc563cef2d81dfc676edd0562791341ffc58e8fb9d377011d4fe0977ae
7bd1ce5e91f7fa685fe3ec37c7f79c27a49f3ae067afce596fa46bb5b2d90d89
87066901222869bbc18ab6d6620daa3aeac78dad94f88233f14ff68bae4cb472
8e2c7ac508139a02af859de64a4743c1f3946837279332c35ec8f5ddf20654ae
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b055c452bbb3790a25caef40ba7e75a53f148ad46260c00719b5bd7b6ee90d82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecd0bd452254e541bd3e0f90384daf729c71bac57dcd6506ce531b82e91a6077
ee81740f6cc74f3e18b1a459058b371b76febbc1ae8b6365783f17a046212719

finanssifirfaizle.online Open in urlscan Pro 94.156.105.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

438 kBTransfer

1422 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

finanssifirfaizle.online Open in urlscan Pro
94.156.105.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

438 kB
Transfer

1422 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!