udkaksaray.com Open in urlscan Pro
37.230.106.206 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://udkaksaray.com/cli/f/load3.php
Submission: On February 02 via manual (February 2nd 2021, 11:32:38 am UTC) from FI

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 37.230.106.206, located in Istanbul, Turkey and belongs to AEROTEK-AS, TR. The main domain is udkaksaray.com.

This is the only time udkaksaray.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	37.230.106.206 37.230.106.206	42807 (AEROTEK-AS) (AEROTEK-AS)
2	158.233.249.230 158.233.249.230	201271 (NORDEA-AS) (NORDEA-AS)
1	212.83.131.207 212.83.131.207	12876 (Online SAS) (Online SAS)
14	4

7 37.230.106.206 (Istanbul, Turkey)

ASN42807 (AEROTEK-AS, TR)
PTR: srvc49.turhost.com

udkaksaray.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.233.249.230 (Finland)

ASN201271 (NORDEA-AS, SE)

identify.nordea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.83.131.207 (France)

ASN12876 (Online SAS, FR)
PTR: 212-83-131-207.rev.poneytelecom.eu

www.ksposeur.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	udkaksaray.com udkaksaray.com	12 KB
2	nordea.com identify.nordea.com	73 KB
1	ksposeur.fr www.ksposeur.fr	43 KB
14	3

	Domain	Requested by
7	udkaksaray.com	udkaksaray.com
2	identify.nordea.com	udkaksaray.com identify.nordea.com
1	www.ksposeur.fr	udkaksaray.com
14	3

This site contains no links.

Subject Issuer	Validity	Valid
identify.nordea.com Entrust Certification Authority - L1M	`2020-11-20` - `2021-11-20`	a year	crt.sh
ksposeur.fr GlobalSign GCC R3 DV TLS CA 2020	`2020-09-29` - `2021-03-07`	5 months	crt.sh

This page contains 1 frames:

Primary Page: http://udkaksaray.com/cli/f/load3.php
Frame ID: AA1E7D83DD9C4B340B2BD286DCCF265B
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Page Statistics

14
Requests

21 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

128 kB
Transfer

164 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request load3.php Show response
udkaksaray.com/cli/f/ 19 KB
6 KB 153ms
139ms Document
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

17a22a2cd03c668aec223ccc21c7b99bc0d0f3d2d5ff33cc9e0ddd40a9e12a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: udkaksaray.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: Keep-Alive
X-Powered-By: PHP/7.3.23
Content-Type: text/html; charset=UTF-8
Content-Length: 5624
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Tue, 02 Feb 2021 11:32:19 GMT
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK styles-90d1ba6c2eef1d8f73fc94069cfe444b.css
identify.nordea.com/assets/ 29 KB
6 KB 171ms
42ms Stylesheet
text/css 158.233.249.230
NORDEA-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://identify.nordea.com/assets/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.233.249.230 , Finland, ASN201271 (NORDEA-AS, SE),

Reverse DNS

Software

Resource Hash

c52420b71e624dbd9e17fd88a0b97df1ba38d3c92a43592a251c0bd62fa0825c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Feb 2021 11:32:19 GMT
Content-Encoding: gzip
Referrer-Policy: origin
Last-Modified: Thu, 17 Dec 2020 05:44:40 GMT
X-Backside-Transport: OK OK,OK OK
Transfer-Encoding: chunked
Content-Type: text/css
nnCoection: close
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-Global-Transaction-ID: 19aea26360193843179cd755
Vary: Accept-Encoding, User-Agent
X-Content-Type-Options: nosniff

GET
H/1.1 404
Not Found service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 522ms
521ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 200
OK loading_lg.gif
www.ksposeur.fr/img/ 43 KB
43 KB 232ms
120ms Image
image/gif 212.83.131.207
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ksposeur.fr/img/loading_lg.gif
Requested by: Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 212.83.131.207 , France, ASN12876 (Online SAS, FR),
Reverse DNS: 212-83-131-207.rev.poneytelecom.eu
Software: Microsoft-IIS/8.5 /
Resource Hash: 0330efb05c0ae1eb7e37b6c1282022fbb7a78b883fb700a9b6b8f604732f99e8

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Feb 2021 11:32:16 GMT
Last-Modified: Tue, 15 Sep 2020 08:53:32 GMT
Server: Microsoft-IIS/8.5
Accept-Ranges: bytes
ETag: "d0cbeb03d8bd61:0"
Content-Length: 44124
Content-Type: image/gif

GET
H/1.1 404
Not Found technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 621ms
607ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 404
Not Found something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 522ms
508ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 404
Not Found cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 520ms
506ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 404
Not Found no-connection-83f79e2367a313b468986e12a237c346.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 618ms
604ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/no-connection-83f79e2367a313b468986e12a237c346.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 404
Not Found empty-3857ebe69f653487f8c9d99adde4657f.svg
udkaksaray.com/assets/images/ 1000 B
1000 B 521ms
507ms Image
text/html 37.230.106.206
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://udkaksaray.com/assets/images/empty-3857ebe69f653487f8c9d99adde4657f.svg

Requested by

Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/load3.php

Protocol

HTTP/1.1

Server

37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),

Reverse DNS

srvc49.turhost.com

Software

/ PHP/7.3.23

Resource Hash

81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://udkaksaray.com/cli/f/load3.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Feb 2021 11:32:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.3.23
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 531

GET
H/1.1 200
OK 564d0ff0f3578b7128a458ef269b286a.jpg
identify.nordea.com/assets/ 67 KB
67 KB 42ms
41ms Image
image/jpeg 158.233.249.230
NORDEA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://identify.nordea.com/assets/564d0ff0f3578b7128a458ef269b286a.jpg

Requested by

Host: identify.nordea.com
URL: https://identify.nordea.com/assets/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.233.249.230 , Finland, ASN201271 (NORDEA-AS, SE),

Reverse DNS

Software

Resource Hash

836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://identify.nordea.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Feb 2021 11:32:19 GMT
Content-Encoding: gzip
Referrer-Policy: origin
Last-Modified: Thu, 17 Dec 2020 05:43:11 GMT
X-Backside-Transport: OK OK,OK OK
Transfer-Encoding: chunked
Content-Type: image/jpeg
nnCoection: close
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-Global-Transaction-ID: 19aea2636019384326be656b
X-Content-Type-Options: nosniff

GET c233a817ad142919d728ebf4c8b3d54c.woff2
identify.nordea.com/assets/ 0
0

GET 7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2
identify.nordea.com/assets/ 0
0

GET e18bb962ed5dc6adc929833b78251735.woff
identify.nordea.com/assets/ 0
0

GET 8303da27eb3496a604f280ca8f3b4388.woff
identify.nordea.com/assets/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: identify.nordea.com
URL: https://identify.nordea.com/assets/c233a817ad142919d728ebf4c8b3d54c.woff2

Domain: identify.nordea.com
URL: https://identify.nordea.com/assets/7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2

Domain: identify.nordea.com
URL: https://identify.nordea.com/assets/e18bb962ed5dc6adc929833b78251735.woff

Domain: identify.nordea.com
URL: https://identify.nordea.com/assets/8303da27eb3496a604f280ca8f3b4388.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			udkaksaray.com/	1969-12-31 23:59:59	Name: d9d2d2597b03978892fdb29ba1ee1650 Value: 5f7795e82bc23687f55f8a6b269fe181

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

identify.nordea.com
udkaksaray.com
www.ksposeur.fr
identify.nordea.com
158.233.249.230
212.83.131.207
37.230.106.206
0330efb05c0ae1eb7e37b6c1282022fbb7a78b883fb700a9b6b8f604732f99e8
17a22a2cd03c668aec223ccc21c7b99bc0d0f3d2d5ff33cc9e0ddd40a9e12a4d
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
c52420b71e624dbd9e17fd88a0b97df1ba38d3c92a43592a251c0bd62fa0825c

udkaksaray.com Open in urlscan Pro 37.230.106.206 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

21 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

128 kBTransfer

164 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

udkaksaray.com Open in urlscan Pro
37.230.106.206 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

21 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

128 kB
Transfer

164 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!