![](/screenshots/3735fc29-12c8-429d-a3f9-43c9137cd836.png)
ziraatgroup.online
Open in
urlscan Pro
185.224.138.63
Malicious Activity!
Public Scan
Submission: On October 31 via manual from TR
Summary
This is the only time ziraatgroup.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ziraat Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
19 | 185.224.138.63 185.224.138.63 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
19 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
ziraatgroup.online
ziraatgroup.online |
1011 KB |
19 | 1 |
Domain | Requested by | |
---|---|---|
19 | ziraatgroup.online |
ziraatgroup.online
|
19 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ziraatbank.com.tr |
bireysel.ziraatbank.com.tr |
kurumsal.ziraatbank.com.tr |
www.evinziraatten.com.tr |
www.facebook.com |
twitter.com |
instagram.com |
www.youtube.com |
plus.google.com |
www.linkedin.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://ziraatgroup.online/
Frame ID: EBFCDD78B6F29083E67F53980E07E308
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/3735fc29-12c8-429d-a3f9-43c9137cd836.png)
Detected technologies
![](/vendor/wappa/icons/WindowsServer.png)
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
![](/vendor/wappa/icons/Microsoft ASP.NET.png)
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Detected patterns
- headers server /^LiteSpeed$/i
![](/vendor/wappa/icons/IIS.png)
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
![](/vendor/wappa/icons/Yandex.Metrika.png)
Detected patterns
- script /mc\.yandex\.ru\/metrika\/watch\.js/i
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: POS Services
Search URL Search Domain Scan URL
Title: PERSONAL(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: CORPORATE(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Evin Ziraat'ten(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Facebook(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Twitter(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Instagram(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Youtube(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Google Plus(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Linkedin(This page will be opened in new tab)
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ziraatgroup.online/ |
42 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
magiclick.minebb0.css
ziraatgroup.online/SiteAssets/css/min/ |
502 KB 65 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.minb055.js
ziraatgroup.online/SiteAssets/js/min/ |
94 KB 34 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
ziraatgroup.online/SiteAssets/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-bot-img.png
ziraatgroup.online/siteassets/images/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
intro-modal-2.jpg
ziraatgroup.online/SiteAssets/images/ |
14 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
magiclick.min9220.js
ziraatgroup.online/SiteAssets/js/min/ |
1 MB 360 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
homePage.min2d53.js
ziraatgroup.online/SiteAssets/js/min/ |
132 KB 37 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Book.otf
ziraatgroup.online/SiteAssets/fonts/ |
59 KB 60 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
calculator-bg.jpg
ziraatgroup.online/SiteAssets/images/ |
37 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Medium.otf
ziraatgroup.online/SiteAssets/fonts/ |
61 KB 61 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icomoon133c.html
ziraatgroup.online/SiteAssets/fonts/ |
24 KB 25 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Bold.otf
ziraatgroup.online/SiteAssets/fonts/ |
61 KB 61 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-bot-img.png
ziraatgroup.online/siteassets/images/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en-yakin-ziraat.jpg
ziraatgroup.online/SiteAssets/images/ |
232 KB 232 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FBLogin.aspx
ziraatgroup.online/en/_layouts/15/Ziraat/Social/ |
2 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
watch.js
ziraatgroup.online/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js
ziraatgroup.online/www.google-analytics.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
GetSessionID
ziraatgroup.online/en/_layouts/15/Ziraat/Chatbot/Ajax.aspx/ |
2 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ziraat Bank (Banking)133 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| RegisterSod function| removeAllStatus function| RegisterSodDep function| AttachEvent function| UpdateFormDigest function| GetUrlFromWebUrlAndWebRelativeUrl object| _spBodyOnLoadFunctionNames object| WPSC object| g_updateFormDigestPageLoaded object| _spPageContextInfo string| langUrl string| webRelURL number| digestRefreshInterval function| $ function| jQuery object| theForm function| __doPostBack string| MSOWebPartPageFormName function| WebForm_OnSubmit function| submitHook number| vadeGunMin number| vadeGunMax object| vadeAyMax number| BaslangicTutar number| BitisTutar object| formDigestElement number| _spFormDigestRefreshInterval boolean| _fV4UI object| CryptoJS function| tryRefreshDigest object| ReturnCodes object| ieBrowser object| touchBrowser boolean| isMobile boolean| isMobileRecourse object| jsResources function| ZiraatModule object| Ziraat function| SocialUserLogined function| SocialChecked function| RefreshCaptcha function| uiBlock string| inDesignMode boolean| spMode string| siteLanguage undefined| jsName undefined| jsNameTwo object| globalPage object| socialLoginWindow object| globalSlider function| setFooter object| subPageConfig object| calculateSliderBox object| sliderMonth object| sliderPrice object| creditPrice object| creditSelect object| totalPrice object| creditRate number| vadeData object| calcPrice undefined| priceData number| userFaizOrani object| BaslangicTtr object| BitisTtr object| subPageCalculate object| stElement object| sonradanTaksitlendirme object| tnaElement object| taksitliNakitAvans object| dovizCeviriciElement object| dovizCevirici object| formPage object| formValidate function| CalcIBAN function| FormatIBAN function| PadZeroes function| GetCharCode function| GetCharTable function| calculateChecksum function| mod97 object| $selectBox function| blockChat function| unblockChat number| index string| cbSessionID string| cbKey number| cbDate boolean| secureScope object| CHAT object| MODULES undefined| _token object| createjs object| JSON3 object| jQuery1113035652103350089415 function| Inputmask object| Browser function| _ function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| ProgressBar function| lazyload function| LazyLoad object| lottie object| bodymovin object| hopscotch object| _inputboxelement object| _inputBox object| _0x9bd5 object| homePageCalculateElement undefined| uiValue object| homePageCalculate undefined| ziraatInterval undefined| piyasaInterval object| homePageConfig object| AdobeAn undefined| homeiconkredi undefined| homeiconkart undefined| homeiconsigorta undefined| homeiconemeklilik function| IScroll function| fp_offsetSectionsExtension object| yandex_metrika_callbacks string| GoogleAnalyticsObject function| ga object| data0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ziraatgroup.online
185.224.138.63
2603f6d5047b71b5e5e9fe62c5fbc47e0185f0c1618d80d5b018a20dbcd12758
277fbc0e7cab340b007addc4812b701d115ae5be9a7d03a509b2c5811727b89b
3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e
42830ddca0e588b6b7dc1a763f707af39eeefbe46404b3759b806933e58ae5f3
4fec5a4a228cb362fe06ed6239198602448f35855c3b2e823f0e68c4940df525
5a469368af3eb80b7b406805fa9103fdf1f3882230d42e5ba93401e248d465ef
6dbea73719feeeddf4eeec62e2227a246fedc4cf4b1997410ec225a73895316c
70990aca8963cfeed3b321a1ff523c782dd454579070bbe7da0935d8e228c1cb
76db5e4ab6590faf76dd3ea357976c37f58aec4ef2979312aa89d317bbbad56c
96a6bd5d7cd4d0dcd3cda64f2001ad6b5fffaf15ac37e19b00d1bcb0205d7709
9e62bbd51aa1cffa92e06b049ed6882fc94af0a6891b6de2eb1d515d2b027e2d
aa8a40c7d040c62e5d7963281173bbc700f2fd64892ee1e81af2fc7e09694c66
dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638
dcd2488d4f219c45db61e690c1efd5c58726f37ff1afb6a0af7ba07608a1256e