![](/screenshots/3751afea-3889-4310-b955-8516c8f11226.png)
duyurubnscgiris.com
Open in
urlscan Pro
172.67.150.57
Malicious Activity!
Public Scan
Effective URL: https://duyurubnscgiris.com/
Submission Tags: @ecarlesi threat phishing binance Search All
Submission: On July 04 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by WE1 on July 3rd 2024. Valid for: 3 months.
This is the only time duyurubnscgiris.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Binance (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 172.67.150.57 172.67.150.57 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
duyurubnscgiris.com
duyurubnscgiris.com |
257 KB |
14 | 1 |
Domain | Requested by | |
---|---|---|
14 | duyurubnscgiris.com |
duyurubnscgiris.com
|
14 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
duyurubnscgiris.com WE1 |
2024-07-03 - 2024-10-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://duyurubnscgiris.com/
Frame ID: EFDB7804CB3459B0F7F176B9B4712A77
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/3751afea-3889-4310-b955-8516c8f11226.png)
Page Title
Bitcoin Exchange | Cryptocurrency Exchange | BinancePage URL History Show full URLs
-
http://duyurubnscgiris.com/
HTTP 307
https://duyurubnscgiris.com/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://duyurubnscgiris.com/
HTTP 307
https://duyurubnscgiris.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
duyurubnscgiris.com/ Redirect Chain
|
21 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
duyurubnscgiris.com/dist/ |
197 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logogoogle.png
duyurubnscgiris.com/dist/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ios-dark.svg
duyurubnscgiris.com/dist/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
binance-logo.png
duyurubnscgiris.com/dist/ |
618 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bnqr.png
duyurubnscgiris.com/dist/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
scan-device-light.svg
duyurubnscgiris.com/dist/ |
38 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
duyurubnscgiris.com/dist/ |
100 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
fakesocket.php
duyurubnscgiris.com/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
BinancePlex-Regular.woff2
duyurubnscgiris.com/dist/ |
59 KB 60 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
BinancePlex-Medium.woff2
duyurubnscgiris.com/dist/ |
63 KB 64 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
BinancePlex-SemiBold.woff2
duyurubnscgiris.com/dist/ |
64 KB 64 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
brand.png
duyurubnscgiris.com/dist/ |
4 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
fakesocket.php
duyurubnscgiris.com/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Binance (Crypto Exchange)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| _0x601d9d function| _0xe6e9ee function| _0x7a7dc object| visitors function| ast_excute function| _0xd83e function| _0x9ega function| _0xd2496f function| _0x2558b function| _0xb5139d function| _0x1g4ee function| _0xab34bb function| _0x1cf function| _0x572e4a function| _0xd719e1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
duyurubnscgiris.com/ | Name: PHPSESSID Value: u359r6a28k2hkurs94jov3rpcr |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
duyurubnscgiris.com
172.67.150.57
09b0a09485a3616fbef018847ea9665914d8e8a3835ca91733012d4ce1b4aa65
3283811faaaf60c51baa07acf6156fec5475910b9b167ee81a9b9667b172a290
3da9ee1c30c2a461b9783ae3ca2646da3b3de5da432e45d4ca14ebc0b5981db2
774f97c9687c03c187b227a2cc5e0a26700d18c5d9624ea5d995154c8b117db7
83eef421c3682a87d0a7107f6872a1e36222cb1623ade9211b817ee2dfc0059b
ab55edbaaef0358cc623836d1522fa0f4a1b164e5ad876122bfde83372754d1d
bc23cc86744e8baf49afbbd44c4d4a0adad1e31cc3478bdc150a1a61d3fc3c78
e3d40db99105ff6d19854c303de2525f94659f7ac2fa9fe018b61fabbef0d4af
e7412f204aa573c993bec8856dda3e640f365ac0b3f232981c460df0b736738f
f0c89db40383201da8f854e27909a3809aadfe0ce107bea29eb86e6135791947
fb333dfc868c8c5af243500d6f727f8ed0005110e6bfef678b09854d467d8006
ff8ea7e65cfd39328818560a487314250942bf5c81fed6db50d50a3fbce08c51