www.govtr.kartiadeler.tk Open in urlscan Pro
91.219.194.4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.govtr.kartiadeler.tk/
Submission: On March 20 via automatic, source certstream-suspicious (March 20th 2021, 8:09:11 am UTC)

Summary HTTP 24 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 24 HTTP transactions. The main IP is 91.219.194.4, located in Russian Federation and belongs to BEST-HOSTER, RU. The main domain is www.govtr.kartiadeler.tk.
TLS certificate: Issued by govtr.kartiadeler.tk on March 20th 2021. Valid for: a year.

This is the only time www.govtr.kartiadeler.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Turkish Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
17	91.219.194.4 91.219.194.4	49693 (BEST-HOSTER) (BEST-HOSTER)
1	2606:4700:20:... 2606:4700:20::681a:407	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.149.100.222 185.149.100.222	209853 (VERIDYEN ...) (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi)
4	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	67.202.94.93 67.202.94.93	32748 (STEADFAST) (STEADFAST)
24	6

17 91.219.194.4 (Russian Federation)

ASN49693 (BEST-HOSTER, RU)
PTR: piter4.dns-rus.net

www.govtr.kartiadeler.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:407 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.149.100.222 (Turkey)

ASN209853 (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi, TR)
PTR: lupin.veridyen.com

www.yazhocam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.93 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	kartiadeler.tk www.govtr.kartiadeler.tk	91 KB
4	gstatic.com fonts.gstatic.com	55 KB
1	amung.us whos.amung.us	145 B
1	yazhocam.com www.yazhocam.com	71 KB
1	waust.at waust.at	4 KB
24	5

	Domain	Requested by
17	www.govtr.kartiadeler.tk	www.govtr.kartiadeler.tk
4	fonts.gstatic.com	www.govtr.kartiadeler.tk
1	whos.amung.us	waust.at
1	www.yazhocam.com	www.govtr.kartiadeler.tk
1	waust.at	www.govtr.kartiadeler.tk
24	5

This site contains no links.

Subject Issuer	Validity	Valid
govtr.kartiadeler.tk govtr.kartiadeler.tk	`2021-03-20` - `2022-03-20`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-09-04` - `2021-09-04`	a year	crt.sh
*.yazhocam.com R3	`2021-03-11` - `2021-06-09`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.govtr.kartiadeler.tk/
Frame ID: 87ABC5AEE91485B448E4EA98EC623320
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

24
Requests

29 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

221 kB
Transfer

567 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.govtr.kartiadeler.tk/ 7 KB
2 KB 257ms
90ms Document
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache / PHP/5.5.38
Resource Hash: 1e2b877ea2cea5d93ba7b5d08ac4eeab8ab4e4ff0570966d7d9b736437aa7feb

Request headers

:method: GET
:authority: www.govtr.kartiadeler.tk
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
server: Apache
x-powered-by: PHP/5.5.38
vary: Accept-Encoding
content-encoding: br
content-length: 1889
content-type: text/html

GET
H2 404 bootstrap.min.css
www.govtr.kartiadeler.tk/index_files/ 0
0 89ms
86ms Stylesheet
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/bootstrap.min.css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4351
vary: Accept-Encoding
content-type: text/html

GET
H2 404 font-awesome.min.css
www.govtr.kartiadeler.tk/index_files/ 0
0 90ms
87ms Stylesheet
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/font-awesome.min.css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4354
vary: Accept-Encoding
content-type: text/html

GET
H2 404 flaticon.css
www.govtr.kartiadeler.tk/index_files/ 0
0 149ms
146ms Stylesheet
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/flaticon.css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4348
vary: Accept-Encoding
content-type: text/html

GET
H2 200 css
www.govtr.kartiadeler.tk/index_files/ 31 KB
1 KB 92ms
89ms Stylesheet
text/plain 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 608ff39d81bf3098a9db9aaea1c56c59773d04db4bdb4567500842cc9f1431cb

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
accept-ranges: bytes
content-length: 1372
vary: Accept-Encoding

GET
H2 404 style.css
www.govtr.kartiadeler.tk/index_files/ 0
0 151ms
148ms Stylesheet
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/style.css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4343
vary: Accept-Encoding
content-type: text/html

GET
H2 404 default.css
www.govtr.kartiadeler.tk/index_files/ 0
0 153ms
150ms Stylesheet
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/default.css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4342
vary: Accept-Encoding
content-type: text/html

GET
H2 200 jquery-3.2.1.min.js.indir Show response
www.govtr.kartiadeler.tk/index_files/ 85 KB
29 KB 227ms
223ms Script
application/javascript 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/jquery-3.2.1.min.js.indir
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 29530

GET
H2 200 jquery.creditCardValidator.js.indir Show response
www.govtr.kartiadeler.tk/index_files/ 8 KB
2 KB 214ms
210ms Script
application/javascript 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/jquery.creditCardValidator.js.indir
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2487

GET
H2 200 bootstrap.min(1).css
www.govtr.kartiadeler.tk/index_files/ 163 KB
19 KB 214ms
212ms Stylesheet
text/css 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/bootstrap.min(1).css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 0a0a376dc5ee222a63ee133b4ae1dc75a8655ae493139aa478d7a0dc64755a39

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 19615

GET
H2 200 font-awesome.min(1).css
www.govtr.kartiadeler.tk/index_files/ 38 KB
7 KB 159ms
157ms Stylesheet
text/css 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/font-awesome.min(1).css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 2f499490b865ea22b5a1efdeade6d8b977073b0642238b51109cd202167d173e

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6866

GET
H2 200 flaticon(1).css
www.govtr.kartiadeler.tk/index_files/ 2 KB
476 B 158ms
156ms Stylesheet
text/css 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/flaticon(1).css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: b86d0b93e4e11cf1a09e3a7efe97c0faa07a335bd100b85f2ce7655942da1894

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 437

GET
H2 200 style(1).css
www.govtr.kartiadeler.tk/index_files/ 66 KB
6 KB 208ms
206ms Stylesheet
text/css 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/style(1).css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: cb409ca7227f6ea8937b56b2c90284afe4f0596944940317b3fb7bb8444a69b2

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6131

GET
H2 200 default(1).css
www.govtr.kartiadeler.tk/index_files/ 154 B
124 B 158ms
155ms Stylesheet
text/css 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/default(1).css
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: cbb81f38ee322ed3d62af6bb700def6a6be839b1edafcb6261fc2a78ed4ffdb3

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 93

GET
H2 200 logo-2.png
www.govtr.kartiadeler.tk/index_files/ 11 KB
11 KB 157ms
156ms Image
image/png 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.govtr.kartiadeler.tk/index_files/logo-2.png
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 257461ed4d440311ffc7147309e879bc3ea33dc97c7f7cd15e17bc5ab0dd538e

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
accept-ranges: bytes
content-length: 10879
content-type: image/png

GET
H2 200 creditly.js.indir Show response
www.govtr.kartiadeler.tk/index_files/ 14 KB
3 KB 210ms
209ms Script
application/javascript 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to

Full URL: https://www.govtr.kartiadeler.tk/index_files/creditly.js.indir
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: 87f22c41dbcb26bad91fbaf973d978ab76cd68a768ad20b3a3596c9277cb113c

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
last-modified: Mon, 22 Jul 2019 20:20:16 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3047

GET
H2 200 s.js Show response
waust.at/ 8 KB
4 KB 33ms
16ms Script
application/x-javascript 2606:4700:20::681a:407
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waust.at/s.js
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:407 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 1351
cf-request-id: 08f0471b9a0000325c020f3000000001
last-modified: Tue, 23 Feb 2021 15:47:35 GMT
server: cloudflare
etag: W/"60352397-1ed7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FRMOkqKgmqhErBct4d7jlPZbYJURIkKzDlJzdd1%2F3dlZTf3%2F1mTGWrJWlfehaU1hwsqpRs9UYib6B7RC%2BrP5wql8r2yNY7GSFFD47ZWUVfk2XKyzTg%3D%3D"}],"max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 632d74728fb1325c-FRA
expires: Sun, 21 Mar 2021 07:46:19 GMT

GET
H2 200 Beyaz-Arkaplan.jpg
www.yazhocam.com/wp-content/uploads/2018/02/ 71 KB
71 KB 374ms
73ms Image
image/jpeg 185.149.100.222
VERIDYEN Veridyen...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.yazhocam.com/wp-content/uploads/2018/02/Beyaz-Arkaplan.jpg
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.149.100.222 , Turkey, ASN209853 (VERIDYEN Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi, TR),
Reverse DNS: lupin.veridyen.com
Software: /
Resource Hash: 457cac5dccdf4c67de5e139d64507819421bbb252e88951cbabddbee68267699

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
last-modified: Sat, 24 Feb 2018 16:44:58 GMT
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length: 72755
expires: Sat, 27 Mar 2021 08:08:50 GMT

GET
H2 404 bg-image.jpeg
www.govtr.kartiadeler.tk/img/ 10 KB
10 KB 83ms
83ms Image
text/html 91.219.194.4
BEST-HOSTER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.govtr.kartiadeler.tk/img/bg-image.jpeg
Requested by: Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/index_files/style(1).css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.219.194.4 , Russian Federation, ASN49693 (BEST-HOSTER, RU),
Reverse DNS: piter4.dns-rus.net
Software: Apache /
Resource Hash: e9c7167bedaaf674e1bf87ac293329469218643b816dd0e6bb4f19dd7ca10dc9

Request headers

Referer: https://www.govtr.kartiadeler.tk/index_files/style(1).css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 4344
vary: Accept-Encoding
content-type: text/html

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v16/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/index_files/css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.govtr.kartiadeler.tk
Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 18 Mar 2021 19:41:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:11:29 GMT
server: sffe
age: 131241
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Fri, 18 Mar 2022 19:41:29 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v16/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/index_files/css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.govtr.kartiadeler.tk
Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 19 Mar 2021 21:46:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:12:24 GMT
server: sffe
age: 37350
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15056
x-xss-protection: 0
expires: Sat, 19 Mar 2022 21:46:20 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v16/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/index_files/css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.govtr.kartiadeler.tk
Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 23:01:37 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:12:08 GMT
server: sffe
age: 205633
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14880
x-xss-protection: 0
expires: Thu, 17 Mar 2022 23:01:37 GMT

GET
H3-Q050 200 mem8YaGs126MiZpBA-UFW50bbck.woff2
fonts.gstatic.com/s/opensans/v16/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFW50bbck.woff2

Requested by

Host: www.govtr.kartiadeler.tk
URL: https://www.govtr.kartiadeler.tk/index_files/css

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28e9420a6d03a70b837b51c9fbe1bb1f819a3d4aa71bffa07f7c3e79d7dcf878

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.govtr.kartiadeler.tk
Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 18 Mar 2021 19:41:58 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:13:03 GMT
server: sffe
age: 131212
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11316
x-xss-protection: 0
expires: Fri, 18 Mar 2022 19:41:58 GMT

GET
H2 200 / Show response
whos.amung.us/pingjs/ 29 B
145 B 375ms
126ms Script
text/javascript 67.202.94.93
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://whos.amung.us/pingjs/?k=lxuedrx523&t=e-Devlet%20%7C%20Aidat%20%C4%B0ade%20Sistemi&c=s&x=https%3A%2F%2Fwww.govtr.kartiadeler.tk%2F&y=&a=0&d=0.556&v=27&r=6673
Requested by: Host: waust.at
URL: https://waust.at/s.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.202.94.93 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: amung.us
Software: /
Resource Hash: 73ae1e53f4a4ea084655f590e016497a36a25f419bf35fb5b71591b95d07b6f6

Request headers

Referer: https://www.govtr.kartiadeler.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 20 Mar 2021 08:08:50 GMT
content-encoding: gzip
content-type: text/javascript;charset=UTF-8

GET
DATA 200
OK truncated
/ 439 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Turkish Government (Government)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
waust.at
whos.amung.us
www.govtr.kartiadeler.tk
www.yazhocam.com
185.149.100.222
2606:4700:20::681a:407
2a00:1450:4001:800::2003
67.202.94.93
91.219.194.4
0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84
0a0a376dc5ee222a63ee133b4ae1dc75a8655ae493139aa478d7a0dc64755a39
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
1e2b877ea2cea5d93ba7b5d08ac4eeab8ab4e4ff0570966d7d9b736437aa7feb
257461ed4d440311ffc7147309e879bc3ea33dc97c7f7cd15e17bc5ab0dd538e
28e9420a6d03a70b837b51c9fbe1bb1f819a3d4aa71bffa07f7c3e79d7dcf878
2f499490b865ea22b5a1efdeade6d8b977073b0642238b51109cd202167d173e
457cac5dccdf4c67de5e139d64507819421bbb252e88951cbabddbee68267699
608ff39d81bf3098a9db9aaea1c56c59773d04db4bdb4567500842cc9f1431cb
73ae1e53f4a4ea084655f590e016497a36a25f419bf35fb5b71591b95d07b6f6
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
87f22c41dbcb26bad91fbaf973d978ab76cd68a768ad20b3a3596c9277cb113c
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
b86d0b93e4e11cf1a09e3a7efe97c0faa07a335bd100b85f2ce7655942da1894
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
cb409ca7227f6ea8937b56b2c90284afe4f0596944940317b3fb7bb8444a69b2
cbb81f38ee322ed3d62af6bb700def6a6be839b1edafcb6261fc2a78ed4ffdb3
e9c7167bedaaf674e1bf87ac293329469218643b816dd0e6bb4f19dd7ca10dc9
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

www.govtr.kartiadeler.tk Open in urlscan Pro 91.219.194.4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

24 Requests

29 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

6 IPs

4 Countries

221 kBTransfer

567 kBSize

0 Cookies

0 Outgoing links

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

0 Cookies

Indicators

www.govtr.kartiadeler.tk Open in urlscan Pro
91.219.194.4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

29 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

221 kB
Transfer

567 kB
Size

0
Cookies

24 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!