ekranhaberler.com
Open in
urlscan Pro
138.201.199.105
Malicious Activity!
Public Scan
Effective URL: https://ekranhaberler.com/office/wp-ug/gurt/check/New/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=25&id=5...
Submission: On July 24 via manual from IN
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 6th 2019. Valid for: 3 months.
This is the only time ekranhaberler.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 54.36.113.236 54.36.113.236 | 16276 (OVH) (OVH) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
2 25 | 138.201.199.105 138.201.199.105 | 24940 (HETZNER-AS) (HETZNER-AS) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:2be::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
30 | 6 |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.105.199.201.138.clients.your-server.de
ekranhaberler.com |
ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
ekranhaberler.com
2 redirects
ekranhaberler.com |
563 KB |
3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
294 KB |
1 |
googleapis.com
fonts.googleapis.com |
772 B |
1 |
jquery.com
code.jquery.com |
24 KB |
1 |
pebblessauna.co.za
pebblessauna.co.za |
3 KB |
30 | 5 |
Domain | Requested by | |
---|---|---|
25 | ekranhaberler.com |
2 redirects
pebblessauna.co.za
ekranhaberler.com |
3 | secure.aadcdn.microsoftonline-p.com |
ekranhaberler.com
|
1 | fonts.googleapis.com |
ekranhaberler.com
|
1 | code.jquery.com |
pebblessauna.co.za
|
1 | pebblessauna.co.za | |
30 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
pebblessauna.co.za cPanel, Inc. Certification Authority |
2019-07-13 - 2019-10-11 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
ekranhaberler.com cPanel, Inc. Certification Authority |
2019-07-06 - 2019-10-04 |
3 months | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1 |
2017-08-15 - 2019-08-15 |
2 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-06-18 - 2019-09-10 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://ekranhaberler.com/office/wp-ug/gurt/check/New/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=25&id=5959930878&email=Conor.Shields@schneider-electric.com
Frame ID: BF08A0556AA93C6FD3883E272A730727
Requests: 8 HTTP requests in this frame
Frame:
https://ekranhaberler.com/office/wp-ug/gurt/check/New/data_files/Prefetch.html
Frame ID: BBF5A4BC80E2630F9DAC31AABDCC34CC
Requests: 22 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://pebblessauna.co.za/8f09c424b5c2aa40044a79d70c6a8480?tyid=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3... Page URL
-
https://ekranhaberler.com/office/wp-ug/gurt/check/New?email=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3RyaW...
HTTP 301
https://ekranhaberler.com/office/wp-ug/gurt/check/New/?email=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3Rya... HTTP 302
https://ekranhaberler.com/office/wp-ug/gurt/check/New/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8f... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://pebblessauna.co.za/8f09c424b5c2aa40044a79d70c6a8480?tyid=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3RyaWMuY29t Page URL
-
https://ekranhaberler.com/office/wp-ug/gurt/check/New?email=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3RyaWMuY29t
HTTP 301
https://ekranhaberler.com/office/wp-ug/gurt/check/New/?email=Q29ub3IuU2hpZWxkc0BzY2huZWlkZXItZWxlY3RyaWMuY29t HTTP 302
https://ekranhaberler.com/office/wp-ug/gurt/check/New/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=25&id=5959930878&email=Conor.Shields@schneider-electric.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
8f09c424b5c2aa40044a79d70c6a8480
pebblessauna.co.za/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
Login.php
ekranhaberler.com/office/wp-ug/gurt/check/New/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.login.min.css
ekranhaberler.com/office/wp-ug/gurt/check/New/data_files/ |
84 KB 85 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
ekranhaberler.com/office/wp-ug/gurt/check/New/data_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picker_account_aad.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6970.12/content/images/ |
756 B 772 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Prefetch.html
ekranhaberler.com/office/wp-ug/gurt/check/New/data_files/ Frame BBF5 |
16 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
291 KB 291 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cli-style.css
ekranhaberler.com/wp-content/plugins/cookie-law-info/css/ Frame BBF5 |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dashicons.min.css
ekranhaberler.com/wp-includes/css/ Frame BBF5 |
45 KB 46 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
everest-forms.css
ekranhaberler.com/wp-content/plugins/everest-forms/assets/css/ Frame BBF5 |
11 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame BBF5 |
9 KB 772 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
ekranhaberler.com/wp-content/themes/colornews/ Frame BBF5 |
60 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
ekranhaberler.com/wp-content/themes/colornews/font-awesome/css/ Frame BBF5 |
27 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
ekranhaberler.com/wp-includes/js/jquery/ Frame BBF5 |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-migrate.min.js
ekranhaberler.com/wp-includes/js/jquery/ Frame BBF5 |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cookielawinfo.js
ekranhaberler.com/wp-content/plugins/cookie-law-info/js/ Frame BBF5 |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
cropped-extra.png
ekranhaberler.com/wp-content/uploads/2018/09/ Frame BBF5 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.inputmask.bundle.min.js
ekranhaberler.com/wp-content/plugins/everest-forms/assets/js/inputmask/ Frame BBF5 |
71 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flatpickr.min.js
ekranhaberler.com/wp-content/plugins/everest-forms/assets/js/flatpickr/ Frame BBF5 |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
ekranhaberler.com/wp-content/plugins/everest-forms/assets/js/jquery-validate/ Frame BBF5 |
23 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
everest-forms.min.js
ekranhaberler.com/wp-content/plugins/everest-forms/assets/js/frontend/ Frame BBF5 |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.fitvids.js
ekranhaberler.com/wp-content/themes/colornews/js/fitvids/ Frame BBF5 |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.bxslider.min.js
ekranhaberler.com/wp-content/themes/colornews/js/jquery.bxslider/ Frame BBF5 |
23 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wp-emoji-release.min.js
ekranhaberler.com/wp-includes/js/ Frame BBF5 |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
ekranhaberler.com/wp-content/themes/colornews/js/ Frame BBF5 |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
skip-link-focus-fix.js
ekranhaberler.com/wp-content/themes/colornews/js/ Frame BBF5 |
751 B 1005 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wp-embed.min.js
ekranhaberler.com/wp-includes/js/ Frame BBF5 |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-pattern.jpg
ekranhaberler.com/wp-content/themes/colornews/img/ Frame BBF5 |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ekranhaberler.com
- URL
- http://ekranhaberler.com/wp-content/uploads/2018/09/cropped-extra.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
ekranhaberler.com
fonts.googleapis.com
pebblessauna.co.za
secure.aadcdn.microsoftonline-p.com
ekranhaberler.com
138.201.199.105
205.185.208.52
2a00:1450:4001:820::200a
2a02:26f0:6c00:2be::35c1
54.36.113.236
04b92ec3092ba8579dd17d8d96461741120cdba8cc8ab90f39de44e42031f93e
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0b135ce0d8fb0b99efe0fdfac81143525ef85ac3fea580a3f504d3a0d3864e8a
14e1fb6f605c7dd974dec8bcbb567fb524990048dd6e5921acb800eaadf247c4
17a879e50c3ab3078afaded288e257fb66e94806b76ff7e796b54226f9848f50
206e70b1d3fc646c69387e42d65e72b786acb70bb688c93b7cf8c16cd78d9e20
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
33474b006ea78f01cdb7dbd69a55ebb65b2bbeb76f02575889360ea3dd65907d
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
5a55d3de0a725a8d09ab29a42ac534238742c459937d09d199e279eddeef74ca
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
703ad56f438bb9e00a299ccf58f8f583aa8503858c753e89a086e12a33276442
831d0530a39842ddbe971fac8d0dc5c3947b4c09c2a0966b812b37863c14785b
83b66f12681c7ff8663500d5c2cc268633cceaa18f9e9cf1dbffa2491ac8d810
bb809b6445d1fba8940e3b3089392bed19e43fa138217ec3d85f0c6bd9502eb3
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
c1f127b73918a5243fc545fb46a2f29e94c02641e4511642ec2a9b3ee20cbc94
d0df2ff25fded9e43a0cfa5159393d4482725bfb390e8ca94f34da85b5304117
d11ce56c5174a28dae1290e7ec970de72c853dcaa62640025389e3ac39964eb3
d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5
db6cd59c42c777b02410dca9f0a28e5d02cc4fb4fad189645bb2398941c4ce59
dc0f0c46f51c480b1f6594a3953549d956510d4dce2bc2ce6a57e55f28b114c8
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e54b12f091001a29558f0c4c6e33fe512f71ba0215fc6630f6afc159f2ba40a1
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e