aysekilincaslan.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 178.18.197.108, located in Sanayi, Turkey and belongs to NETDIREKT-AS, TR. The main domain is aysekilincaslan.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on August 28th 2018. Valid for: a year.

This is the only time aysekilincaslan.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: University of Iowa (Education)

Domain & IP information

	IP Address	AS Autonomous System
2 2	45.40.140.1 45.40.140.1	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
2	178.18.197.108 178.18.197.108	43391 (NETDIREKT-AS) (NETDIREKT-AS)
3	128.255.166.97 128.255.166.97	3676 (UIOWA-AS) (UIOWA-AS - University of Iowa)
2	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
7	3

2 45.40.140.1 (Scottsdale, United States) 2 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-140-1.ip.secureserver.net

x.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.18.197.108 (Sanayi, Turkey)

ASN43391 (NETDIREKT-AS, TR)
PTR: ns1.fzmtech.com

aysekilincaslan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 128.255.166.97 (Iowa City, United States)

ASN3676 (UIOWA-AS - University of Iowa, US)
PTR: login.uiowa.edu

login.uiowa.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	uiowa.edu login.uiowa.edu	119 KB
2	google-analytics.com ssl.google-analytics.com	17 KB
2	aysekilincaslan.com aysekilincaslan.com	2 KB
2	x.co 2 redirects x.co	294 B
7	4

	Domain	Requested by
3	login.uiowa.edu	aysekilincaslan.com
2	ssl.google-analytics.com	aysekilincaslan.com
2	aysekilincaslan.com
2	x.co	2 redirects
7	4

This site contains links to these domains. Also see Links.

Domain
apps.its.uiowa.edu
myui.uiowa.edu

Subject Issuer	Validity	Valid
aysekilincaslan.com RapidSSL RSA CA 2018	`2018-08-28` - `2019-08-28`	a year	crt.sh
login.uiowa.edu COMODO RSA Extended Validation Secure Server CA	`2017-12-12` - `2019-12-12`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G3	`2018-10-30` - `2019-01-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://aysekilincaslan.com/wp-includes/promo/iowa.html
Frame ID: AB95F7D3396E4A431FFD746810C2E4AA
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://x.co/6nZhN HTTP 301
https://x.co/6nZhN HTTP 302
https://aysekilincaslan.com/index(1).htm Page URL
https://aysekilincaslan.com/wp-includes/promo/iowa.html Page URL

Detected technologies

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

138 kB
Transfer

168 kB
Size

5
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://apps.its.uiowa.edu/pwtool/reset
Title: Forgot your HawkID password?

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/guest-login.page
Title: Click here for the guest login page

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/courses/dashboard.page
Title: Courses

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/help/dashboard.page
Title: Help

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/home.page
Title: News & Information

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://x.co/6nZhN HTTP 301
https://x.co/6nZhN HTTP 302
https://aysekilincaslan.com/index(1).htm Page URL
https://aysekilincaslan.com/wp-includes/promo/iowa.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://x.co/6nZhN HTTP 301
https://x.co/6nZhN HTTP 302
https://aysekilincaslan.com/index(1).htm

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

index(1).htm
aysekilincaslan.com/
Redirect Chain

http://x.co/6nZhN
https://x.co/6nZhN
https://aysekilincaslan.com/index(1).htm

100 B
516 B

192ms
59ms

Document
text/html

178.18.197.108
NETDIREKT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://aysekilincaslan.com/index(1).htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.18.197.108 Sanayi, Turkey, ASN43391 (NETDIREKT-AS, TR),
Reverse DNS: ns1.fzmtech.com
Software: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /
Resource Hash

Request headers

Host: aysekilincaslan.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 28 Nov 2018 17:55:30 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Last-Modified: Tue, 27 Nov 2018 16:56:16 GMT
ETag: "64-57ba853ea796b-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Referrer-Policy
Content-Length: 117
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

status: 302
server: nginx/1.12.2
date: Wed, 28 Nov 2018 17:55:32 GMT
content-type: text/html; charset=utf-8
location: https://aysekilincaslan.com/index(1).htm

GET
H/1.1 200
OK Primary Request iowa.html Show response
aysekilincaslan.com/wp-includes/promo/ 4 KB
2 KB 59ms
59ms Document
text/html 178.18.197.108
NETDIREKT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.18.197.108 Sanayi, Turkey, ASN43391 (NETDIREKT-AS, TR),
Reverse DNS: ns1.fzmtech.com
Software: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /
Resource Hash: 378242d996b518aeb906306bb55c37a5e719cdf9308429e6cee5daf07b2cb8cd

Request headers

Host: aysekilincaslan.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://aysekilincaslan.com/index(1).htm
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://aysekilincaslan.com/index(1).htm

Response headers

Date: Wed, 28 Nov 2018 17:55:30 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Last-Modified: Mon, 12 Mar 2018 14:03:26 GMT
ETag: "1000-567379b110780-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Referrer-Policy
Content-Length: 1426
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK bootstrap.min.css
login.uiowa.edu/uip/bs-3.0.3/ 97 KB
97 KB 388ms
126ms Stylesheet
text/css 128.255.166.97
University of Iowa

General

Check archive.org

Show headers Download Go to

Full URL: https://login.uiowa.edu/uip/bs-3.0.3/bootstrap.min.css
Requested by: Host: aysekilincaslan.com
URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 128.255.166.97 Iowa City, United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS: login.uiowa.edu
Software: Apache-Coyote/1.1 /
Resource Hash: 46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466

Request headers

Referer: https://aysekilincaslan.com/wp-includes/promo/iowa.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 28 Nov 2018 17:55:33 GMT
Last-Modified: Tue, 30 Jan 2018 22:55:22 GMT
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"99548-1517352922000"
Content-Length: 99548
Content-Type: text/css

GET
H/1.1 200
OK simple-login.css
login.uiowa.edu/uip/css/ 3 KB
3 KB 387ms
126ms Stylesheet
text/css 128.255.166.97
University of Iowa

General

Check archive.org

Show headers Download Go to

Full URL: https://login.uiowa.edu/uip/css/simple-login.css
Requested by: Host: aysekilincaslan.com
URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 128.255.166.97 Iowa City, United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS: login.uiowa.edu
Software: Apache-Coyote/1.1 /
Resource Hash: 23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556

Request headers

Referer: https://aysekilincaslan.com/wp-includes/promo/iowa.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 28 Nov 2018 17:55:33 GMT
Last-Modified: Tue, 30 Jan 2018 22:55:22 GMT
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"2847-1517352922000"
Content-Length: 2847
Content-Type: text/css

GET
H/1.1 200
OK uiowa-dome.png
login.uiowa.edu/uip/images/ 18 KB
19 KB 391ms
127ms Image
image/png 128.255.166.97
University of Iowa

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.uiowa.edu/uip/images/uiowa-dome.png
Requested by: Host: aysekilincaslan.com
URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 128.255.166.97 Iowa City, United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS: login.uiowa.edu
Software: Apache-Coyote/1.1 /
Resource Hash: 5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc

Request headers

Referer: https://aysekilincaslan.com/wp-includes/promo/iowa.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 28 Nov 2018 17:55:33 GMT
Last-Modified: Tue, 30 Jan 2018 22:55:22 GMT
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"18909-1517352922000"
Content-Length: 18909
Content-Type: image/png

GET
S 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: aysekilincaslan.com
URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:817::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://aysekilincaslan.com/wp-includes/promo/iowa.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Nov 2018 21:10:09 GMT
server: Golfe2
age: 4340
date: Wed, 28 Nov 2018 16:43:13 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17168
expires: Wed, 28 Nov 2018 18:43:13 GMT

GET
S 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
102 B 18ms
17ms Image
image/gif 2a00:1450:4001:817::2008
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=496331153&utmhn=aysekilincaslan.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=HawkID%20Login%20for%20myUI&utmhid=1509228610&utmr=0&utmp=%2Fwp-includes%2Fpromo%2Fiowa.html&utmht=1543427734047&utmac=UA-21427431-1&utmcc=__utma%3D131860127.992529938.1543427734.1543427734.1543427734.1%3B%2B__utmz%3D131860127.1543427734.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1060239929&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: aysekilincaslan.com
URL: https://aysekilincaslan.com/wp-includes/promo/iowa.html

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:817::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://aysekilincaslan.com/wp-includes/promo/iowa.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 28 Nov 2018 17:55:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: University of Iowa (Education)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _gaq object| focusControl object| _gat object| gaGlobal

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.aysekilincaslan.com/	1970-01-18 20:43:49	Name: __utmb Value: 131860127.1.10.1543427734
.aysekilincaslan.com/	1970-01-18 20:43:48	Name: __utmt Value: 1
.aysekilincaslan.com/	1970-01-19 01:06:35	Name: __utmz Value: 131860127.1543427734.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.aysekilincaslan.com/	1969-12-31 23:59:59	Name: __utmc Value: 131860127
.aysekilincaslan.com/	1970-01-19 14:14:59	Name: __utma Value: 131860127.992529938.1543427734.1543427734.1543427734.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aysekilincaslan.com
login.uiowa.edu
ssl.google-analytics.com
x.co
128.255.166.97
178.18.197.108
2a00:1450:4001:817::2008
45.40.140.1
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556
378242d996b518aeb906306bb55c37a5e719cdf9308429e6cee5daf07b2cb8cd
46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466
5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

aysekilincaslan.com Open in urlscan Pro 178.18.197.108 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

138 kBTransfer

168 kBSize

5 Cookies

5 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

5 Cookies

Indicators

aysekilincaslan.com Open in urlscan Pro
178.18.197.108 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

138 kB
Transfer

168 kB
Size

5
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!