197-1-2-78-2-1.shop Open in urlscan Pro
45.95.146.98 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://197-1-2-78-2-1.shop/
Submission: On June 17 via api (June 17th 2024, 9:15:15 pm UTC) from TR — Scanned from NL

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 45.95.146.98, located in Amsterdam, Netherlands and belongs to AS49870-BV, NL. The main domain is 197-1-2-78-2-1.shop.
TLS certificate: Issued by R11 on June 17th 2024. Valid for: 3 months.

This is the only time 197-1-2-78-2-1.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Vakifbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	45.95.146.98 45.95.146.98	49870 (AS49870-BV) (AS49870-BV)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
21	3

14 45.95.146.98 (Amsterdam, Netherlands)

ASN49870 (AS49870-BV, NL)
PTR: env-prime13.contaprotegida.co

197-1-2-78-2-1.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	197-1-2-78-2-1.shop 197-1-2-78-2-1.shop	86 KB
6	gstatic.com fonts.gstatic.com	82 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	1 KB
21	3

	Domain	Requested by
14	197-1-2-78-2-1.shop	197-1-2-78-2-1.shop
6	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	197-1-2-78-2-1.shop
21	3

This site contains no links.

Subject Issuer	Validity	Valid
197-1-2-78-2-1.shop R11	`2024-06-17` - `2024-09-15`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://197-1-2-78-2-1.shop/
Frame ID: 65EE1265C1513680EC3E7935B1A475FA
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VakıfBank İnternet Bankacılığı

Page Statistics

21
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

169 kB
Transfer

234 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
197-1-2-78-2-1.shop/ 10 KB
2 KB 77ms
16ms Document
text/html 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PHP/7.4.33 PleskLin
Resource Hash: a37a92c655b29235ce18e74a429d6272494c42cef268d7c3158563f083752ee8

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 17 Jun 2024 21:15:09 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
x-powered-by: PHP/7.4.33 PleskLin

GET
H2 200 style.css
197-1-2-78-2-1.shop/dist/ 18 KB
3 KB 16ms
15ms Stylesheet
text/css 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/dist/style.css
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 287443306280e15dc7f73942c6dfb8b1d9b3b787f6d18488a49ac12863190ae1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
content-encoding: br
last-modified: Tue, 14 May 2024 20:20:20 GMT
server: nginx
etag: W/"6643c784-4777"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 vakifbank-logo.svg
197-1-2-78-2-1.shop/dist/ 4 KB
4 KB 28ms
28ms Image
image/svg+xml 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/vakifbank-logo.svg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 9d39d3cb5e7555520fb55b849bbdc8a3c525c519d3d4e2d1bccf3022c145de30

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Wed, 15 May 2024 05:15:52 GMT
server: nginx
etag: "66444508-ed2"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3794

GET
H2 200 vakifbank-logo-white.svg
197-1-2-78-2-1.shop/dist/ 4 KB
4 KB 17ms
16ms Image
image/svg+xml 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/vakifbank-logo-white.svg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: f9b3eeb4e4348dde16556d18e4b8d9dee807fe41412550df5c7d6d3a6e91ebf6

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Wed, 15 May 2024 05:15:40 GMT
server: nginx
etag: "664444fc-ecf"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3791

GET
H2 200 qr_entry_tr.svg
197-1-2-78-2-1.shop/dist/ 34 KB
34 KB 24ms
22ms Image
image/svg+xml 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/qr_entry_tr.svg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 463991336704eac1867214666e23fe6ff459f9c050991e454a3d494b67d6a47a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Tue, 14 May 2024 01:15:50 GMT
server: nginx
etag: "6642bb46-888a"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 34954

GET
H2 200 secure-globalsign-ssl.png
197-1-2-78-2-1.shop/dist/ 9 KB
10 KB 31ms
29ms Image
image/png 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/secure-globalsign-ssl.png
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: fedf4740b9ae487ac387afe5ac91b724a7a0c9fc05680b9f024ccc37ebb7772b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Sat, 07 Aug 2021 04:44:00 GMT
server: nginx
etag: "610e0f90-25ff"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 9727

GET
H2 200 google-play.jpg
197-1-2-78-2-1.shop/dist/ 5 KB
5 KB 31ms
30ms Image
image/jpeg 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/google-play.jpg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: a137095fc3e621e7d32a0134fb1022348219e0a844740d83c816839d3253d8c1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Sat, 07 Aug 2021 04:43:54 GMT
server: nginx
etag: "610e0f8a-13df"
x-powered-by: PleskLin
content-type: image/jpeg
accept-ranges: bytes
content-length: 5087

GET
H2 200 app-store.jpg
197-1-2-78-2-1.shop/dist/ 5 KB
5 KB 32ms
31ms Image
image/jpeg 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/app-store.jpg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 0e8c81e455a1c214d6907ace3553cba24d23ef771246e3776568a5dd9166585a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Sat, 07 Aug 2021 04:43:58 GMT
server: nginx
etag: "610e0f8e-1458"
x-powered-by: PleskLin
content-type: image/jpeg
accept-ranges: bytes
content-length: 5208

GET
H2 200 app.js Show response
197-1-2-78-2-1.shop/dist/ 47 KB
7 KB 17ms
16ms Script
application/javascript 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/dist/app.js
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 39a25c2ec4b3d23aca5b6b93c880100997c6a3809ccbfcd1e5204d3f0dd97e24

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
content-encoding: br
last-modified: Mon, 27 May 2024 15:09:58 GMT
server: nginx
etag: W/"6654a246-bc11"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 82ms
28ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Requested by

Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/dist/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

42e3aa6d662901ad9a1a467a06d2ea7514451ad93b1fda75bc093374aba78290

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 17 Jun 2024 21:15:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 17 Jun 2024 21:14:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jun 2024 21:15:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 74ms
19ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 05:20:49 GMT
x-content-type-options: nosniff
age: 402860
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 05:20:49 GMT

GET
H2 200 keyboard.svg
197-1-2-78-2-1.shop/dist/ 5 KB
5 KB 15ms
15ms Image
image/svg+xml 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/keyboard.svg
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/dist/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 1d98ff4e153149c0d4fd725fb9dd878e2de83ac30e52dbadbb3fdf1a0853fe93

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/dist/style.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Sat, 07 Aug 2021 17:15:30 GMT
server: nginx
etag: "610ebfb2-1292"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 4754

GET
H2 200 icon-shield.png
197-1-2-78-2-1.shop/dist/ 5 KB
5 KB 15ms
15ms Image
image/png 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://197-1-2-78-2-1.shop/dist/icon-shield.png
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/dist/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: ecf0f6192658b9f4eb288b8353e2f84a4be9c3b2d8f0365f0539e7556558bf2b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/dist/style.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Sat, 07 Aug 2021 04:44:10 GMT
server: nginx
etag: "610e0f9a-1442"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 5186

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 80ms
26ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 20:32:44 GMT
x-content-type-options: nosniff
age: 348145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 20:32:44 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 106ms
52ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 18:03:05 GMT
x-content-type-options: nosniff
age: 357124
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15752
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 18:03:05 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 11 KB
12 KB 110ms
56ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2781e9e7c3f369b8fc7965e679b17b60b5b11eaae5da1e5045107bbdd9d568f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 05:05:38 GMT
x-content-type-options: nosniff
age: 403771
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11756
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 05:05:38 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 96ms
42ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 10 Jun 2024 23:19:48 GMT
x-content-type-options: nosniff
age: 597321
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Jun 2025 23:19:48 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 98ms
46ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://197-1-2-78-2-1.shop
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 19:41:16 GMT
x-content-type-options: nosniff
age: 351233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11824
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 19:41:16 GMT

GET
H2 200 favicon.ico
197-1-2-78-2-1.shop/ 1 KB
1 KB 17ms
17ms Other
image/vnd.microsoft.icon 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PleskLin
Resource Hash: 22b4e5c5489c64b15b67e78d962dbec29af1a3022d9162a65fa9b43fafa7f27c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 21:15:09 GMT
last-modified: Thu, 05 Aug 2021 01:04:58 GMT
server: nginx
etag: "610b393a-47e"
x-powered-by: PleskLin
content-type: image/vnd.microsoft.icon
accept-ranges: bytes
content-length: 1150

POST
H2 200 fakesocket.php
197-1-2-78-2-1.shop/ 0
0 17ms
16ms Fetch
text/html 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/fakesocket.php
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/dist/app.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PHP/7.4.33, PleskLin
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 17 Jun 2024 21:15:10 GMT
content-encoding: br
server: nginx
x-powered-by: PHP/7.4.33, PleskLin
content-type: text/html; charset=UTF-8

POST
H2 200 fakesocket.php
197-1-2-78-2-1.shop/ 0
0 16ms
16ms Fetch
text/html 45.95.146.98
AS49870-BV

General

Check archive.org

Show headers Download Go to

Full URL: https://197-1-2-78-2-1.shop/fakesocket.php
Requested by: Host: 197-1-2-78-2-1.shop
URL: https://197-1-2-78-2-1.shop/dist/app.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.95.146.98 Amsterdam, Netherlands, ASN49870 (AS49870-BV, NL),
Reverse DNS: env-prime13.contaprotegida.co
Software: nginx / PHP/7.4.33, PleskLin
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://197-1-2-78-2-1.shop/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 17 Jun 2024 21:15:13 GMT
content-encoding: br
server: nginx
x-powered-by: PHP/7.4.33, PleskLin
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vakifbank (Banking)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			197-1-2-78-2-1.shop/	1969-12-31 23:59:59	Name: PHPSESSID Value: skr2fvdi0drkpg0eudf66uiajh

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://197-1-2-78-2-1.shop/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

197-1-2-78-2-1.shop
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:81c::200a
2a00:1450:4001:827::2003
45.95.146.98
0e8c81e455a1c214d6907ace3553cba24d23ef771246e3776568a5dd9166585a
1d98ff4e153149c0d4fd725fb9dd878e2de83ac30e52dbadbb3fdf1a0853fe93
22b4e5c5489c64b15b67e78d962dbec29af1a3022d9162a65fa9b43fafa7f27c
2781e9e7c3f369b8fc7965e679b17b60b5b11eaae5da1e5045107bbdd9d568f0
287443306280e15dc7f73942c6dfb8b1d9b3b787f6d18488a49ac12863190ae1
39a25c2ec4b3d23aca5b6b93c880100997c6a3809ccbfcd1e5204d3f0dd97e24
3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431
42e3aa6d662901ad9a1a467a06d2ea7514451ad93b1fda75bc093374aba78290
463991336704eac1867214666e23fe6ff459f9c050991e454a3d494b67d6a47a
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
9d39d3cb5e7555520fb55b849bbdc8a3c525c519d3d4e2d1bccf3022c145de30
a137095fc3e621e7d32a0134fb1022348219e0a844740d83c816839d3253d8c1
a37a92c655b29235ce18e74a429d6272494c42cef268d7c3158563f083752ee8
ecf0f6192658b9f4eb288b8353e2f84a4be9c3b2d8f0365f0539e7556558bf2b
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f9b3eeb4e4348dde16556d18e4b8d9dee807fe41412550df5c7d6d3a6e91ebf6
fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b
fedf4740b9ae487ac387afe5ac91b724a7a0c9fc05680b9f024ccc37ebb7772b

197-1-2-78-2-1.shop Open in urlscan Pro 45.95.146.98 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

21 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

169 kBTransfer

234 kBSize

1 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

197-1-2-78-2-1.shop Open in urlscan Pro
45.95.146.98 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

169 kB
Transfer

234 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!