zirveairlines.com Open in urlscan Pro
185.12.108.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://zirveairlines.com/
Submission: On December 26 via automatic, source phishtank (December 26th 2022, 8:09:40 pm UTC) — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 185.12.108.114, located in Turkey and belongs to WIFIBER, TR. The main domain is zirveairlines.com.
TLS certificate: Issued by R3 on October 31st 2022. Valid for: 3 months.

This is the only time zirveairlines.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Ripley (Banking)

Domain & IP information

	IP Address		AS Autonomous System
12	185.12.108.114 185.12.108.114		58059 (WIFIBER) (WIFIBER)
12	1

12 185.12.108.114 (Turkey)

ASN58059 (WIFIBER, TR)
PTR: athena.ynt.com.tr

zirveairlines.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	zirveairlines.com zirveairlines.com	885 KB
12	1

	Domain	Requested by
12	zirveairlines.com	zirveairlines.com
12	1

This site contains no links.

Subject Issuer	Validity	Valid
api.zirveairlines.com R3	`2022-10-31` - `2023-01-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://zirveairlines.com/
Frame ID: C8E31DE1BED339E83458695641C4B043
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banco Ripley

Detected technologies

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

885 kB
Transfer

1331 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response zirveairlines.com/	26 KB 6 KB	304ms 78ms	Document text/html	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / PHP/7.3.6 Resource Hash `ae17654f996fb597d06ea4249aadba9e2dd3380e1d110a11302bc89cb0e1e914` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=60 content-encoding gzip content-length 5502 content-type text/html; charset=UTF-8 date Mon, 26 Dec 2022 19:25:55 GMT expires Mon, 26 Dec 2022 19:26:55 GMT server Apache/2 vary Accept-Encoding,User-Agent x-powered-by PHP/7.3.6
GET H2	200	styles.ca1132029e4b23633a6e.css zirveairlines.com/assets/	118 KB 20 KB	78ms 76ms	Stylesheet text/css	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `228188cabceffc8b2bcb6bc21caddad020746104beb1ad045ff468fa871c5def` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Wed, 19 Aug 2020 02:23:02 GMT server Apache/2 etag "1d97c-5ad31aed8cd80-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 20342 expires Mon, 02 Jan 2023 19:25:55 GMT
GET H2	200	master.css zirveairlines.com/assets/	13 KB 3 KB	75ms 74ms	Stylesheet text/css	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/master.css?rand=1707489721 Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `749837101cd73ec4d3acf3069ce270d83390af712dfbd4efac5d318ddcdfd93b` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Mon, 26 Oct 2020 20:59:06 GMT server Apache/2 etag "34b3-5b299336bda80-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 2797 expires Mon, 02 Jan 2023 19:25:55 GMT
GET H2	200	loading.css zirveairlines.com/assets/	189 KB 11 KB	147ms 146ms	Stylesheet text/css	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/loading.css Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `b4ea3f56351395b7528c9049014f2e33442f8620f0b5e0bcae9d6aae234e87fe` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Tue, 22 Jan 2019 11:21:32 GMT server Apache/2 etag "2f20d-5800a2deba700-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 10708 expires Mon, 02 Jan 2023 19:25:55 GMT
GET H2	200	loading-btn.css zirveairlines.com/assets/	3 KB 671 B	75ms 74ms	Stylesheet text/css	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/loading-btn.css Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `3c925403eeb24cf057851003097e8bbc81f8baf6467c4748571cd440d20a7d12` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Tue, 22 Jan 2019 11:21:54 GMT server Apache/2 etag "b8c-5800a2f3b5880-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 592 expires Mon, 02 Jan 2023 19:25:55 GMT
GET H2	200	animate.css zirveairlines.com/assets/	79 KB 5 KB	76ms 75ms	Stylesheet text/css	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/animate.css Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `ed229a57e697e1eee579a1bbf898693bbf6f4b2acfa05f29bf30081db504fcca` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Tue, 22 Jan 2019 12:20:28 GMT server Apache/2 etag "13de5-5800b00aebb00-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 4811 expires Mon, 02 Jan 2023 19:25:55 GMT
GET H2	200	jquery.min.js Show response zirveairlines.com/assets/	82 KB 29 KB	148ms 147ms	Script application/javascript	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/jquery.min.js Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Sun, 25 Oct 2020 08:57:34 GMT server Apache/2 etag "14915-5b27b012cfb80-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=60 accept-ranges bytes content-length 29497 expires Mon, 26 Dec 2022 19:26:55 GMT
GET H2	200	fun.js Show response zirveairlines.com/assets/	1 KB 720 B	75ms 75ms	Script application/javascript	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/fun.js Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `70929dfe08bfc3b9e80c3ae8aa36ee1dd0e4dadbf25cc9a69c2ed2d2f7758934` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Mon, 26 Oct 2020 18:04:06 GMT server Apache/2 etag "509-5b296c1929180-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=60 accept-ranges bytes content-length 624 expires Mon, 26 Dec 2022 19:26:55 GMT
GET H2	200	image-welcome.d46e514b879706636370.png zirveairlines.com/assets/	751 KB 756 KB	73ms 72ms	Image image/png	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Show image Full URL https://zirveairlines.com/assets/image-welcome.d46e514b879706636370.png Requested by Host: zirveairlines.com URL: https://zirveairlines.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `e9ba5f3a430e44fbfc76ce4e327a5942670bd2ca7ea3983fcbc8c0c9ad6834f6` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT last-modified Wed, 19 Aug 2020 02:32:04 GMT server Apache/2 etag "bbc38-5ad31cf271100" content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 769080 expires Wed, 25 Jan 2023 19:25:55 GMT
GET H2	200	logo-bancoripley.5860169353c9e41d5bcf.svg zirveairlines.com/assets/	23 KB 9 KB	106ms 106ms	Image image/svg+xml	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Show image Full URL https://zirveairlines.com/assets/logo-bancoripley.5860169353c9e41d5bcf.svg Requested by Host: zirveairlines.com URL: https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `84df12b4f5ecc4b851d5fa9ee6d41e274c817a9656c8f89684275379d0e1de9b` Request headers accept-language de-DE,de;q=0.9 Referer https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Wed, 19 Aug 2020 03:41:18 GMT server Apache/2 etag "5cf9-5ad32c6c01380-gzip" vary Accept-Encoding,User-Agent content-type image/svg+xml cache-control max-age=60 accept-ranges bytes content-length 9406 expires Mon, 26 Dec 2022 19:26:55 GMT
GET H2	200	montserrat-regular-webfont.63c74e353d72c0d4dcc9.woff2 zirveairlines.com/assets/	26 KB 26 KB	74ms 74ms	Font application/octet-stream	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/montserrat-regular-webfont.63c74e353d72c0d4dcc9.woff2 Requested by Host: zirveairlines.com URL: https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `dbee593c6b373f35d1a2ef6a2ec0c897c3271ffb6d8546e83702782c50bb6924` Request headers Referer https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Origin https://zirveairlines.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Wed, 19 Aug 2020 18:56:28 GMT server Apache/2 etag "669c-5ad3f8fa42f00-gzip" vary Accept-Encoding,User-Agent cache-control max-age=60 accept-ranges bytes content-length 26291 expires Mon, 26 Dec 2022 19:26:55 GMT
GET H2	200	montserrat-semibold-webfont.75955f7a0fe09129e937.woff2 zirveairlines.com/assets/	18 KB 19 KB	145ms 144ms	Font application/octet-stream	185.12.108.114 WIFIBER
General Check archive.org Show headers Download Go to Full URL https://zirveairlines.com/assets/montserrat-semibold-webfont.75955f7a0fe09129e937.woff2 Requested by Host: zirveairlines.com URL: https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.12.108.114 , Turkey, ASN58059 (WIFIBER, TR), Reverse DNS athena.ynt.com.tr Software Apache/2 / Resource Hash `2ae2373e5bff2e7297ca85888329886c0ed99efb2ec2a2ca610f0596f826f5da` Request headers Referer https://zirveairlines.com/assets/styles.ca1132029e4b23633a6e.css Origin https://zirveairlines.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 26 Dec 2022 19:25:55 GMT content-encoding gzip last-modified Wed, 19 Aug 2020 18:56:30 GMT server Apache/2 etag "4928-5ad3f8fc2b380-gzip" vary Accept-Encoding,User-Agent cache-control max-age=60 accept-ranges bytes content-length 18751 expires Mon, 26 Dec 2022 19:26:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Ripley (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

zirveairlines.com
185.12.108.114
228188cabceffc8b2bcb6bc21caddad020746104beb1ad045ff468fa871c5def
2ae2373e5bff2e7297ca85888329886c0ed99efb2ec2a2ca610f0596f826f5da
3c925403eeb24cf057851003097e8bbc81f8baf6467c4748571cd440d20a7d12
70929dfe08bfc3b9e80c3ae8aa36ee1dd0e4dadbf25cc9a69c2ed2d2f7758934
749837101cd73ec4d3acf3069ce270d83390af712dfbd4efac5d318ddcdfd93b
84df12b4f5ecc4b851d5fa9ee6d41e274c817a9656c8f89684275379d0e1de9b
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
ae17654f996fb597d06ea4249aadba9e2dd3380e1d110a11302bc89cb0e1e914
b4ea3f56351395b7528c9049014f2e33442f8620f0b5e0bcae9d6aae234e87fe
dbee593c6b373f35d1a2ef6a2ec0c897c3271ffb6d8546e83702782c50bb6924
e9ba5f3a430e44fbfc76ce4e327a5942670bd2ca7ea3983fcbc8c0c9ad6834f6
ed229a57e697e1eee579a1bbf898693bbf6f4b2acfa05f29bf30081db504fcca

zirveairlines.com Open in urlscan Pro 185.12.108.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

885 kBTransfer

1331 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

zirveairlines.com Open in urlscan Pro
185.12.108.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

885 kB
Transfer

1331 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!