blog1.zip.web.tr Open in urlscan Pro
194.116.229.5 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog1.zip.web.tr/
Effective URL:
https://blog1.zip.web.tr/yonetim/kur.php
Submission Tags: @phish_report
Submission: On May 24 via api (May 24th 2024, 9:12:45 pm UTC) from FI — Scanned from AU

Summary HTTP 9 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 194.116.229.5, located in Turkey and belongs to AS212219, TR. The main domain is blog1.zip.web.tr.
TLS certificate: Issued by R3 on May 24th 2024. Valid for: 3 months.

This is the only time blog1.zip.web.tr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 7	194.116.229.5 194.116.229.5		215181 (AS212219) (AS212219)
1	142.250.204.10 142.250.204.10		15169 (GOOGLE) (GOOGLE)
1	151.101.66.137 151.101.66.137		54113 (FASTLY) (FASTLY)
9	4

7 194.116.229.5 (Turkey) 1 redirects

ASN215181 (AS212219, TR)
PTR: server.uzmanhosting.net.tr

blog1.zip.web.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.204.10 (United States)

ASN15169 (GOOGLE, US)
PTR: syd09s25-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	zip.web.tr 1 redirects blog1.zip.web.tr	28 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	105 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380 fonts.googleapis.com Failed	33 KB
9	3

	Domain	Requested by
7	blog1.zip.web.tr	1 redirects blog1.zip.web.tr
1	code.jquery.com	blog1.zip.web.tr
1	ajax.googleapis.com	blog1.zip.web.tr
0	fonts.googleapis.com Failed	blog1.zip.web.tr
9	4

This site contains no links.

Subject Issuer	Validity	Valid
blog1.zip.web.tr R3	`2024-05-24` - `2024-08-22`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://blog1.zip.web.tr/yonetim/kur.php
Frame ID: 8C45626580D90459171017801CA25034
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Basit Blog Kurulum

Page URL History Show full URLs

http://blog1.zip.web.tr/ HTTP 307
https://blog1.zip.web.tr/ HTTP 302
https://blog1.zip.web.tr/yonetim/kur.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

167 kB
Transfer

678 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog1.zip.web.tr/ HTTP 307
https://blog1.zip.web.tr/ HTTP 302
https://blog1.zip.web.tr/yonetim/kur.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request kur.php Show response
blog1.zip.web.tr/yonetim/
Redirect Chain

http://blog1.zip.web.tr/
https://blog1.zip.web.tr/
https://blog1.zip.web.tr/yonetim/kur.php

4 KB
1 KB

360ms
359ms

Document
text/html

194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: / PHP/7.2.34
Resource Hash: 6f6edfc30c45e2a7b0b7c5820a39d1e32f7fb8f83eae7be4175af67df34e4106

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 957
content-type: text/html; charset=UTF-8
date: Fri, 24 May 2024 21:12:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
vary: Accept-Encoding
x-powered-by: PHP/7.2.34

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 24 May 2024 21:12:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: yonetim/kur.php
pragma: no-cache
x-powered-by: PHP/7.2.34

GET
H3 200 bootstrap.min.css
blog1.zip.web.tr/inc/css/ 98 KB
14 KB 960ms
959ms Stylesheet
text/css 194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/inc/css/bootstrap.min.css
Requested by: Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: /
Resource Hash: e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/yonetim/kur.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 24 May 2024 21:12:40 GMT
content-encoding: br
last-modified: Wed, 23 Jul 2014 08:39:18 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 14084
expires: Fri, 31 May 2024 21:12:40 GMT

GET
H3 200 font-awesome.min.css
blog1.zip.web.tr/inc/css/ 20 KB
4 KB 958ms
956ms Stylesheet
text/css 194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/inc/css/font-awesome.min.css
Requested by: Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: /
Resource Hash: b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/yonetim/kur.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 24 May 2024 21:12:40 GMT
content-encoding: br
last-modified: Wed, 23 Jul 2014 08:39:18 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3767
expires: Fri, 31 May 2024 21:12:40 GMT

GET
H3 200 stil.min.css
blog1.zip.web.tr/yonetim/inc/css/ 7 KB
2 KB 958ms
957ms Stylesheet
text/css 194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/yonetim/inc/css/stil.min.css
Requested by: Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: /
Resource Hash: 55d4294922f79681ae6c7ed6b5f759b3a48683e4704b65cbb2f8cfcdd9433907

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/yonetim/kur.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 24 May 2024 21:12:40 GMT
content-encoding: br
last-modified: Wed, 23 Jul 2014 08:39:18 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1608
expires: Fri, 31 May 2024 21:12:40 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ 94 KB
33 KB 114ms
2ms Script
text/javascript 142.250.204.10
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js

Requested by

Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.10 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s25-in-f10.1e100.net

Software

sffe /

Resource Hash

b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 22 May 2024 01:49:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242593
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33576
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 May 2025 01:49:27 GMT

GET
H2 200 jquery-ui.js Show response
code.jquery.com/ui/1.10.4/ 426 KB
105 KB 17ms
4ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.10.4/jquery-ui.js
Requested by: Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b69f1567863d760ef4dabec3eb29f349abca4b007dce36ab8926784a7babbe6c

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 24 May 2024 21:12:40 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 17766186
x-cache: HIT, HIT
content-length: 107515
x-served-by: cache-lga13621-LGA, cache-syd10146-SYD
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1716585160.109806,VS0,VE0
etag: W/"28feccc0-6a9eb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 2, 3161

GET
H3 200 bootstrap.min.js Show response
blog1.zip.web.tr/inc/js/ 28 KB
7 KB 1019ms
1019ms Script
text/javascript 194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/inc/js/bootstrap.min.js
Requested by: Host: blog1.zip.web.tr
URL: https://blog1.zip.web.tr/yonetim/kur.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: /
Resource Hash: 898d05a17f2cfc5120ddcdba47a885c378c0b466f30f0700e502757e24b403a1

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/yonetim/kur.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 24 May 2024 21:12:40 GMT
content-encoding: br
last-modified: Wed, 23 Jul 2014 08:39:18 GMT
accept-ranges: bytes
content-length: 6816
vary: Accept-Encoding
content-type: text/javascript

GET css
fonts.googleapis.com/ 0
0

GET
H3 404 favicon.ico
blog1.zip.web.tr/ 708 B
812 B 341ms
341ms Other
text/html 194.116.229.5
AS212219

General

Check archive.org

Show headers Download Go to

Full URL: https://blog1.zip.web.tr/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 194.116.229.5 , Turkey, ASN215181 (AS212219, TR),
Reverse DNS: server.uzmanhosting.net.tr
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://blog1.zip.web.tr/yonetim/kur.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Fri, 24 May 2024 21:12:41 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
content-type: text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Oswald|Roboto:400,400italic,700,700italic&subset=latin-ext,latin

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jQuery111008261224200449349

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			blog1.zip.web.tr/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8681f6ecadc6051fc4b9e8e1d86a8f31

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://blog1.zip.web.tr/yonetim/kur.php(Line 16) Message: Mixed Content: The page at 'https://blog1.zip.web.tr/yonetim/kur.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Oswald\|Roboto:400,400italic,700,700italic&subset=latin-ext,latin'. This request has been blocked; the content must be served over HTTPS.
network	error	URL: https://blog1.zip.web.tr/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
blog1.zip.web.tr
code.jquery.com
fonts.googleapis.com
fonts.googleapis.com
142.250.204.10
151.101.66.137
194.116.229.5
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
55d4294922f79681ae6c7ed6b5f759b3a48683e4704b65cbb2f8cfcdd9433907
6f6edfc30c45e2a7b0b7c5820a39d1e32f7fb8f83eae7be4175af67df34e4106
898d05a17f2cfc5120ddcdba47a885c378c0b466f30f0700e502757e24b403a1
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b69f1567863d760ef4dabec3eb29f349abca4b007dce36ab8926784a7babbe6c
b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0
e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b