page-recovery220887.esyadepolama.info.tr Open in urlscan Pro
89.252.172.74 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.page-recovery220887.esyadepolama.info.tr/
Effective URL:
https://page-recovery220887.esyadepolama.info.tr/
Submission: On October 07 via automatic, source certstream-suspicious (October 7th 2023, 4:26:13 am UTC) — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 89.252.172.74, located in Turkey and belongs to NETINTERNET Netinternet Bilisim Teknolojileri AS, TR. The main domain is page-recovery220887.esyadepolama.info.tr.
TLS certificate: Issued by R3 on October 7th 2023. Valid for: 3 months.

This is the only time page-recovery220887.esyadepolama.info.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3 9	89.252.172.74 89.252.172.74	51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS)
1	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
7	3

9 89.252.172.74 (Turkey) 3 redirects

ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)

www.page-recovery220887.esyadepolama.info.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
page-recovery220887.esyadepolama.info.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	esyadepolama.info.tr 3 redirects www.page-recovery220887.esyadepolama.info.tr page-recovery220887.esyadepolama.info.tr	213 KB
1	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 957
7	2

	Domain	Requested by
6	page-recovery220887.esyadepolama.info.tr	1 redirects page-recovery220887.esyadepolama.info.tr
3	www.page-recovery220887.esyadepolama.info.tr	2 redirects
1	static.xx.fbcdn.net	page-recovery220887.esyadepolama.info.tr
7	3

This site contains no links.

Subject Issuer	Validity	Valid
www.page-recovery220887.esyadepolama.info.tr R3	`2023-10-07` - `2024-01-05`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-15` - `2023-10-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://page-recovery220887.esyadepolama.info.tr/
Frame ID: E81FA1E5A81AFC2102930DDEBA5D1595
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Restrictions Information

Page URL History Show full URLs

https://www.page-recovery220887.esyadepolama.info.tr/ Page URL
https://www.page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23986922 HTTP 302
https://www.page-recovery220887.esyadepolama.info.tr/ HTTP 301
https://page-recovery220887.esyadepolama.info.tr/ Page URL
https://page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7611836 HTTP 302
https://page-recovery220887.esyadepolama.info.tr/ Page URL

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

212 kB
Transfer

622 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.page-recovery220887.esyadepolama.info.tr/ Page URL
https://www.page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23986922 HTTP 302
https://www.page-recovery220887.esyadepolama.info.tr/ HTTP 301
https://page-recovery220887.esyadepolama.info.tr/ Page URL
https://page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7611836 HTTP 302
https://page-recovery220887.esyadepolama.info.tr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://www.page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23986922 HTTP 302
https://www.page-recovery220887.esyadepolama.info.tr/ HTTP 301
https://page-recovery220887.esyadepolama.info.tr/

7 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response www.page-recovery220887.esyadepolama.info.tr/	1 KB 2 KB	367ms 76ms	Document text/html	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Full URL https://www.page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash `5dd2437e405744d4e67dd5ad2f756a23742abf876f88534fa251ef4c3096bd3e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 cf-edge-cache no-cache content-type text/html date Sat, 07 Oct 2023 04:26:07 GMT last-modified Saturday, 07-Oct-2023 04:26:07 GMT server imunify360-webshield/1.21
GET H2	200	/ page-recovery220887.esyadepolama.info.tr/ Redirect Chain https://www.page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23986922 https://www.page-recovery220887.esyadepolama.info.tr/ https://page-recovery220887.esyadepolama.info.tr/	1 KB 2 KB	170ms 58ms	Document text/html	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Full URL https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash Request headers Referer https://www.page-recovery220887.esyadepolama.info.tr/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 cf-edge-cache no-cache content-type text/html date Sat, 07 Oct 2023 04:26:08 GMT last-modified Saturday, 07-Oct-2023 04:26:08 GMT server imunify360-webshield/1.21 Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 707 content-type text/html date Sat, 07 Oct 2023 04:26:07 GMT location https://page-recovery220887.esyadepolama.info.tr/ server imunify360-webshield/1.21 vary User-Agent
GET H2	200	Primary Request / Show response page-recovery220887.esyadepolama.info.tr/ Redirect Chain https://page-recovery220887.esyadepolama.info.tr/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7611836 https://page-recovery220887.esyadepolama.info.tr/	14 KB 4 KB	72ms 71ms	Document text/html	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Full URL https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash `ce5c586b767d5f4dd9364b2126d45e5c5ef0b8727b46cab5c9d2bc5c1dc44b94` Request headers Referer https://page-recovery220887.esyadepolama.info.tr/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-type text/html; charset=UTF-8 date Sat, 07 Oct 2023 04:26:08 GMT server imunify360-webshield/1.21 vary Accept-Encoding,User-Agent Redirect headers content-length 142 content-type text/html date Sat, 07 Oct 2023 04:26:08 GMT location https://page-recovery220887.esyadepolama.info.tr server imunify360-webshield/1.21
GET H2	200	1D8erEf3S9.css page-recovery220887.esyadepolama.info.tr/asset/css/	505 KB 152 KB	117ms 116ms	Stylesheet text/css	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Full URL https://page-recovery220887.esyadepolama.info.tr/asset/css/1D8erEf3S9.css Requested by Host: page-recovery220887.esyadepolama.info.tr URL: https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash `9be6fcd99b4925b0428087f59d20245466827164a26b795d3169a6b578ef8476` Request headers accept-language de-DE,de;q=0.9 Referer https://page-recovery220887.esyadepolama.info.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 04:26:08 GMT content-encoding br last-modified Wed, 12 Jul 2023 01:15:27 GMT server imunify360-webshield/1.21 vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 155132 expires Sat, 14 Oct 2023 04:26:08 GMT
GET H2	200	4fGxs96Xxc.css page-recovery220887.esyadepolama.info.tr/asset/css/	52 KB 5 KB	179ms 179ms	Stylesheet text/css	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Full URL https://page-recovery220887.esyadepolama.info.tr/asset/css/4fGxs96Xxc.css Requested by Host: page-recovery220887.esyadepolama.info.tr URL: https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash `12702066a2a9e7bb44d1cfdba4129a6b0cb23188f62a9e6935a65ae775ac5ab7` Request headers accept-language de-DE,de;q=0.9 Referer https://page-recovery220887.esyadepolama.info.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 04:26:08 GMT content-encoding br last-modified Wed, 12 Jul 2023 01:15:27 GMT server imunify360-webshield/1.21 vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 4688 expires Sat, 14 Oct 2023 04:26:08 GMT
GET H2	200	MetaSecure.png page-recovery220887.esyadepolama.info.tr/asset/img/	48 KB 48 KB	60ms 60ms	Image image/png	89.252.172.74 NETINTERNET Netin...
General Check archive.org Show headers Download Go to Show image Full URL https://page-recovery220887.esyadepolama.info.tr/asset/img/MetaSecure.png Requested by Host: page-recovery220887.esyadepolama.info.tr URL: https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.252.172.74 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR), Reverse DNS Software imunify360-webshield/1.21 / Resource Hash `545c3781cff9f7114a31b0de7323250d7abbbea4c567cabd7025efb0f6a290e9` Request headers accept-language de-DE,de;q=0.9 Referer https://page-recovery220887.esyadepolama.info.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 04:26:08 GMT last-modified Wed, 12 Jul 2023 01:15:27 GMT server imunify360-webshield/1.21 vary User-Agent content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 49084 expires Sat, 14 Oct 2023 04:26:08 GMT
GET H2	404	espe7X_o_zC.png static.xx.fbcdn.net/rsrc.php/v3/y5/r/	0 0	59ms 41ms	Image text/html	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/espe7X_o_zC.png Requested by Host: page-recovery220887.esyadepolama.info.tr URL: https://page-recovery220887.esyadepolama.info.tr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://page-recovery220887.esyadepolama.info.tr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	135 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.www.page-recovery220887.esyadepolama.info.tr/	1970-01-20 16:00:44	Name: wschkid Value: 00195b43c28dfd5dc91b0812105d62a0523e353b.1696739167.1
			.page-recovery220887.esyadepolama.info.tr/	1970-01-20 16:00:44	Name: wschkid Value: fc9440f817d96b6760259b1db50fdf34911c8b53.1696739168.1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/espe7X_o_zC.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

page-recovery220887.esyadepolama.info.tr
static.xx.fbcdn.net
www.page-recovery220887.esyadepolama.info.tr
2a03:2880:f084:d:face:b00c:0:3
89.252.172.74
12702066a2a9e7bb44d1cfdba4129a6b0cb23188f62a9e6935a65ae775ac5ab7
545c3781cff9f7114a31b0de7323250d7abbbea4c567cabd7025efb0f6a290e9
5dd2437e405744d4e67dd5ad2f756a23742abf876f88534fa251ef4c3096bd3e
9be6fcd99b4925b0428087f59d20245466827164a26b795d3169a6b578ef8476
c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675
ce5c586b767d5f4dd9364b2126d45e5c5ef0b8727b46cab5c9d2bc5c1dc44b94
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

page-recovery220887.esyadepolama.info.tr Open in urlscan Pro 89.252.172.74 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

212 kBTransfer

622 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

page-recovery220887.esyadepolama.info.tr Open in urlscan Pro
89.252.172.74 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

212 kB
Transfer

622 kB
Size

2
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!