![](/screenshots/bc86cdf7-c51b-4d0e-92a6-af7b2e7d8a1a.png)
197-1-2-78-2-1.online
Open in
urlscan Pro
45.95.146.98
Malicious Activity!
Public Scan
Effective URL: https://197-1-2-78-2-1.online/
Submission: On June 17 via api from TR — Scanned from NL
Summary
TLS certificate: Issued by R11 on June 17th 2024. Valid for: 3 months.
This is the only time 197-1-2-78-2-1.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Vakifbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 45.95.146.98 45.95.146.98 | 49870 (AS49870-BV) (AS49870-BV) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::200a | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 3 |
ASN49870 (AS49870-BV, NL)
PTR: env-prime13.contaprotegida.co
197-1-2-78-2-1.online |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
197-1-2-78-2-1.online
197-1-2-78-2-1.online |
86 KB |
6 |
gstatic.com
fonts.gstatic.com |
82 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 77 |
1 KB |
21 | 3 |
Domain | Requested by | |
---|---|---|
14 | 197-1-2-78-2-1.online |
197-1-2-78-2-1.online
|
6 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
197-1-2-78-2-1.online
|
21 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
197-1-2-78-2-1.online R11 |
2024-06-17 - 2024-09-15 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://197-1-2-78-2-1.online/
Frame ID: 6173FD56D9096A3B0225E4D8A00100E1
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/bc86cdf7-c51b-4d0e-92a6-af7b2e7d8a1a.png)
Page Title
VakıfBank İnternet BankacılığıPage URL History Show full URLs
-
http://197-1-2-78-2-1.online/
HTTP 307
https://197-1-2-78-2-1.online/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://197-1-2-78-2-1.online/
HTTP 307
https://197-1-2-78-2-1.online/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
197-1-2-78-2-1.online/ Redirect Chain
|
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
197-1-2-78-2-1.online/dist/ |
18 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vakifbank-logo.svg
197-1-2-78-2-1.online/dist/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vakifbank-logo-white.svg
197-1-2-78-2-1.online/dist/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qr_entry_tr.svg
197-1-2-78-2-1.online/dist/ |
34 KB 34 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
secure-globalsign-ssl.png
197-1-2-78-2-1.online/dist/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play.jpg
197-1-2-78-2-1.online/dist/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store.jpg
197-1-2-78-2-1.online/dist/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
197-1-2-78-2-1.online/dist/ |
47 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keyboard.svg
197-1-2-78-2-1.online/dist/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-shield.png
197-1-2-78-2-1.online/dist/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
197-1-2-78-2-1.online/ |
1 KB 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
fakesocket.php
197-1-2-78-2-1.online/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
fakesocket.php
197-1-2-78-2-1.online/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Vakifbank (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| _0x1a function| _0x7e1a function| _0xf5910g object| visitors function| ast_excute function| _0xad3c function| _0x89c7eb function| _0xd1ec0a function| _0x95a1db function| _0x296f7a function| _0xa3e8ed function| _0x85f27d function| _0xa function| _0x8e884c function| _0x7g8b function| _0x028f8b function| _0xce42e function| _0x901b1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
197-1-2-78-2-1.online/ | Name: PHPSESSID Value: 0k3nkguaf5nflcskn2fk10c31d |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
197-1-2-78-2-1.online
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:827::2003
2a00:1450:4001:82b::200a
45.95.146.98
0e8c81e455a1c214d6907ace3553cba24d23ef771246e3776568a5dd9166585a
1d98ff4e153149c0d4fd725fb9dd878e2de83ac30e52dbadbb3fdf1a0853fe93
22b4e5c5489c64b15b67e78d962dbec29af1a3022d9162a65fa9b43fafa7f27c
2781e9e7c3f369b8fc7965e679b17b60b5b11eaae5da1e5045107bbdd9d568f0
287443306280e15dc7f73942c6dfb8b1d9b3b787f6d18488a49ac12863190ae1
39a25c2ec4b3d23aca5b6b93c880100997c6a3809ccbfcd1e5204d3f0dd97e24
3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431
42e3aa6d662901ad9a1a467a06d2ea7514451ad93b1fda75bc093374aba78290
463991336704eac1867214666e23fe6ff459f9c050991e454a3d494b67d6a47a
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
9d39d3cb5e7555520fb55b849bbdc8a3c525c519d3d4e2d1bccf3022c145de30
a137095fc3e621e7d32a0134fb1022348219e0a844740d83c816839d3253d8c1
a67c88e421e727b242f6a7371ba7f181e8daef190a1d9da9c3688862fa234f3b
ecf0f6192658b9f4eb288b8353e2f84a4be9c3b2d8f0365f0539e7556558bf2b
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f9b3eeb4e4348dde16556d18e4b8d9dee807fe41412550df5c7d6d3a6e91ebf6
fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b
fedf4740b9ae487ac387afe5ac91b724a7a0c9fc05680b9f024ccc37ebb7772b