ozaltuntaslar.com.tr

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 89.252.188.133, located in Maya, Turkey and belongs to NETINTERNET, TR. The main domain is ozaltuntaslar.com.tr.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 7th 2017. Valid for: 3 months.

This is the only time ozaltuntaslar.com.tr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	89.252.188.133 89.252.188.133	51559 (NETINTERNET) (NETINTERNET)
5	206.214.208.95 206.214.208.95	25847 (SERVINT) (SERVINT - ServInt)
7	3

1 89.252.188.133 (Maya, Turkey)

ASN51559 (NETINTERNET, TR)

ozaltuntaslar.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 206.214.208.95 (Reston, United States)

ASN25847 (SERVINT - ServInt, US)
PTR: linux11.web4world.com

avi-products.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	avi-products.com avi-products.com Failed	839 KB
1	ozaltuntaslar.com.tr ozaltuntaslar.com.tr	158 B
7	2

	Domain	Requested by
5	avi-products.com	avi-products.com
1	ozaltuntaslar.com.tr
7	2

This site contains no links.

Subject Issuer	Validity	Valid
ozaltuntaslar.com.tr cPanel, Inc. Certification Authority	`2017-09-07` - `2017-12-06`	3 months	crt.sh
avi-products.com cPanel, Inc. Certification Authority	`2017-07-21` - `2017-10-19`	3 months	crt.sh

This page contains 2 frames:

Frame: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com
Frame ID: 17205.1
Requests: 2 HTTP requests in this frame

Frame: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com
Frame ID: 17230.1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

840 kB
Transfer

840 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://avi-products.com/-/Officeand365/Officeand365/?&email=bootyhole@google.com HTTP 302
https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response ozaltuntaslar.com.tr/	141 B 158 B	623ms 208ms	Document text/html	89.252.188.133 NETINTERNET
General Check archive.org Show headers Download Go to Full URL https://ozaltuntaslar.com.tr/?email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.252.188.133 Maya, Turkey, ASN51559 (NETINTERNET, TR), Reverse DNS Software Apache / Resource Hash `6a43e0e9c59e1c4ce3c8c4642e3e28d6224a3e81d3f67147f1845c2c9098394b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:13 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET		28evywmkcfmg18zylz2ww3x1.php avi-products.com/-/Officeand365/Officeand365/ Redirect Chain https://avi-products.com/-/Officeand365/Officeand365/?&email=bootyhole@google.com https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f7...	0 0

GET H/1.1	200 OK	28evywmkcfmg18zylz2ww3x1.php Show response avi-products.com/-/Officeand365/Officeand365/ Frame 1723	1 KB 1 KB	304ms 153ms	Document text/html	206.214.208.95 ServInt
General Check archive.org Show headers Download Go to Full URL https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 206.214.208.95 Reston, United States, ASN25847 (SERVINT - ServInt, US), Reverse DNS linux11.web4world.com Software Apache / PHP/5.6.30 Resource Hash `d18b40c2ec450f732ab8670864e9d551fe618ada6d94775f94860cdac317c6ce` Request headers Upgrade-Insecure-Requests 1 Referer https://ozaltuntaslar.com.tr/?email=bootyhole@google.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:14 GMT Server Apache Connection close X-Powered-By PHP/5.6.30 Content-Length 1398 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	main_css.css avi-products.com/-/Officeand365/Officeand365/images/ Frame 1723	2 KB 2 KB	452ms 150ms	Stylesheet text/css	206.214.208.95 ServInt
General Check archive.org Show headers Download Go to Full URL https://avi-products.com/-/Officeand365/Officeand365/images/main_css.css Requested by Host: avi-products.com URL: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 206.214.208.95 Reston, United States, ASN25847 (SERVINT - ServInt, US), Reverse DNS linux11.web4world.com Software Apache / Resource Hash `4dbf2e4f3fa2fd8ac6e90c25c45cd0140f4909a3949311de51cdbebea4e98ef2` Request headers Referer https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:14 GMT Last-Modified Mon, 14 Nov 2016 06:12:30 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 1995 Content-Type text/css
GET H/1.1	200 OK	index.css avi-products.com/-/Officeand365/Officeand365/images/ Frame 1723	2 KB 2 KB	452ms 150ms	Stylesheet text/css	206.214.208.95 ServInt
General Check archive.org Show headers Download Go to Full URL https://avi-products.com/-/Officeand365/Officeand365/images/index.css Requested by Host: avi-products.com URL: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 206.214.208.95 Reston, United States, ASN25847 (SERVINT - ServInt, US), Reverse DNS linux11.web4world.com Software Apache / Resource Hash `432477ad5a346fe74c9e22e6b2da7f7a7c63dfe3b44359ffe47734dc29e81f5c` Request headers Referer https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:14 GMT Last-Modified Mon, 14 Nov 2016 06:12:30 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 1996 Content-Type text/css
GET H/1.1	200 OK	1.png avi-products.com/-/Officeand365/Officeand365/images/ Frame 1723	804 KB 804 KB	452ms 151ms	Image image/png	206.214.208.95 ServInt
General Check archive.org Show headers Download Go to Show image Full URL https://avi-products.com/-/Officeand365/Officeand365/images/1.png Requested by Host: avi-products.com URL: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 206.214.208.95 Reston, United States, ASN25847 (SERVINT - ServInt, US), Reverse DNS linux11.web4world.com Software Apache / Resource Hash `ba05bef2d7327f4c6daa4bf96117d01c3cec21568a9a9769063c43cb32e97dc6` Request headers Referer https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:15 GMT Last-Modified Mon, 14 Nov 2016 04:28:52 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 822800 Content-Type image/png
GET H/1.1	200 OK	2.jpg avi-products.com/-/Officeand365/Officeand365/images/ Frame 1723	31 KB 31 KB	452ms 150ms	Image image/jpeg	206.214.208.95 ServInt
General Check archive.org Show headers Download Go to Show image Full URL https://avi-products.com/-/Officeand365/Officeand365/images/2.jpg Requested by Host: avi-products.com URL: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 206.214.208.95 Reston, United States, ASN25847 (SERVINT - ServInt, US), Reverse DNS linux11.web4world.com Software Apache / Resource Hash `db8891386f4086652a8f48f855dfc9f30b5710f4e325f2e6f9d63140921eb443` Request headers Referer https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Thu, 21 Sep 2017 19:23:15 GMT Last-Modified Wed, 22 Mar 2017 14:08:06 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 31321 Content-Type image/jpeg

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: avi-products.com
URL: https://avi-products.com/-/Officeand365/Officeand365/28evywmkcfmg18zylz2ww3x1.php?LA302415060217947f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a97157f79d2f584f8b388be9817c1f39a9715&email=bootyhole@google.com

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

avi-products.com
ozaltuntaslar.com.tr
avi-products.com
206.214.208.95
89.252.188.133
432477ad5a346fe74c9e22e6b2da7f7a7c63dfe3b44359ffe47734dc29e81f5c
4dbf2e4f3fa2fd8ac6e90c25c45cd0140f4909a3949311de51cdbebea4e98ef2
6a43e0e9c59e1c4ce3c8c4642e3e28d6224a3e81d3f67147f1845c2c9098394b
ba05bef2d7327f4c6daa4bf96117d01c3cec21568a9a9769063c43cb32e97dc6
d18b40c2ec450f732ab8670864e9d551fe618ada6d94775f94860cdac317c6ce
db8891386f4086652a8f48f855dfc9f30b5710f4e325f2e6f9d63140921eb443

ozaltuntaslar.com.tr Open in urlscan Pro 89.252.188.133 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

840 kBTransfer

840 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

ozaltuntaslar.com.tr Open in urlscan Pro
89.252.188.133 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

840 kB
Transfer

840 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!