![](/screenshots/d8a93ef5-567a-422f-a8b5-a8813d1f62f6.png)
besikcioglu.com.tr
Open in
urlscan Pro
89.163.214.157
Malicious Activity!
Public Scan
Effective URL: https://besikcioglu.com.tr/domains/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=LfEmAipZ95FzPMoLXz7...
Submission: On November 24 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on September 26th 2023. Valid for: 3 months.
This is the only time besikcioglu.com.tr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TSB Bank (Banking) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 148.72.80.248 148.72.80.248 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
6 | 89.163.214.157 89.163.214.157 | 24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG) | |
7 | 2 |
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 248.80.72.148.host.secureserver.net
appboletos.com |
ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: vps2415162.dedi.server-hosting.expert
besikcioglu.com.tr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
besikcioglu.com.tr
besikcioglu.com.tr |
151 KB |
1 |
appboletos.com
appboletos.com |
200 B |
7 | 2 |
Domain | Requested by | |
---|---|---|
6 | besikcioglu.com.tr |
appboletos.com
besikcioglu.com.tr |
1 | appboletos.com | |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.appboletos.com R3 |
2023-10-22 - 2024-01-20 |
3 months | crt.sh |
*.besikcioglu.com.tr R3 |
2023-09-26 - 2023-12-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://besikcioglu.com.tr/domains/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=LfEmAipZ95FzPMoLXz7wPvTRdBMD95JszTPIAOzaCWImfzG4U46oZNyjBMsjG8y0OXQFTPgFEMP6q0mY
Frame ID: 991DDCC1C6848C8147A4A00CCC6DD16D
Requests: 7 HTTP requests in this frame
Screenshot
![](/screenshots/d8a93ef5-567a-422f-a8b5-a8813d1f62f6.png)
Page Title
LoginPage URL History Show full URLs
- https://appboletos.com/assets/images/login.php Page URL
- https://besikcioglu.com.tr/domains/TSB/TSB/ Page URL
- https://besikcioglu.com.tr/domains/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://appboletos.com/assets/images/login.php Page URL
- https://besikcioglu.com.tr/domains/TSB/TSB/ Page URL
- https://besikcioglu.com.tr/domains/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=LfEmAipZ95FzPMoLXz7wPvTRdBMD95JszTPIAOzaCWImfzG4U46oZNyjBMsjG8y0OXQFTPgFEMP6q0mY Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
login.php
appboletos.com/assets/images/ |
125 B 200 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
besikcioglu.com.tr/domains/TSB/TSB/ |
563 B 816 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
soa.js
besikcioglu.com.tr/domains/TSB/TSB/ |
20 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
besikcioglu.com.tr/domains/TSB/TSB/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
soa.js
besikcioglu.com.tr/domains/TSB/TSB/ |
20 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
continue.png
besikcioglu.com.tr/domains/TSB/TSB/assets/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.png
besikcioglu.com.tr/domains/TSB/TSB/ |
135 KB 136 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TSB Bank (Banking) Generic (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
besikcioglu.com.tr/ | Name: PHPSESSID Value: ec5c36b3adf3144a22a8aa88ea9cfec2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
appboletos.com
besikcioglu.com.tr
148.72.80.248
89.163.214.157
618b0e96c6bf41f64cb14c9c32219f278311936e6cf5a7ba832230389db3ccb0
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
b6306c6795649fd97ea206b8530357afb62cef0d10f95626221f83da5cd9e718
d22a8fec25e0f44176ac92b1b8adeb7e3a1222be1f0fdb8b7382c02800252d08
fcb24cc78048d39e9c3f162214b403829685fde8fa1fc9646db578fbc39b759a