ziraat-ba.com
Open in
urlscan Pro
148.163.67.138
Malicious Activity!
Public Scan
Effective URL: https://ziraat-ba.com/
Submission: On October 10 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 31st 2022. Valid for: 3 months.
This is the only time ziraat-ba.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ziraat Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 30 | 148.163.67.138 148.163.67.138 | 53755 (IOFLOOD) (IOFLOOD) | |
29 | 1 |
ASN53755 (IOFLOOD, US)
PTR: budget4.noc401.com
ziraat-ba.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
30 |
ziraat-ba.com
1 redirects
ziraat-ba.com |
2 MB |
29 | 1 |
Domain | Requested by | |
---|---|---|
30 | ziraat-ba.com |
1 redirects
ziraat-ba.com
|
29 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ziraatbank.com.tr |
kurumsal.ziraatbank.com.tr |
www.facebook.com |
twitter.com |
instagram.com |
www.youtube.com |
www.linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ziraat-ba.com R3 |
2022-08-31 - 2022-11-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ziraat-ba.com/
Frame ID: 7AE4EF43EAFC24CC6BDA329943269B2D
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
Ziraat BankasıPage URL History Show full URLs
-
http://ziraat-ba.com/
HTTP 301
https://ziraat-ba.com/ Page URL
Detected technologies
Microsoft ASP.NET (Web Frameworks) ExpandDetected patterns
- <input[^>]+name="__VIEWSTATE
Yandex.Metrika (Analytics) Expand
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: POS Services
Search URL Search Domain Scan URL
Title: (This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Facebook(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Twitter(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Instagram(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Youtube(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Linkedin(This page will be opened in new tab)
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ziraat-ba.com/
HTTP 301
https://ziraat-ba.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ziraat-ba.com/ Redirect Chain
|
50 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
magiclick.minbdd8.css
ziraat-ba.com/SiteAssets/css/min/ |
540 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mesafeni-koru-modal.png
ziraat-ba.com/SiteAssets/images/ |
346 KB 346 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-app-modal-img.jpg
ziraat-ba.com/SiteAssets/images/ |
134 KB 134 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min0466.js
ziraat-ba.com/SiteAssets/js/min/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ziraat-ba.com/SiteAssets/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent.png
ziraat-ba.com/SiteAssets/images/ |
924 B 978 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat-bot-img.png
ziraat-ba.com/siteassets/images/ |
708 B 708 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
intro-modal-2.jpg
ziraat-ba.com/SiteAssets/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
magiclick.min70c4.js
ziraat-ba.com/SiteAssets/js/min/ |
1 MB 331 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homePage.min4ebc.js
ziraat-ba.com/SiteAssets/js/min/ |
134 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.smartbanner.js
ziraat-ba.com/SiteAssets/js/jquery/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cbot-ziraatbilge-generatord754.js
ziraat-ba.com/api.ziraatbank.com.tr/inbound/cbot/static-files/web/js/widget/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Book.otf
ziraat-ba.com/SiteAssets/fonts/ |
59 KB 30 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
calculator-bg.jpg
ziraat-ba.com/SiteAssets/images/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Medium.otf
ziraat-ba.com/SiteAssets/fonts/ |
61 KB 31 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en-yakin-ziraat.jpg
ziraat-ba.com/SiteAssets/images/ |
232 KB 232 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoone81c.html
ziraat-ba.com/SiteAssets/fonts/ |
25 KB 25 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Bold.otf
ziraat-ba.com/SiteAssets/fonts/ |
61 KB 31 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FBLogin.aspx
ziraat-ba.com/en/_layouts/15/Ziraat/Social/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
watch.js
ziraat-ba.com/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bpbanners.aspx
ziraat-ba.com/SitePages/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetZiraatVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetPiyasaVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetZiraatVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetPiyasaVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent.png
ziraat-ba.com/SiteAssets/images/ |
924 B 951 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screenshot%202022-08-20%20101651.png
ziraat-ba.com/bk/ |
390 KB 390 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screenshot%202022-08-20%20101651.png
ziraat-ba.com/bk/ |
390 KB 390 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ziraat Bank (Banking)149 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| RegisterSod function| removeAllStatus function| RegisterSodDep function| AttachEvent function| UpdateFormDigest function| GetUrlFromWebUrlAndWebRelativeUrl object| _spBodyOnLoadFunctionNames object| WPSC object| g_updateFormDigestPageLoaded object| _spPageContextInfo string| langUrl string| webRelURL number| digestRefreshInterval function| $ function| jQuery object| theForm function| __doPostBack string| MSOWebPartPageFormName function| WebForm_OnSubmit function| submitHook number| vadeGunMin number| vadeGunMax object| vadeAyMax number| BaslangicTutar number| BitisTutar object| formDigestElement number| _spFormDigestRefreshInterval boolean| _fV4UI object| CryptoJS function| tryRefreshDigest object| ReturnCodes object| ieBrowser object| touchBrowser boolean| isMobile boolean| isMobileRecourse object| jsResources function| ZiraatModule object| Ziraat function| SocialUserLogined function| SocialChecked function| RefreshCaptcha function| uiBlock string| inDesignMode boolean| spMode string| siteLanguage undefined| jsName undefined| jsNameTwo object| globalPage object| socialLoginWindow object| globalSlider function| setFooter object| subPageConfig object| calculateSliderBox object| sliderMonth object| sliderPrice object| creditPrice object| creditSelect object| totalPrice object| creditRate number| vadeData object| calcPrice undefined| priceData number| userFaizOrani object| BaslangicTtr object| BitisTtr object| subPageCalculate object| stElement object| sonradanTaksitlendirme object| tnaElement object| taksitliNakitAvans object| dovizCeviriciElement object| dovizCevirici object| formPage object| formValidate function| CalcIBAN function| CalcIBAN9X function| FormatIBAN function| PadZeroes function| GetCharCode function| GetCharTable function| calculateChecksum function| mod97 object| $selectBox object| MODULES undefined| _token function| getUrlVars function| paymentOk function| paymentFail object| closeValidation object| orderID undefined| selectFormValue object| creditNo undefined| InputsArray undefined| Inputs undefined| InputsProp object| newInputs string| sessionDataTemp string| ua boolean| isAndroid object| createjs object| JSON3 function| Inputmask object| Browser function| _ function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| ProgressBar function| lazyload function| LazyLoad object| lottie object| bodymovin object| hopscotch function| moment object| Popper object| _inputboxelement object| _inputBox object| _0x9bd5 object| homePageCalculateElement undefined| uiValue object| homePageCalculate number| ziraatInterval undefined| piyasaInterval object| homePageConfig object| AdobeAn undefined| homeiconkredi undefined| homeiconkart undefined| homeiconsigorta undefined| homeiconemeklilik function| IScroll function| fp_offsetSectionsExtension object| yandex_metrika_callbacks object| data string| currentTabIndex string| storedTabIndex object| mat1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ziraat-ba.com/ | Name: mobile-app-modal Value: 1 |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ziraat-ba.com
148.163.67.138
0302dbdff5bad8708d4d7027825dd040ca3a1550fb208ace34bf4d952e1c6ef4
038a09d5c14212e13cf97fb6c9986af317881859ec5306908de31f529630ec2b
24489d37a4f37a51da7ca075defba5ea657b967964113199c4f6439f3c02cd5f
277fbc0e7cab340b007addc4812b701d115ae5be9a7d03a509b2c5811727b89b
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
6dbea73719feeeddf4eeec62e2227a246fedc4cf4b1997410ec225a73895316c
734f38cbfcc17f7bbce11e3f73c17487a7e62e3a08d22f8240862a1daae423d8
76db5e4ab6590faf76dd3ea357976c37f58aec4ef2979312aa89d317bbbad56c
880c1e133675bb5cae2d90b00d916d311e75a3e2b37c8dcde55796ced37a04e7
9916b20e0e346a808aa3d33641d98263c4b1b27f67f0b091004021c91652cc72
9e62bbd51aa1cffa92e06b049ed6882fc94af0a6891b6de2eb1d515d2b027e2d
a336639240d71effd17416cf26e38a06fc3bf1f3a64fbac04b3f1970f2d55c0b
a643765cbd8944eddbd34bb7429b9ca6a576963da21c5cfbb7c56fd131adb9bb
aa8a40c7d040c62e5d7963281173bbc700f2fd64892ee1e81af2fc7e09694c66
b5d8f198b23f420470a91d8462b8cd1fb5fc2070fe4437282402344215496b17
dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638
dcd2488d4f219c45db61e690c1efd5c58726f37ff1afb6a0af7ba07608a1256e
e2e9f2b3b062193e47ee0ff3bdcc1dd8b4185670dc783679c79fcb752d3b2f04
e825d4f06e1988699280f0d8813dbdc85114bc97a5366760d7df48040b211774