![](/screenshots/e40723c6-d685-4f19-83fb-527f666a510e.png)
mail.turkiyecumhuriyetiziraatbankasi.com
Open in
urlscan Pro
162.240.37.219
Malicious Activity!
Public Scan
Submission: On June 28 via api from US — Scanned from DE
Summary
This is the only time mail.turkiyecumhuriyetiziraatbankasi.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ziraat Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
25 | 162.240.37.219 162.240.37.219 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
25 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: server.bcginc.co.uk
mail.turkiyecumhuriyetiziraatbankasi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
turkiyecumhuriyetiziraatbankasi.com
mail.turkiyecumhuriyetiziraatbankasi.com |
3 MB |
25 | 1 |
Domain | Requested by | |
---|---|---|
25 | mail.turkiyecumhuriyetiziraatbankasi.com |
mail.turkiyecumhuriyetiziraatbankasi.com
|
25 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ziraatbank.com.tr |
bireysel.ziraatbank.com.tr |
kurumsal.ziraatbank.com.tr |
www.facebook.com |
twitter.com |
instagram.com |
www.youtube.com |
www.linkedin.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html
Frame ID: FFF291D5C31D89BBDF225B204F542AC8
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/e40723c6-d685-4f19-83fb-527f666a510e.png)
Page Title
Cards | Retail | Ziraat BankasıPage URL History Show full URLs
-
http://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html
HTTP 307
https://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html HTTP 307
http://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html Page URL
Detected technologies
![](/vendor/wappa/icons/Microsoft ASP.NET.png)
Detected patterns
- <input[^>]+name="__VIEWSTATE
![](/vendor/wappa/icons/Yandex.Metrika.png)
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: POS Services
Search URL Search Domain Scan URL
Title: PERSONAL(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: CORPORATE(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Facebook(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Twitter(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Instagram(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Youtube(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Linkedin(This page will be opened in new tab)
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html
HTTP 307
https://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html HTTP 307
http://mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/cards.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
cards.html
mail.turkiyecumhuriyetiziraatbankasi.com/en/retail/ Redirect Chain
|
50 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
magiclick.min2ec1.css
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/css/min/ |
558 KB 558 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.minaded.js
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/js/min/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
magiclick.min37ba.js
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/js/min/ |
1 MB 1 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.smartbanner.js
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/js/jquery/ |
16 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cbot-ziraatbilge-generator473d.js
mail.turkiyecumhuriyetiziraatbankasi.com/api.ziraatbank.com.tr/inbound/cbot/static-files/web/js/widget/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mesafeni-koru-modal.png
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
346 KB 346 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-app-modal-img.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
73 KB 73 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
landing.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
381 KB 381 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Book.otf
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/fonts/ |
59 KB 60 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow.png
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
959 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dd-arrow.png
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dd-arrow-sub.png
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
958 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icomoonc2a0.woff2
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/fonts/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Medium.otf
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/fonts/ |
61 KB 61 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GothamNarrow-Light.otf
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/fonts/ |
59 KB 59 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FBLogin.aspx
mail.turkiyecumhuriyetiziraatbankasi.com/en/_layouts/15/Ziraat/Social/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
watch.js
mail.turkiyecumhuriyetiziraatbankasi.com/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Combo_Kartlar.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/PublishingImages/Subpage/bireysel/kartlar/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bank_Kart.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/PublishingImages/Landing/bireysel/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bankkart_Genc.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/PublishingImages/Subpage/bireysel/kartlar/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Yurtici_ATM_Paylasim.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/PublishingImages/Landing/bireysel/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Internette_Guvenli_Alisveris.jpg
mail.turkiyecumhuriyetiziraatbankasi.com/PublishingImages/Landing/bireysel/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
mail.turkiyecumhuriyetiziraatbankasi.com/SiteAssets/images/ |
11 KB 11 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ziraat Bank (Banking)122 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence function| RegisterSod function| removeAllStatus function| RegisterSodDep function| AttachEvent function| UpdateFormDigest function| GetUrlFromWebUrlAndWebRelativeUrl object| _spBodyOnLoadFunctionNames object| WPSC object| g_updateFormDigestPageLoaded object| _spPageContextInfo string| langUrl string| webRelURL number| digestRefreshInterval function| $ function| jQuery object| theForm function| __doPostBack string| MSOWebPartPageFormName function| WebForm_OnSubmit function| submitHook object| navigationContainer object| formDigestElement number| _spFormDigestRefreshInterval boolean| _fV4UI object| CryptoJS function| tryRefreshDigest object| ReturnCodes object| ieBrowser object| touchBrowser boolean| isMobile boolean| isMobileRecourse object| jsResources function| ZiraatModule object| Ziraat function| SocialUserLogined function| SocialChecked function| RefreshCaptcha function| uiBlock string| inDesignMode boolean| spMode string| siteLanguage undefined| jsName undefined| jsNameTwo object| globalPage object| socialLoginWindow object| globalSlider function| setFooter object| subPageConfig object| calculateSliderBox object| sliderMonth object| sliderPrice object| creditPrice object| creditSelect object| totalPrice object| creditRate undefined| vadeData object| calcPrice undefined| priceData number| userFaizOrani object| BaslangicTtr object| BitisTtr object| subPageCalculate object| stElement object| sonradanTaksitlendirme object| tnaElement object| taksitliNakitAvans object| dovizCeviriciElement object| dovizCevirici object| formPage object| formValidate function| IBANHesaplama function| CalcIBAN function| CalcIBAN9X function| FormatIBAN function| PadZeroes function| GetCharCode function| GetCharTable function| calculateChecksum function| mod97 object| $selectBox object| MODULES undefined| _token function| getUrlVars function| paymentOk function| paymentFail object| closeValidation object| orderID undefined| selectFormValue object| creditNo undefined| InputsArray undefined| Inputs undefined| InputsProp object| newInputs string| sessionDataTemp string| ua boolean| isAndroid object| validateInterval object| createjs object| JSON3 function| Inputmask object| Browser function| _ function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| ProgressBar function| lazyload function| LazyLoad object| lottie object| bodymovin object| hopscotch function| moment object| Popper object| mat object| yandex_metrika_callbacks object| data0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.turkiyecumhuriyetiziraatbankasi.com
162.240.37.219
0302dbdff5bad8708d4d7027825dd040ca3a1550fb208ace34bf4d952e1c6ef4
169351eb745ff085ffdf70466ec0d62f0e5d7674282067b0843f59bf513d12e6
1db3c4c816b399f5cfe680679d67af61ee169be6897247a9ced136e0e62a5a6f
225ddfecd15f7b8b19677dff2bcf0405b2c0642413f9b771cfb66c6e82627673
24489d37a4f37a51da7ca075defba5ea657b967964113199c4f6439f3c02cd5f
277fbc0e7cab340b007addc4812b701d115ae5be9a7d03a509b2c5811727b89b
2f2e0cc0f57a44db726dfad23c03df57b80d4df03adb02388151880033c84c4b
37094e8cc0e2325c0411cea7bd41bd003704abb92a61ec1bdb59fae5e378f45e
5ce3d318c9fe70d7168012f428488d53833adb649406b01318d80f9a5c0b62f8
712077c899efa4b95c439b88c03bae9506d0aebd47b363c7d4d3ec9080e1260b
8d038c463c54e8237efeb8abad5ba7db9381eadbc208e4d425ced38083f2d192
9916b20e0e346a808aa3d33641d98263c4b1b27f67f0b091004021c91652cc72
9db55100ecd437034cc557edd0e7df6d769cfcf019f4046a45d3d4765e4d56a6
aa8a40c7d040c62e5d7963281173bbc700f2fd64892ee1e81af2fc7e09694c66
b5f45ffc3928fdfba55d9ce330c577cddf28dfe4b79c257cc22e2c062e14adec
cafe37d4d0c65351479187d31b293d3e653414c201b0b8ef79ace8644565b8a7
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638