![](/screenshots/e5a4bc8f-91bc-44f6-b0e5-8f76c066ee2f.png)
www.tatarinsaat.com.tr
Open in
urlscan Pro
5.2.81.101
Malicious Activity!
Public Scan
Effective URL: https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/LogonOperacionServlet.html
Submission Tags: 6965467
Submission: On February 12 via api from NL
Summary
TLS certificate: Issued by R3 on December 22nd 2020. Valid for: 3 months.
This is the only time www.tatarinsaat.com.tr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Galicia (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 5.2.81.101 5.2.81.101 | 3188 (ALASTYR) (ALASTYR) | |
10 | 161.190.1.97 161.190.1.97 | 13474 (Banco de ...) (Banco de Galicia y Buenos Aires) | |
1 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 52.2.86.101 52.2.86.101 | 14618 (AMAZON-AES) (AMAZON-AES) | |
17 | 6 |
ASN13474 (Banco de Galicia y Buenos Aires, AR)
PTR: inversiones.bancogalicia.com.ar
onlinebanking.bancogalicia.com.ar |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-86-101.compute-1.amazonaws.com
detectca.easysol.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
bancogalicia.com.ar
onlinebanking.bancogalicia.com.ar |
2 MB |
2 |
easysol.net
detectca.easysol.net |
2 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
29 KB |
2 |
tatarinsaat.com.tr
1 redirects
www.tatarinsaat.com.tr |
3 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
11 KB |
17 | 6 |
Domain | Requested by | |
---|---|---|
10 | onlinebanking.bancogalicia.com.ar |
www.tatarinsaat.com.tr
onlinebanking.bancogalicia.com.ar |
2 | detectca.easysol.net |
onlinebanking.bancogalicia.com.ar
www.tatarinsaat.com.tr |
2 | maxcdn.bootstrapcdn.com |
www.tatarinsaat.com.tr
|
2 | www.tatarinsaat.com.tr | 1 redirects |
1 | ajax.googleapis.com |
www.tatarinsaat.com.tr
|
1 | cdnjs.cloudflare.com |
www.tatarinsaat.com.tr
|
17 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.bancogalicia.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
tatarinsaat.com.tr R3 |
2020-12-22 - 2021-03-22 |
3 months | crt.sh |
onlinebanking.bancogalicia.com.ar DigiCert SHA2 Secure Server CA |
2020-10-07 - 2021-10-12 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
*.easysol.net DigiCert SHA2 Secure Server CA |
2019-10-10 - 2021-09-10 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/LogonOperacionServlet.html
Frame ID: D652F3A55AD4D6640D84BBCDCB1580DF
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/e5a4bc8f-91bc-44f6-b0e5-8f76c066ee2f.png)
Page URL History Show full URLs
-
https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/
HTTP 302
https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/LogonOperacionServlet.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Detected patterns
- headers server /^LiteSpeed$/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/
HTTP 302
https://www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/LogonOperacionServlet.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3-Q050 |
Primary Request
LogonOperacionServlet.html
www.tatarinsaat.com.tr/emtnuevo/170.51.80.1742720/agregar/telefono/contacto/ Redirect Chain
|
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
onlinebanking.bancogalicia.com.ar/Content/ |
121 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.min.css
onlinebanking.bancogalicia.com.ar/Content/ |
968 KB 113 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keyboard.css
onlinebanking.bancogalicia.com.ar/Content/Keyboard/ |
524 B 887 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
simple-keyboard.css
onlinebanking.bancogalicia.com.ar/Content/Keyboard/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/ |
120 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.3/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/ |
36 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrontFunctions.min.js
onlinebanking.bancogalicia.com.ar/Scripts/ |
26 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
customcarousel.min.css
onlinebanking.bancogalicia.com.ar/Content/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
seguloginborders
onlinebanking.bancogalicia.com.ar/bundles/ |
651 B 901 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
detect.js
detectca.easysol.net/detectca/scripts/QjL8pgjJN3mpOxVuG7JxpI2OYsRMit/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
onlinebanking.bancogalicia.com.ar/images/default/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
67-Sofia-Wi%C3%B1azki_Vermont.jpg
onlinebanking.bancogalicia.com.ar/images/art/ |
1 MB 1 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Inter-Regular.woff2
onlinebanking.bancogalicia.com.ar/Content/fonts/ |
87 KB 87 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DetectCA.png
detectca.easysol.net/detectca/images/QjL8pgjJN3mpOxVuG7JxpI2OYsRMit/ |
82 B 303 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Galicia (Banking)115 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery boolean| isMobile number| mobileDimensionLimit string| htmlSelection string| htmlFilter function| getIsMobile function| getIsDevice function| ocultarTooltip function| agregarTooltipsFima function| agregarIconoAyudaTooltip function| updateInputs object| capsLockEnabled function| checkWarning function| inputsEfect function| closeAlert function| openPanel function| bindClosePanel function| closePanel function| fixedMenu function| fixedFooter function| fixMarginBottom function| fixedHeader function| fixPerfil function| fixPadding function| inputWidth function| inputAutosize function| btnTooltip function| hiddenMenu function| showMenu function| showErrorModal function| showHBModal function| carouselEffect function| showShadow function| dropdownMobile function| stopBodyScrolling function| btnRippled function| contentScroll function| contentFix function| inputLowerCase function| mostrarAlertaEncabezado function| closeDropdown function| fixBottomBlur function| fixModal function| inputExtraInfo function| toLowerCapitalize function| setTooltips function| updateTooltips object| modal number| widthGuia number| heightGuia string| overlayGuia string| botonSalir string| botonSiguiente string| botonAnterior string| botonFinalizar string| espacio string| botonEntendido string| mantle string| hole boolean| guiaIniciada number| diferenciaPixels object| listaMensajes string| contentGuia function| inicializarGuiaNovedad function| inicializarGuiaVoluntaria function| inicializarGuia object| resizeTimeout function| AttachResizeGuia function| AttachGuia function| precargarGuias function| setUnicoModal function| setUnicaBurbuja function| setPrimeraBurbuja function| setPrimerModal function| setModal function| setSegundoYUltimoMensaje function| setSegundoYUltimoMensajeBurbuja function| setUltimoMensaje function| setSegundoMensaje function| setMensajeIntermedio function| setMensaje function| getTopOffset function| ObtenerMensajesAMostrar function| terminarGuia function| mostrarProximaGuia function| getDataGuiaPorID function| mostrarGuia function| createHole function| getIdGuia function| guiaNoInteresa function| getJsonGuia function| cerrar function| getUbicacionGuia function| fixGuiaView function| guiaIsVisible function| lockGuia function| guiaInWidthViewPort function| elementInViewport function| fixHole object| _0xfbg object| dca object| s object| _mOs function| _ODRx object| _nlcR0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
detectca.easysol.net
maxcdn.bootstrapcdn.com
onlinebanking.bancogalicia.com.ar
www.tatarinsaat.com.tr
161.190.1.97
2001:4de0:ac19::1:b:1b
2606:4700::6810:125e
2a00:1450:4001:812::200a
5.2.81.101
52.2.86.101
14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7
15454e01cc8a094ad6eb5840eef73843d165316f30e61bbfc148b4df07659a33
306ad3108f32b29c978464c769a64ab72c1cd3918ae9c239f0defd449ada8bb6
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
6516631a0821750428cceecfbadd6a061d25944befe8a714ac3086c79361c9c4
77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720
89b7cb897584bad45e3d1a294f363b8c14d01630784209c4e0a62c62322fa030
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
8f54afc514051a0aa61f219128449ae21d1e2f7e1d99d490f46cbd0ca727cc16
90b50ee9b20db43f429b9389dc09407c18a53ffdb1c54316b170d65c5ab28b40
a4b3a957697bdaad0271f701adac904e2ae3ffd626e9d6fb9a73383e0aa35d5e
c4c70a5e11bb36e373e25ab051860a7cd9d72a3091f1fe10373161297ffca1b2
c714daca086c41b0915c1eb7cdfc38696582eba1d6a0259e2fec643e84728be6
ca2613f315c93819ed7c4a14d44dcf8b041a71c5e032bd0aec9b399a6f4eb491
e7be2d8041a9132b8d88373cf1f3ba55032b30343e461ce8b32903c766dd6c3b
fad6369e7b4e8af718c87cf1d5e13e9f3c3e831725a388ad52a971ee70c1abe8