![](/screenshots/f3f22aae-a6a6-4666-abe1-fd0b1b12b740.png)
ziraat-ba.com
Open in
urlscan Pro
148.163.67.138
Malicious Activity!
Public Scan
Submission: On October 10 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on August 31st 2022. Valid for: 3 months.
This is the only time ziraat-ba.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ziraat Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
32 | 148.163.67.138 148.163.67.138 | 53755 (IOFLOOD) (IOFLOOD) | |
32 | 1 |
ASN53755 (IOFLOOD, US)
PTR: budget4.noc401.com
ziraat-ba.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
ziraat-ba.com
ziraat-ba.com |
3 MB |
32 | 1 |
Domain | Requested by | |
---|---|---|
32 | ziraat-ba.com |
ziraat-ba.com
|
32 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ziraatbank.com.tr |
kurumsal.ziraatbank.com.tr |
www.facebook.com |
twitter.com |
instagram.com |
www.youtube.com |
www.linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ziraat-ba.com R3 |
2022-08-31 - 2022-11-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ziraat-ba.com/
Frame ID: A6817B12C4BA5E5318969CD0867DEA4A
Requests: 32 HTTP requests in this frame
Screenshot
![](/screenshots/f3f22aae-a6a6-4666-abe1-fd0b1b12b740.png)
Page Title
Ziraat BankasıDetected technologies
![](/vendor/wappa/icons/Microsoft ASP.NET.png)
Detected patterns
- <input[^>]+name="__VIEWSTATE
![](/vendor/wappa/icons/Yandex.Metrika.png)
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: POS Services
Search URL Search Domain Scan URL
Title: (This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Facebook(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Twitter(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Instagram(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Youtube(This page will be opened in new tab)
Search URL Search Domain Scan URL
Title: Ziraat Bank Linkedin(This page will be opened in new tab)
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ziraat-ba.com/ |
50 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
magiclick.minbdd8.css
ziraat-ba.com/SiteAssets/css/min/ |
540 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mesafeni-koru-modal.png
ziraat-ba.com/SiteAssets/images/ |
346 KB 346 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-app-modal-img.jpg
ziraat-ba.com/SiteAssets/images/ |
134 KB 134 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min0466.js
ziraat-ba.com/SiteAssets/js/min/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ziraat-ba.com/SiteAssets/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent.png
ziraat-ba.com/SiteAssets/images/ |
924 B 978 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat-bot-img.png
ziraat-ba.com/siteassets/images/ |
708 B 708 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
intro-modal-2.jpg
ziraat-ba.com/SiteAssets/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
magiclick.min70c4.js
ziraat-ba.com/SiteAssets/js/min/ |
1 MB 331 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homePage.min4ebc.js
ziraat-ba.com/SiteAssets/js/min/ |
134 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.smartbanner.js
ziraat-ba.com/SiteAssets/js/jquery/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cbot-ziraatbilge-generatord754.js
ziraat-ba.com/api.ziraatbank.com.tr/inbound/cbot/static-files/web/js/widget/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Book.otf
ziraat-ba.com/SiteAssets/fonts/ |
59 KB 30 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
calculator-bg.jpg
ziraat-ba.com/SiteAssets/images/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Medium.otf
ziraat-ba.com/SiteAssets/fonts/ |
61 KB 31 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en-yakin-ziraat.jpg
ziraat-ba.com/SiteAssets/images/ |
232 KB 232 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoone81c.html
ziraat-ba.com/SiteAssets/fonts/ |
25 KB 25 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GothamNarrow-Bold.otf
ziraat-ba.com/SiteAssets/fonts/ |
61 KB 31 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FBLogin.aspx
ziraat-ba.com/en/_layouts/15/Ziraat/Social/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
watch.js
ziraat-ba.com/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bpbanners.aspx
ziraat-ba.com/SitePages/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetZiraatVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetPiyasaVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetZiraatVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetPiyasaVerileri
ziraat-ba.com/en/_layouts/15/Ziraat/HomePage/Ajax.aspx/ |
708 B 733 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent.png
ziraat-ba.com/SiteAssets/images/ |
924 B 997 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screenshot%202022-08-20%20101651.png
ziraat-ba.com/bk/ |
390 KB 390 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screenshot%202022-08-20%20101651.png
ziraat-ba.com/bk/ |
390 KB 390 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dcc-mobil-2.jpg
ziraat-ba.com/bk/ |
425 KB 426 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dcc-mobil-2.jpg
ziraat-ba.com/bk/ |
425 KB 426 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
western-union-img.png
ziraat-ba.com/bk/ |
32 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ziraat Bank (Banking)149 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| RegisterSod function| removeAllStatus function| RegisterSodDep function| AttachEvent function| UpdateFormDigest function| GetUrlFromWebUrlAndWebRelativeUrl object| _spBodyOnLoadFunctionNames object| WPSC object| g_updateFormDigestPageLoaded object| _spPageContextInfo string| langUrl string| webRelURL number| digestRefreshInterval function| $ function| jQuery object| theForm function| __doPostBack string| MSOWebPartPageFormName function| WebForm_OnSubmit function| submitHook number| vadeGunMin number| vadeGunMax object| vadeAyMax number| BaslangicTutar number| BitisTutar object| formDigestElement number| _spFormDigestRefreshInterval boolean| _fV4UI object| CryptoJS function| tryRefreshDigest object| ReturnCodes object| ieBrowser object| touchBrowser boolean| isMobile boolean| isMobileRecourse object| jsResources function| ZiraatModule object| Ziraat function| SocialUserLogined function| SocialChecked function| RefreshCaptcha function| uiBlock string| inDesignMode boolean| spMode string| siteLanguage undefined| jsName undefined| jsNameTwo object| globalPage object| socialLoginWindow object| globalSlider function| setFooter object| subPageConfig object| calculateSliderBox object| sliderMonth object| sliderPrice object| creditPrice object| creditSelect object| totalPrice object| creditRate number| vadeData object| calcPrice undefined| priceData number| userFaizOrani object| BaslangicTtr object| BitisTtr object| subPageCalculate object| stElement object| sonradanTaksitlendirme object| tnaElement object| taksitliNakitAvans object| dovizCeviriciElement object| dovizCevirici object| formPage object| formValidate function| CalcIBAN function| CalcIBAN9X function| FormatIBAN function| PadZeroes function| GetCharCode function| GetCharTable function| calculateChecksum function| mod97 object| $selectBox object| MODULES undefined| _token function| getUrlVars function| paymentOk function| paymentFail object| closeValidation object| orderID undefined| selectFormValue object| creditNo undefined| InputsArray undefined| Inputs undefined| InputsProp object| newInputs string| sessionDataTemp string| ua boolean| isAndroid object| createjs object| JSON3 function| Inputmask object| Browser function| _ function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| ProgressBar function| lazyload function| LazyLoad object| lottie object| bodymovin object| hopscotch function| moment object| Popper object| _inputboxelement object| _inputBox object| _0x9bd5 object| homePageCalculateElement undefined| uiValue object| homePageCalculate number| ziraatInterval undefined| piyasaInterval object| homePageConfig object| AdobeAn undefined| homeiconkredi undefined| homeiconkart undefined| homeiconsigorta undefined| homeiconemeklilik function| IScroll function| fp_offsetSectionsExtension object| yandex_metrika_callbacks object| data string| currentTabIndex string| storedTabIndex object| mat1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ziraat-ba.com/ | Name: mobile-app-modal Value: 1 |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ziraat-ba.com
148.163.67.138
0302dbdff5bad8708d4d7027825dd040ca3a1550fb208ace34bf4d952e1c6ef4
038a09d5c14212e13cf97fb6c9986af317881859ec5306908de31f529630ec2b
24489d37a4f37a51da7ca075defba5ea657b967964113199c4f6439f3c02cd5f
277fbc0e7cab340b007addc4812b701d115ae5be9a7d03a509b2c5811727b89b
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
6dbea73719feeeddf4eeec62e2227a246fedc4cf4b1997410ec225a73895316c
734f38cbfcc17f7bbce11e3f73c17487a7e62e3a08d22f8240862a1daae423d8
76db5e4ab6590faf76dd3ea357976c37f58aec4ef2979312aa89d317bbbad56c
880c1e133675bb5cae2d90b00d916d311e75a3e2b37c8dcde55796ced37a04e7
9916b20e0e346a808aa3d33641d98263c4b1b27f67f0b091004021c91652cc72
9e62bbd51aa1cffa92e06b049ed6882fc94af0a6891b6de2eb1d515d2b027e2d
a12f20aa58b1a2e809967bfaf8c1ce864bc153f9ffeb51ef96761419fa39e8b7
a336639240d71effd17416cf26e38a06fc3bf1f3a64fbac04b3f1970f2d55c0b
a643765cbd8944eddbd34bb7429b9ca6a576963da21c5cfbb7c56fd131adb9bb
aa8a40c7d040c62e5d7963281173bbc700f2fd64892ee1e81af2fc7e09694c66
b5d8f198b23f420470a91d8462b8cd1fb5fc2070fe4437282402344215496b17
dc6750872782481c50484242a1e4d6dcfa856fae3d932154d384b476a0254638
dcd2488d4f219c45db61e690c1efd5c58726f37ff1afb6a0af7ba07608a1256e
e2e9f2b3b062193e47ee0ff3bdcc1dd8b4185670dc783679c79fcb752d3b2f04
e825d4f06e1988699280f0d8813dbdc85114bc97a5366760d7df48040b211774