{"report_id":"00cd7338-29ee-4af3-ac4c-ce5d5fea1f9e","version":6,"status":"done","tags":["e-devlet","phishing","government","turkey"],"date":"2026-05-02T12:39:32Z","url":{"schema":"https","addr":"haftanin-noktasi.com.tr","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"title":"e-Devlet Kapısı","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-06T12:39:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]},"summary":[{"fqdn":"haftanin-noktasi.com.tr","ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-01-17","domain_rank":0,"first_seen":"2026-04-18T13:23:33.911856Z","last_seen":"2026-05-02T02:18:11.107809Z","alert_count":175,"request_count":35,"received_data":506420,"sent_data":19288,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-04-26T22:20:29.825994Z","alert_count":0,"request_count":1,"received_data":12823,"sent_data":497,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-04-26T22:34:03.62582Z","alert_count":0,"request_count":1,"received_data":90523,"sent_data":448,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-04-26T22:16:47.246638Z","alert_count":0,"request_count":2,"received_data":85146,"sent_data":1130,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.numeric.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"69fb87a2fc9b47c211950c37e07a586a","sha1":"ebec14e55641e1d10dbe0b264f4358b30afa2e85","sha256":"97bc947f6b6ffd0042a86a82ccee14a89920194d87c185eccd3208f70574067e","sha512":"642e4dcbc60944656ce45a4c934715edb879b82d00ba1cd0876966c4953d304a8de5934d37278717f5b148a425246c39e67307b6c6dd79c75b4af53021fd4d2c","ssdeep":"384:/YHU8NjK9dABOW1lBPM+XKPQ7iaL8CT76V34KmTLQTRw:YU8N29d9R+f62KVw","tlshash":"61b2401d5ee7905aa592b2aa1bbbc40d1cb48f43fad81a61341ca1851f204f4b7e7f73","size":24911,"data":"","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.848029Z","times_seen":118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/header.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1bad337bce10f26575f4ddb1f63fa6e","sha1":"0c95590a305f8843dcdafbbf74e6497ed82c6a93","sha256":"5e002677cbc74b8ece199259c3000ad851348079c777165d04d76e7a28e0ca48","sha512":"c565172ed65670fa58d126e0a1446de4972cff7d8f2b06d7585c232dcebf0ba4e6c59a81ecc1fc81fc386626917a0eaa63b8dfaa2b2064e69fc40ed5875f2d5b","ssdeep":"192:GC0P0E75cbiYjziGjh5ANYwLHTYdwY6O7m9hymn8WtqygjzpT/26WKt:GmQ5cbzPiGjh5ANXkwNO69hnbtqygvp9","tlshash":"e222d7ce76a2306a939b107b613f050ff6b92a0c591d4800e465d8fdbdb4ea4537bd39","size":9990,"data":"","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.84277Z","times_seen":112,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"87b6e90dd6db8973420b90b1e81e08e3","sha1":"3099cb74ba3f8ab7ef31ffb854da83060f23e828","sha256":"b6451989470c4a49372ab0702abb602da99dbe7bb0707993bd3f01d703a80212","sha512":"66fc4217bbe56739f4e3bc6e2c9dec93dc17036c284730725591909cfcc8f0d34d526566d49fe6d653658ced3652f213e4808712fb1d42e089c9667af5b31689","ssdeep":"","tlshash":"59610e089ef56242089376b884ff4254a171cb6b1dd8ac0c78cc41589f1c68c37baeae","size":3443,"data":"","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.852244Z","times_seen":108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c810d90964a0509ee1e03c1f12a255e","sha1":"bbed1155b4f335d76cd3a65617405cb188f2dd88","sha256":"f9961f390ca223bbe4363a87b745e64f3fd1388a8212e4da059283d93d23fadb","sha512":"8e12f38b5533fa437c51f9bfc0c235a94c435e20f6c672cfd536526d5768f142627ca6fa0bdc301c52d3904ae888bc004e91b554d16096bc95248b619285b748","ssdeep":"","tlshash":"90f0a35d3c5af06737fd7634c2278e7f3755070175835524d646cc247864496584ad4e","size":445,"data":"","first_seen":"2026-04-18T13:23:38.30983Z","last_seen":"2026-05-02T12:39:33.855685Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.date.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"5490c61d3f2f31497e6aa78117e721f8","sha1":"e9ffe55ee353700d86b4175a1e4c292c5001824d","sha256":"45e1abbe19c2f001c291c150e9fc5c70798203b4733e1841217524ba4720e8bf","sha512":"c148262f9af2a501f353307fc2de32f35c7eb1c2919cc354f78978e80267f0c78961872e6271f5e32d2d1155920e0c11649b7007e97b24c0f8f6050a3031bd56","ssdeep":"192:uTdvTQR2VrkIWMvSdEGIjBWYERMqtI+27PYNmf+bAxUeqVYbAgQHUh7YeT6KnmfK:uJsrUdfQE7PRvjL/BL02LMS4dL+","tlshash":"a0b21e0cece24089956731ed95bf450539b556d7a8eced64360c0088bf684ef83baef8","size":24422,"data":"","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.848971Z","times_seen":118,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-24T13:32:12.519743Z","times_seen":493838,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8d1682044a5c04aafc85f61d9235d30","sha1":"968de7afd762516a94e480fea2232325b6b17923","sha256":"7a5dde98fa0c5faf365959c6911d93697e0ae90dc156db3f25afc3cbb4ddc1a9","sha512":"568555b74414342bc44bd5ed9fb56f16e2a800c342da73e74c0dfcf23ba2ab6c8820c294f081e00af421b98a8b61f96f615d34dc17632d11bc0cfb84657e43dc","ssdeep":"1536:xtmVA0+DER056oqkHV5OFpP7sO+g7+x+X3FW465+3Vz+VLLYRUT/p31c7PpE8Oy:xtmWQJqon0XVviUT/p31c7PpE8Oy","tlshash":"56c3d9655cd751026603b0beabdbc4057a7b4a2b198d9494bcbc26400f27da84bfbff4","size":123405,"data":"","first_seen":"2023-03-13T11:31:40Z","last_seen":"2026-05-02T12:39:33.84556Z","times_seen":110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"domTimer","is_inline":false,"md5":"480f272278bc665eaea243c27de6ead7","sha1":"3f7570e96deed07c9668c114d3dcb202cfe03cbc","sha256":"66285fb4df09f4565a9fad2e868d6fdb29326b5e0913c3320bd3faa3bb1c2926","sha512":"652a5b958d134fdedaa2c44c443a733691a594c1d0b20a883fcafb035c69876f800e75d20669583ecf61a103170686655f78c7e2070779d26bbb2a7dca2e3cec","ssdeep":"","tlshash":"89e00033f0030003300cccf0030c0c00000000c0c000f000003000000030000f30cf30","size":348,"data":"","first_seen":"2026-04-18T13:23:38.307343Z","last_seen":"2026-05-02T12:39:33.854893Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"efa066e9ed87bdd5c245cfb9908c84bd","sha1":"1f727802b80a89db4cf27016223ed3c57cb3063a","sha256":"c46ef9762c7ec3ae49cc8ea055e1befa69ee77ea6cc5660a60814d116f12b3af","sha512":"991414ae1f3df1376ac986879afe1c8c64cb1924ed172e9894d07e8203ed94d3235fe7a540cd7142aa5ac3b898512fae7e46625cd33ed2b9518b7e154c20f940","ssdeep":"","tlshash":"8b117b9716ba063487fbb1aa8f87438b213150777441c5243d1ed9156fa5e84eab52c8","size":1058,"data":"","first_seen":"2024-12-31T14:57:44.453605Z","last_seen":"2026-05-02T12:39:33.85649Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/jquery.inputmask.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a4814d207ac80d87a3841df5285ff1c","sha1":"71832c2b40a98163a81e25ad31a398872972b96c","sha256":"0566e20d61e2e798bda5067585595950ad6e49c1d6103a1583c9b5546f8db8d8","sha512":"43f1d3aa2596e1526ccbbd2c5fbdea0a7593afdddfe3d4ff7ecf3f73fbb6140d4d57a969659712ab15749862ff1aa4816144976213da1aa1a321e1949804aae8","ssdeep":"","tlshash":"18518a4a7fe6fb0166a3617569ebc808b93b6b2331cc4a48386d41c01f710a15fb5fa7","size":2621,"data":"","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.838116Z","times_seen":109,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/jquery.maskedinput.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"8d8ec956b7eac73a9b778a210eb795a7","sha1":"931dbe67bdabb253767000230f692b5d06eedf34","sha256":"b134fc3f777a1aeb46d45b7999e88fb655daa62f4fafe5bcaed5f70b4bb7bcef","sha512":"54a35645e694a742370f12a46a98b176226f80d7617778ce575c8afbd6efec632a10757d96ee92e8812046ff09e44cea50afe183449d6bf658d5f7eed44d6e6b","ssdeep":"96:VBRRS3DZo/zdr5Q29ONKjGOBKzwPgWYMg8RHYTke8KSO7JPoxg4OOaYjrdofdkXE:a3OBtn9HKOEzUr+TkxAoxMu0T","tlshash":"1922630abca9516552b3b33bfbebc809f63b853b4085d504792c20506f3199447fafea","size":10498,"data":"","first_seen":"2023-03-08T12:47:06Z","last_seen":"2026-07-08T09:37:19.073693Z","times_seen":510,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"610d6f42404538afa28103e3beddae8c","sha1":"9a1b1dfacd346e47e7e208a90f25060bf44199ed","sha256":"c85c179a7a79f31f6b3bb5973f7d703bce0655e8fffc961435c8b4e54003d949","sha512":"516dee367f3623867432a2ae4e83761fc734804add9b21006a0996f4e6f365ba6559e77f6c31106829cf165d8e747dcb56adfe3f241fe5fec4a297b0ff57c53a","ssdeep":"","tlshash":"02319c6df8e752641e6375b60fff82163b7549031209de44f8ac34c1afd0f109666ba9","size":1554,"data":"","first_seen":"2023-04-11T18:53:33Z","last_seen":"2026-05-02T12:39:33.857305Z","times_seen":77,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"99041a781e51b9c269512769f60f1fbe","sha1":"2a952572c2d4b0e45cfb089490eddcec891c468b","sha256":"c2e362b040148f4ede4bcd9ca0067805f300216f0709cf7986a1ed839bacd25e","sha512":"359aec22c79d89dc6a300a1280c428e4b0b3bf31d6d3937fe499055086998ca96c120a698282f353375e5606b4fb416a0cc3dc351d0289e6bdd5ef70059b78f5","ssdeep":"","tlshash":"31f0909bbd4c010481f72955cd3b658cb55f8063490699531e5527546b2833d822eaad","size":503,"data":"","first_seen":"2023-03-26T14:17:25Z","last_seen":"2026-05-02T12:39:33.857809Z","times_seen":82,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-02T12:39:10.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3; path=/\r\nx-powered-by: PHP/8.4.20, PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15660,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"5a824109f79eb91311faab36708b3806","sha1":"b7088d7fe20e5af27f9fcc58189d386ea8d7aa75","sha256":"a9305fb8245fe17a7ac7296bb767dcd1887f37dab1351d6680435220ca700104","sha512":"99ad1ad538a3322f9391d9cdf2f11beba5e62b3c75db9cb9640588b79ef620ee0fa3ea61fd4201d1f2a0fa917aef5cdaf221335ece864ae2a9947585b291a00f","ssdeep":"192:6K8Ptg7d2TWWVeZGqkzmXUr/NM67lCX49LWd5Vas92kghZQPp:KmZ+mXC/jlCvd5PgO","tlshash":"e362d85468ca081d1673439a99b29b4aff5ac213c702d608b5bc67a73ff0e508ec776c","first_seen":"2026-04-18T13:23:38.298549Z","last_seen":"2026-05-02T12:39:33.83661Z","times_seen":4,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":202,"dns":156,"connect":23,"send":0,"wait":38,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/jquery.inputmask.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/jquery.inputmask.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-a3d\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2621,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"6a4814d207ac80d87a3841df5285ff1c","sha1":"71832c2b40a98163a81e25ad31a398872972b96c","sha256":"0566e20d61e2e798bda5067585595950ad6e49c1d6103a1583c9b5546f8db8d8","sha512":"43f1d3aa2596e1526ccbbd2c5fbdea0a7593afdddfe3d4ff7ecf3f73fbb6140d4d57a969659712ab15749862ff1aa4816144976213da1aa1a321e1949804aae8","ssdeep":"","tlshash":"18518a4a7fe6fb0166a3617569ebc808b93b6b2331cc4a48386d41c01f710a15fb5fa7","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.838116Z","times_seen":109,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/edkkds.svg","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/edkkds.svg HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 8818\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-2272\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":8818,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"aeb425e74504eaf8da05abbbe20176bd","sha1":"62ff7d1eb4431ca87967126be6f478ebb4a62d7e","sha256":"06502153e0e50d4126373b6fa182d91a6d78ba1dd919dac8b5a2e53e391eb091","sha512":"00b74ac92512d50477efd9a09a44e54b3b8a804d05b068dd1fa82e3d7a8990bd271af157b438788ad128297adb61b9bb64de4a25583e6ada37bbc15e60f00b8a","ssdeep":"192:Ow8o3Nd5aQk6tjbzOt1SSVZ7u5esh07S01XxnUF:O+3rMCjGt1SSHMesG7D1hnUF","tlshash":"0702a92d9750c3e89ceacebcdf67a0e4a08da5de50e1c392d399c57067a00c9f74e895","first_seen":"2023-04-20T18:57:09Z","last_seen":"2026-05-02T12:39:33.839118Z","times_seen":71,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-bold-webfont.1.ttf","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-bold-webfont.1.ttf HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: W/\"328-64f069b350750\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/favicon-196x196.png","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/favicon-196x196.png HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: image/png\r\ncontent-length: 36658\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-8f32\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36658,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 196, 8-bit/color RGBA, non-interlaced","md5":"d8d70ee5e70ce7e5ad1549bb4f1fa77d","sha1":"0dd76a540a82edeb7eb2b7193d72c7e10c70778d","sha256":"48939cab660e1218fbb818d611a1271f60790f9a1ae5906b08c9ad2f8f7b07fd","sha512":"781d3b4f948f72c9a8a600f35785e2d827ba1ae311215355fc7a9b7337db837806d6df721744723d6fad4d3802cc9c805f56079c0c4751e4e94d02512896de2a","ssdeep":"768:NJ0tQZ0e/z3MZizwURcvMr6wYT9weNpgPjHCv0SVJITW8f2iXkHDrtPP:/0t60ILVzwU6vU6RZFNpgbH0b/Q/na3F","tlshash":"7af2f28ab0b4cdbddf4a46279f0794da54b506cb8239f895908989c8c7673c34d8ce1f","first_seen":"2023-04-30T19:06:20Z","last_seen":"2026-05-02T12:39:33.840826Z","times_seen":112,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/bb-ubak-tsat-black.png","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.727Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/bb-ubak-tsat-black.png HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 15120\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-3b10\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":15120,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 800 x 110, 8-bit colormap, non-interlaced","md5":"c60ab750ec8321b9a186658d4157b22c","sha1":"0edb72858fa9de74d818a2397ef62eb44e495c4c","sha256":"a4745f259315892f1d3a76a0d8f524729e50ac83d4a8a53deda91970a1bf3dbb","sha512":"1088f8d897209047ba88060b062502357f3ef375372cd7a1b3f3738e18b7f81f859d85828acfa7935e4265149992b7d0dfe33ca7b4d19abc1d5c39c1ce522e54","ssdeep":"384:i7MxVc3xYgYzd/AZIAOPcKXMi4QLK+1do8I0pFwIR4:Vf0kPcspVdo8IewIO","tlshash":"0b62d08a62d564c4af3ab70935025bf08ae782f11b5792c314768e20eed335433967eb","first_seen":"2023-04-30T19:06:20Z","last_seen":"2026-05-02T12:39:33.84136Z","times_seen":117,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-regular-webfont.1.woff2","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-regular-webfont.1.woff2 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/favicon-196x196.png","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/favicon-196x196.png HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: image/png\r\ncontent-length: 36658\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-8f32\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36658,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 196, 8-bit/color RGBA, non-interlaced","md5":"d8d70ee5e70ce7e5ad1549bb4f1fa77d","sha1":"0dd76a540a82edeb7eb2b7193d72c7e10c70778d","sha256":"48939cab660e1218fbb818d611a1271f60790f9a1ae5906b08c9ad2f8f7b07fd","sha512":"781d3b4f948f72c9a8a600f35785e2d827ba1ae311215355fc7a9b7337db837806d6df721744723d6fad4d3802cc9c805f56079c0c4751e4e94d02512896de2a","ssdeep":"768:NJ0tQZ0e/z3MZizwURcvMr6wYT9weNpgPjHCv0SVJITW8f2iXkHDrtPP:/0t60ILVzwU6vU6RZFNpgbH0b/Q/na3F","tlshash":"7af2f28ab0b4cdbddf4a46279f0794da54b506cb8239f895908989c8c7673c34d8ce1f","first_seen":"2023-04-30T19:06:20Z","last_seen":"2026-05-02T12:39:33.840826Z","times_seen":112,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Apr 2026 05:19:27 GMT","end":"Wed, 01 Jul 2026 05:19:26 GMT"},"fingerprint":{"sha1":"E9:E5:B7:DA:0A:AE:59:02:EA:10:61:71:9B:52:3A:08:42:A0:67:A5","sha256":"F6:1D:CE:31:AA:9C:7B:58:1D:1D:14:96:99:B6:58:CC:FB:AE:D5:3C:F8:FB:40:E3:45:2D:4A:54:11:B4:E2:F3"}}},"request":{"raw":"GET /css2?family=Open+Sans:ital,wght@0,300..800;1,300..800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 02 May 2026 12:39:10 GMT\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12137,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"7fbc57b14bea8d6561fdb50fc9c3008c","sha1":"9c9ed86aaf4ca655f083c9c80db324d053d3dd11","sha256":"d90d7d2947e295cba230edef392df55e276c2f3c87e04908d093aeb005da805a","sha512":"d70400de88d9d540ba4e871b2c2c4b997f81bdf1765150d65c2ab18a959c9efa4f910735b3873d43e1eabc646c078533972106c111a4838357f866b44cf57c40","ssdeep":"192:+foOfcfLf9L5fMfgqvfZbqGIwV49fOnf+ofjCXXS2asrqAnbqGIwV4uxzBY:+QOkTltULv1qY49GnDu6SqY47","tlshash":"9f420c910417144096835dd233de7e34ee0fa6616044c0baabfd9bdbeecad69a3b435c","first_seen":"2025-09-17T08:42:41.023406Z","last_seen":"2026-07-24T13:54:30.656375Z","times_seen":7335,"resource_available":false,"data":null}},"time_used":523,"timings":{"blocked":240,"dns":3,"connect":9,"send":0,"wait":25,"receive":0,"ssl":242},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/header.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/header.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-2706\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":9990,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9932)","md5":"a1bad337bce10f26575f4ddb1f63fa6e","sha1":"0c95590a305f8843dcdafbbf74e6497ed82c6a93","sha256":"5e002677cbc74b8ece199259c3000ad851348079c777165d04d76e7a28e0ca48","sha512":"c565172ed65670fa58d126e0a1446de4972cff7d8f2b06d7585c232dcebf0ba4e6c59a81ecc1fc81fc386626917a0eaa63b8dfaa2b2064e69fc40ed5875f2d5b","ssdeep":"192:GC0P0E75cbiYjziGjh5ANYwLHTYdwY6O7m9hymn8WtqygjzpT/26WKt:GmQ5cbzPiGjh5ANXkwNO69hnbtqygvp9","tlshash":"e222d7ce76a2306a939b107b613f050ff6b92a0c591d4800e465d8fdbdb4ea4537bd39","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.84277Z","times_seen":112,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/jquery.maskedinput.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/jquery.maskedinput.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-2902\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10498,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"8d8ec956b7eac73a9b778a210eb795a7","sha1":"931dbe67bdabb253767000230f692b5d06eedf34","sha256":"b134fc3f777a1aeb46d45b7999e88fb655daa62f4fafe5bcaed5f70b4bb7bcef","sha512":"54a35645e694a742370f12a46a98b176226f80d7617778ce575c8afbd6efec632a10757d96ee92e8812046ff09e44cea50afe183449d6bf658d5f7eed44d6e6b","ssdeep":"96:VBRRS3DZo/zdr5Q29ONKjGOBKzwPgWYMg8RHYTke8KSO7JPoxg4OOaYjrdofdkXE:a3OBtn9HKOEzUr+TkxAoxMu0T","tlshash":"1922630abca9516552b3b33bfbebc809f63b853b4085d504792c20506f3199447fafea","first_seen":"2023-03-08T12:47:06Z","last_seen":"2026-07-08T09:37:19.073693Z","times_seen":510,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:18.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:18 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:21.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:21 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:28.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:28 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 27938\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"603e8adc-15d9d\"\r\nlast-modified: Tue, 02 Mar 2021 18:58:36 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 152436\r\nexpires: Thu, 22 Apr 2027 12:39:10 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KJZOnYn%2FDFlQq%2BI9t0Bs1Xog2ki3cxmUg8h4YoFlkAa2GzuBbwnIrRPC34Fe%2B1ttbY%2BZHrVowls%2FnG7U6J7XUMeRpejpAUgx%2FEpuXBDwD5s95bu0HWGgM%2BqXRVxV08DaQMG7nkLN\"}]}\r\ncf-ray: 9f57165409402efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-24T13:32:12.519743Z","times_seen":493838,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":8,"receive":2,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/inputmask.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-1e20d\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":123405,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (858)","md5":"c8d1682044a5c04aafc85f61d9235d30","sha1":"968de7afd762516a94e480fea2232325b6b17923","sha256":"7a5dde98fa0c5faf365959c6911d93697e0ae90dc156db3f25afc3cbb4ddc1a9","sha512":"568555b74414342bc44bd5ed9fb56f16e2a800c342da73e74c0dfcf23ba2ab6c8820c294f081e00af421b98a8b61f96f615d34dc17632d11bc0cfb84657e43dc","ssdeep":"1536:xtmVA0+DER056oqkHV5OFpP7sO+g7+x+X3FW465+3Vz+VLLYRUT/p31c7PpE8Oy:xtmWQJqon0XVviUT/p31c7PpE8Oy","tlshash":"56c3d9655cd751026603b0beabdbc4057a7b4a2b198d9494bcbc26400f27da84bfbff4","first_seen":"2023-03-13T11:31:40Z","last_seen":"2026-05-02T12:39:33.84556Z","times_seen":110,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/images/arrow-left.1.svg","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/images/arrow-left.1.svg HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/giris.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: W/\"328-64f069b350750\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Apr 2026 05:19:27 GMT","end":"Wed, 01 Jul 2026 05:19:26 GMT"},"fingerprint":{"sha1":"BF:D8:14:32:18:86:B9:95:54:75:8D:F9:5F:29:DE:4E:F8:F8:F7:13","sha256":"0E:FA:80:0B:F4:13:81:81:4D:CF:50:35:5A:DD:DB:FA:00:0B:34:B2:2D:5D:28:08:E4:45:1F:2C:EF:D2:21:C2"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Apr 2026 17:15:17 GMT\r\nexpires: Thu, 29 Apr 2027 17:15:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 242634\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-07-24T13:54:42.372188Z","times_seen":314646,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":95,"dns":1,"connect":12,"send":0,"wait":9,"receive":17,"ssl":78},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.numeric.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/inputmask.numeric.extensions.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-614f\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":24911,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (528)","md5":"69fb87a2fc9b47c211950c37e07a586a","sha1":"ebec14e55641e1d10dbe0b264f4358b30afa2e85","sha256":"97bc947f6b6ffd0042a86a82ccee14a89920194d87c185eccd3208f70574067e","sha512":"642e4dcbc60944656ce45a4c934715edb879b82d00ba1cd0876966c4953d304a8de5934d37278717f5b148a425246c39e67307b6c6dd79c75b4af53021fd4d2c","ssdeep":"384:/YHU8NjK9dABOW1lBPM+XKPQ7iaL8CT76V34KmTLQTRw:YU8N29d9R+f62KVw","tlshash":"61b2401d5ee7905aa592b2aa1bbbc40d1cb48f43fad81a61341ca1851f204f4b7e7f73","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.848029Z","times_seen":118,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.date.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/inputmask.date.extensions.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-5f66\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24422,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (320)","md5":"5490c61d3f2f31497e6aa78117e721f8","sha1":"e9ffe55ee353700d86b4175a1e4c292c5001824d","sha256":"45e1abbe19c2f001c291c150e9fc5c70798203b4733e1841217524ba4720e8bf","sha512":"c148262f9af2a501f353307fc2de32f35c7eb1c2919cc354f78978e80267f0c78961872e6271f5e32d2d1155920e0c11649b7007e97b24c0f8f6050a3031bd56","ssdeep":"192:uTdvTQR2VrkIWMvSdEGIjBWYERMqtI+27PYNmf+bAxUeqVYbAgQHUh7YeT6KnmfK:uJsrUdfQE7PRvjL/BL02LMS4dL+","tlshash":"a0b21e0cece24089956731ed95bf450539b556d7a8eced64360c0088bf684ef83baef8","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.848971Z","times_seen":118,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-regular-webfont.1.woff","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-regular-webfont.1.woff HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":32,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:13.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:13 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:16.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:16 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/css/base.css","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/css/base.css HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-1f4c0\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":128192,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"45923c60eec6823044f5d6735e75b299","sha1":"584c5c8daaf3fb3b36c3b1e827e9d4f29b75e772","sha256":"73f7279807a6872a399e9f1b335ddf2a847f29784d4f769adfe18e0f96c0f232","sha512":"2b53894427b25d5edb4d5e41221e0e20d64ce20072b0d9ca613521ca150faad39d3b12dc90d95731693db8b8d0efb8dc21a2f17c31db5fbf04cafbcfefa199b7","ssdeep":"768:BuVeHUAF9rhnJdfNwwuCAzgrNfiOAYcRxq8yDiI+O1XSQx9SLNCZkz6J3nL+iNmJ:oeHUyDhrFXwI+GiQx9SLNakV","tlshash":"a6c3b631e1952199b237cd137ac137dd722ad233d0131ebaea67ba29c7c74de2166708","first_seen":"2023-04-22T19:39:37Z","last_seen":"2026-05-02T12:39:33.850136Z","times_seen":51,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/1.png","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/1.png HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 1855\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-73f\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1855,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 165 x 40, 8-bit colormap, non-interlaced","md5":"7847c396db234c92dc4b1bb4b759c011","sha1":"cd8357fc05042cb787267f01fe0c38ba6526e0e4","sha256":"b2f75fb62c0bf3c51f8eebc14891cf56976638fda4b0d23f90e2ee6dbd8f3b18","sha512":"f0eabda227f547754983cbf5a213686a9d0c7595d429224a65964dc871614439377d3a9761a45e81184b95dfbc0add2425ae706f154c4f3350b520c5de150823","ssdeep":"","tlshash":"7d31f9cdaa5d5bb4a7228c14ce0c692042ab99e0abb76108606d2112f8297c4de598a3","first_seen":"2023-04-30T19:06:20Z","last_seen":"2026-06-27T13:22:10.927355Z","times_seen":318,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/js/inputmask.extensions.js","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/js/inputmask.extensions.js HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-d73\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3443,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (320)","md5":"87b6e90dd6db8973420b90b1e81e08e3","sha1":"3099cb74ba3f8ab7ef31ffb854da83060f23e828","sha256":"b6451989470c4a49372ab0702abb602da99dbe7bb0707993bd3f01d703a80212","sha512":"66fc4217bbe56739f4e3bc6e2c9dec93dc17036c284730725591909cfcc8f0d34d526566d49fe6d653658ced3652f213e4808712fb1d42e089c9667af5b31689","ssdeep":"","tlshash":"59610e089ef56242089376b884ff4254a171cb6b1dd8ac0c78cc41589f1c68c37baeae","first_seen":"2023-03-09T08:44:03Z","last_seen":"2026-05-02T12:39:33.852244Z","times_seen":108,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-bold-webfont.1.woff2","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-bold-webfont.1.woff2 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-light-webfont.1.woff2","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-light-webfont.1.woff2 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-light-webfont.1.ttf","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-light-webfont.1.ttf HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: W/\"328-64f069b350750\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:23.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:23 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/img/form-progress.svg","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/img/form-progress.svg HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1068\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: \"69c249ec-42c\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1068,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d57db381e336134adc11990f2f6863f5","sha1":"67cfcefdf4c388118a149ad1749274419d1aa553","sha256":"ff7498da718b1f50faeefae71e24ceadf4575da0692b84c9a1ad359daa1f2ff2","sha512":"f01acf367cae68271cca375cbb50858b784fc26dc8cfc7e12fb1e4de43bf7b977e72188f5d824255d8c311f7f881f98dcd4cf2a3dc33d0633010d0363d7bdf51","ssdeep":"","tlshash":"1611127a8210cbad9ca1c0fccf4521a1659d911ae2c80349e3f0a972e2854ddf34d59a","first_seen":"2023-04-30T19:06:20Z","last_seen":"2026-06-17T08:06:33.408937Z","times_seen":220,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Apr 2026 05:19:27 GMT","end":"Wed, 01 Jul 2026 05:19:26 GMT"},"fingerprint":{"sha1":"BF:D8:14:32:18:86:B9:95:54:75:8D:F9:5F:29:DE:4E:F8:F8:F7:13","sha256":"0E:FA:80:0B:F4:13:81:81:4D:CF:50:35:5A:DD:DB:FA:00:0B:34:B2:2D:5D:28:08:E4:45:1F:2C:EF:D2:21:C2"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 35156\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Apr 2026 11:21:55 GMT\r\nexpires: Fri, 30 Apr 2027 11:21:55 GMT\r\ncache-control: public, max-age=31536000\r\nage: 177436\r\nlast-modified: Mon, 15 Sep 2025 16:30:01 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":35156,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 35156, version 1.0","md5":"062c1f2aaf2d4de07ad2a2f21c17ffc0","sha1":"3fd1f07343bd33a53cd374f7f107dbdf9effae03","sha256":"d5bab8e28732fe3d10dcef4f77b9c248605bbb2a87d289a2539251ceafab536a","sha512":"7ab522d8bc41128be5a15f2cb91f851f6dc5e437afbb90e6191bbe63d9b94a35911f04701fb2b291362b2ae0f0cc639dec2d15e53928afc5769590a2937e81cf","ssdeep":"768:is48okTArkNSgZJAf5jkRcaUNt8wrNPCbJktQV+n+NUB/wo8IEH:5hNTtNSgZJMjkRBUMwrNPC9NV+n+o81H","tlshash":"22f2e172c3787192ae0985760d60cec8986bb2098f7658b0143fdd38ee45345a3f6e6c","first_seen":"2025-05-29T19:30:52.507782Z","last_seen":"2026-07-24T14:20:03.035742Z","times_seen":22067,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":100,"dns":1,"connect":10,"send":0,"wait":19,"receive":2,"ssl":82},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-bold-webfont.1.woff","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-bold-webfont.1.woff HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-light-webfont.1.woff","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-light-webfont.1.woff HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: \"328-64f069b350750\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/fonts/opensans-regular-webfont.1.ttf","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/fonts/opensans-regular-webfont.1.ttf HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/base.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: W/\"328-64f069b350750\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/assets/css/giris.css","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:10.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /assets/css/giris.css HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 24 Mar 2026 08:23:08 GMT\r\netag: W/\"69c249ec-b0f9\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45305,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"d2f8dca7f5633637e8e632684975d97f","sha1":"1023b143336c8f73871e7b937a5be0952acfb4b4","sha256":"7240d65c7509f145e5147366d7393a1fd182cac4e950b15d2089c62b7e282d41","sha512":"3b674987eaa146a6634ff13b1cf14f43522f1f1ae25dcaf535c58a6d019dc83c10ac5b6ccba749274f9fdd723174fe6d1037535b7c87b52eaadf61a7def921bf","ssdeep":"384:EWcBOLBxgADLgBAIyXXFHXSzcsw0L5KFAUm351Gw2Wp8xtLMFo6ACsblLSdPd6wP:1sO/IyXXFXSGorg26wElu","tlshash":"d113537166321909b32bd94536c56fad3f2e6037ce8aeef9ec907d64c39998b10b1344","first_seen":"2023-04-11T18:53:33Z","last_seen":"2026-05-02T12:39:33.854116Z","times_seen":110,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/themes/izmir/images/button-right.1.svg","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:11.098Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"GET /themes/izmir/images/button-right.1.svg HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/assets/css/giris.css\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:11 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 09 Apr 2026 13:00:52 GMT\r\netag: W/\"328-64f069b350750\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-24T13:55:27.762898Z","times_seen":38463,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}},{"url":{"schema":"https","addr":"haftanin-noktasi.com.tr/veri.php?ip=91.90.42.154","fqdn":"haftanin-noktasi.com.tr","domain":"haftanin-noktasi.com.tr","tld":"com.tr"},"ip":{"addr":"159.223.219.193","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://haftanin-noktasi.com.tr/","date":"2026-05-02T12:39:26.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"haftanin-noktasi.com.tr","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 12:04:00 GMT","end":"Wed, 08 Jul 2026 12:03:59 GMT"},"fingerprint":{"sha1":"BC:57:E4:C4:B1:52:78:C6:22:BA:40:48:58:7D:EE:46:7B:94:9C:FC","sha256":"0C:07:04:C0:44:26:91:3C:F6:C3:F1:0A:DF:39:52:BA:5E:AB:E5:6E:0D:3D:74:A5:0E:89:79:8D:6B:0A:D2:1B"}}},"request":{"raw":"POST /veri.php?ip=91.90.42.154 HTTP/1.1\r\nHost: haftanin-noktasi.com.tr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nOrigin: https://haftanin-noktasi.com.tr\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://haftanin-noktasi.com.tr/\r\nCookie: PHPSESSID=0ff5129b1149bb0385a49e22e18b5fa3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 02 May 2026 12:39:26 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-powered-by: PHP/8.4.20, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.4.20","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-02","alert":"Phishing Block","trigger":"haftanin-noktasi.com.tr","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-02","alert":"Sinkholed","trigger":"haftanin-noktasi.com.tr","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - e-Devlet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with e-Devlet phishing","tags":["e-devlet","phishing","government","turkey"],"meta":null}]}}]}