WEBSITE ANALYSIS REPORT

https://tokibasv3urdumunnngeldi.xyz/login.php

01 Jul 2026 · 19:37:00.000 UTCpublic

Report tags: e-devlet phishing government turkey
Submit tags: openphish

Request review

Phishing detected

8 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

19:36:37.100 GET 200 document 10.3 KB 127 ms 7 alerts

19:36:37.458 GET 200 stylesheet 50.2 KB 59 ms 7 alerts

19:36:37.461 GET 200 stylesheet 22.2 KB 71 ms 7 alerts

19:36:37.463 GET 200 script 3.5 KB 23 ms 7 alerts

19:36:37.465 GET 200 script 1.8 KB 25 ms 7 alerts

19:36:37.471 GET 200 script 161 B 23 ms 7 alerts

19:36:37.473 GET 200 script 1.5 KB 22 ms 7 alerts

19:36:37.475 GET 200 script 1.2 KB 25 ms 7 alerts

19:36:37.477 GET 200 script 153.9 KB 48 ms 7 alerts

19:36:37.478 GET 200 script 65.0 KB 54 ms 7 alerts

19:36:37.480 GET 200 script 9.6 KB 50 ms 7 alerts

19:36:37.488 GET 200 img 41.8 KB 51 ms 7 alerts

19:36:37.490 GET 200 img 2.2 KB 46 ms 7 alerts

Transaction #02

Request / response

URL

GET HTTPS

https://tokibasv3urdumunnngeldi.xyz/login/e-Devlet%20Kap%C4%B1s%C4%B1_files/1.png

IP / ASN

172.67.132.247

AS13335 · CLOUDFLARENET

Requested by: https://tokibasv3urdumunnngeldi.xyz/login.php

Resource information

File type: PNG image data, 165 x 40, 8-bit colormap, interlaced
MIME type: image/png
First seen (UTC): 01 Jul 2026 · 06:07:23.166 UTC
Last seen (UTC): 15 Jul 2026 · 06:13:00.785 UTC
Times seen: 4

Size: 2.2 KB (2269 bytes)
MD5: 25d470ddd9d8acc9261b228728b7f759
SHA1: 257aad62a5ec2417adbd144d7cc4c25a4329fd94
SHA256: b7131c6fec5d941a8c8cf83a4c154a7c43c0ff7741bfa30b2d297b1343213f99

Certificate information

Issuer: Google Trust Services · WE1
Subject: tokibasv3urdumunnngeldi.xyz
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 2D:72:78:5D:77:87:9D:49:CC:3A:88:1C:3A:04:B2:EE:0C:20:38:E1
Valid from: Tue, 30 Jun 2026 16:31:26 GMT
Valid until: Mon, 28 Sep 2026 17:29:44 GMT

Technology fingerprints

Cloudflare (CDN)
Plesk (Hosting panels)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - e-Devlet	medium	Phishing
DigiCert UltraDNS Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing
Hagezi Threat Feed Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /login/e-Devlet%20Kap%C4%B1s%C4%B1_files/1.png HTTP/1.1
Host: tokibasv3urdumunnngeldi.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://tokibasv3urdumunnngeldi.xyz/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
server: cloudflare
date: Wed, 01 Jul 2026 19:36:37 GMT
content-type: image/png
server-timing: cfExtPri
last-modified: Tue, 23 Jun 2026 22:36:48 GMT
etag: "6a3b0a80-8dd"
x-powered-by: PleskLin
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: REVALIDATED
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=5,i
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=i8hLQZb%2Bn8OcLdcW5m%2F3jb90LurcxXvOsByVJ9dy0OPICjA5PXVS98EzebzCT%2F5e26C%2BofxqStf1rmWW0sNDpUD5B8cfDaedm8s4lrEM8BBnF0gC%2Fq3ZxGlChaWOPeymSbDZ9qJ2JZ9r30FNUxM%3D"}]}
cf-ray: a147dc525fcb56b7-OSL
alt-svc: h3=":443"; ma=86400
content-length: 2269

19:36:37.492 GET 200 img 74.4 KB 88 ms 7 alerts

19:36:37.493 GET 200 img 16.4 KB 51 ms 7 alerts

19:36:37.569 GET 404 font 808 B 54 ms 7 alerts

19:36:37.572 GET 404 font 808 B 50 ms 7 alerts

19:36:37.576 GET 404 font 808 B 49 ms 7 alerts

19:36:37.578 GET 404 font 808 B 51 ms 7 alerts

19:36:37.580 GET 404 font 808 B 53 ms 7 alerts

19:36:37.582 GET 404 font 808 B 51 ms 7 alerts

19:36:37.879 GET No response img 0 B 0 ms —

19:36:37.880 GET No response img 0 B 0 ms —

19:36:37.882 GET 404 script 808 B 50 ms 7 alerts

19:36:37.883 GET 404 script 808 B 55 ms 7 alerts

19:36:37.889 GET 404 script 808 B 54 ms 7 alerts

https://tokibasv3urdumunnngeldi.xyz/login.php

Domain graph

Hostnames

Connections