{"report_id":"e91b9286-b6aa-46f1-a9af-7a8beb94541e","version":0,"status":"done","tags":[],"date":"2026-08-30T02:25:34Z","url":{"schema":"http","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":0,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"final":{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"title":"Ziraats Bank","dom":{"size":41914,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (26399)","md5":"f9c80be5efe2f2e7908cbc6464a4baa1","sha1":"7c0e9f1f6a741316015e209aaccd4280bb8140e6","sha256":"3432aeb269181b7717693d00dee9e8cb7c65d8ca5f55cd8f256814ef3c1dfcc8","sha512":"21d456fda273365aef1226c05d8ece08a4ef27ce93be2cef19159c86b92fcf060e436cc20acfb22e4e9b1c3830c864d76efec26873cd4ef89d1a3e7202ec1a98","ssdeep":"768:0yJi2qbCmmWq38FTbfsTO+hDGq3t8UtN2v3k/SR+D/5km58:FJzqbCmmWq38FTbfsTO+hDZ3t8UtAk/C","tlshash":"a513a7276784452c9c53d278f399b54ea32af688ef6259eef7c23410c2d93ff088a455","dom_hash":"domhash5a2e7b986a359100c1311ce7180015d1","first_seen":"2026-07-07T22:08:47.685476Z","last_seen":"2026-08-30T04:55:57.247417Z","times_seen":1009,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":0,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-04T02:25:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"translations.smartsuppcdn.com","ip":{"addr":"185.76.9.27","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2018-11-20","domain_rank":560346,"first_seen":"2022-11-04T22:28:35Z","last_seen":"2026-08-28T18:32:03.449136Z","alert_count":0,"request_count":1,"received_data":7743,"sent_data":539,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"cdn.gtranslate.net","ip":{"addr":"172.67.68.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2011-05-26","domain_rank":101861,"first_seen":"2022-11-07T21:49:20Z","last_seen":"2026-08-28T05:43:07.341812Z","alert_count":0,"request_count":2,"received_data":25367,"sent_data":1046,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"widget-v3.smartsuppcdn.com","ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2018-11-20","domain_rank":532262,"first_seen":"2022-10-03T13:48:45Z","last_seen":"2026-08-28T18:32:03.30552Z","alert_count":0,"request_count":4,"received_data":330892,"sent_data":1930,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"bootstrap.smartsuppchat.com","ip":{"addr":"3.79.72.4","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2014-02-02","domain_rank":425291,"first_seen":"2018-01-29T06:10:36Z","last_seen":"2026-08-28T18:32:04.579007Z","alert_count":0,"request_count":1,"received_data":1578,"sent_data":557,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.smartsuppchat.com","ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2014-02-02","domain_rank":491650,"first_seen":"2017-01-30T05:24:57Z","last_seen":"2026-08-28T18:32:04.297063Z","alert_count":0,"request_count":1,"received_data":18547,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-23T22:20:52.902616Z","alert_count":0,"request_count":7,"received_data":253234,"sent_data":4086,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-23T22:23:59.870946Z","alert_count":0,"request_count":3,"received_data":105430,"sent_data":1770,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"websocket-visitors.smartsupp.com","ip":{"addr":"63.188.129.148","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2012-08-25","domain_rank":411464,"first_seen":"2021-07-12T07:42:32Z","last_seen":"2026-08-28T20:21:23.360467Z","alert_count":0,"request_count":1,"received_data":224,"sent_data":642,"comment":"","tags":null,"fingerprints":[{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}]},{"fqdn":"ziraatsbank.cftcrecovry.com","ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"domain_registered":"2026-03-09","domain_rank":0,"first_seen":"2026-08-30T02:25:36.879988Z","last_seen":"2026-08-30T02:25:36.879988Z","alert_count":134,"request_count":67,"received_data":1721581,"sent_data":84018,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WOW","description":"Reveal CSS animation as you scroll down a page.","website":"https://www.delac.io/WOW","common_platform_enumeration":"","icon":"","categories":["JavaScript frameworks","Web frameworks","JavaScript graphics"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]},{"name":"parallax.js","description":"Simple parallax scrolling effect.","website":"https://github.com/pixelcog/parallax.js","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/assets/main-DabC6aZO.js","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"484b339ab8994cd2aa6196b02c94bf40","sha1":"4859d1218ce4eabd728109388b5e999e361399cf","sha256":"6f1773ddd0916b4b176d423ef1ac87883da34e76dd895250be5ccca462fbf0b6","sha512":"ed195878480c14d1a519189d01ea5f90e05ba387f64c7f6958515af3a5cb3375f3a73ff98cf9f9602eaf50f779fc32521c76640ae170c056a00d76ec42f0cf92","ssdeep":"384:a2NcFT88tMPdBgaw5O+mvRan7/AKsDoKVwA3Q+crsbUzgfTtQfQIeIa:ZNcFX+dBgaw5O+aanrkoK2A3Q+cwbUwZ","tlshash":"9672e8741210743f712fac492a6df497723ad298e597c5289a2fdd5c36c8cc0a873bb5","size":16028,"data":"","first_seen":"2026-08-27T10:24:41.410826Z","last_seen":"2026-08-30T04:45:48.816118Z","times_seen":145,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/magnific-popup.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"b37d7edf99565d3858eaa1ad80df3cff","sha1":"786a4343711e9af5e5dfcc493e7d2331b48875bb","sha256":"b0a45cd5aed66e27bd8ee861d0e3b782c8e79849bde32f90f078b9f2451a36f2","sha512":"a48797bf6796ab59e1b40003c98ac999a877c8b07adbf317b087ff49046c943a11c3922b92f228e88c1c770b1e4d80b75240c79e9958de50fcf1fbb9c35dbd1a","ssdeep":"384:iPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:iPBIt8I5h5t1qkOLCMst","tlshash":"bf921894f2b2b21383a735b8686f60093a729952ed06c855a55d94d87efcec89027f3c","size":20219,"data":"","first_seen":"2023-03-07T01:03:21Z","last_seen":"2026-08-30T05:29:15.275592Z","times_seen":25399,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/wow.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed4b12ef0f7e4bf5d5ff3555d18718cb","sha1":"258fa26dec8fcf4769d49eaca6712ef56923673e","sha256":"3162b6468674133d7b6c903e4b8a06f7faf51216d1e7f8b3edc8f326b1bfe461","sha512":"40d8f96697d393a5301d2960394cbea52ea64330a8b706a0982e9b17176bfc0d55394dd4f0fbea2cd1798c938e66ccccc671d803b2802f8b37c2c41f40c1200a","ssdeep":"96:xrZgL1xvPV6GqKyR6TYdtHFMLzA4pOROVEE1fosvGeaMozHImBaokbl:xry9PVfSnAPAjROVEEdos+eatzHILoe","tlshash":"17f175c9ba967035c75792f2833f0106b23a5aeea028047cb5b98dd57d38c58523bf78","size":8183,"data":"","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-08-30T03:14:58.21291Z","times_seen":2654,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/main.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"47bc986391ae43304be7544164cf022d","sha1":"e42afdb45a95bee3a021a79a24bb0357f84b62b8","sha256":"f7f7c12c779f4100a67c0a9c853a1f4a534183c36746df58d358bb5d02e548f8","sha512":"95d746af3aa95c33c01f8ad9e80ba17b7390bae9c4df4c0d2d85762bb84ac18604bfe07eab20d2106486a7a1b26e83c621d84b1d3b7fa0a064ce6d94be6f483b","ssdeep":"96:705I1XuiMlvMsW638DBpUtr+LIZDu7dQzqvcr8r:705I1Xx0tuIZDTA","tlshash":"15c17344714c143dc5fb32a4d139d5098f7d6111e203b2f5f8fe00ac1b686aeb6ba99e","size":5916,"data":"","first_seen":"2024-08-29T17:20:29.828451Z","last_seen":"2026-08-30T03:14:58.192368Z","times_seen":334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"6aef912540ff1f056bd8ddade6e7bea4","sha1":"3d506ddea1700fb96aea9886a2b35476053dc1fd","sha256":"20482c90a37f75f3b7a67172f99751593b65a4bb566bdb9917d4d82aea174971","sha512":"f66d8134701e3103a856042a171e1ec6ecd4bd3c42d4468a618f8e632a15a3afbe11ff04293bb8e3260e87b2d671a61e274546e9e60753042788cd036849852d","ssdeep":"","tlshash":"d9212b1762a1643141fb38f91bdb5784372410836404d8573daedf4d0f2379269b3be8","size":1121,"data":"","first_seen":"2026-06-14T08:01:07.614618Z","last_seen":"2026-08-30T04:54:51.795103Z","times_seen":183,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc67cd42e44d1e9f0a0a0f8ca7ac9da6","sha1":"8b46bf2e2262e9329d39c1c2b63085e225d67841","sha256":"180dfde18da5b77cb518a69d89ce6d6594f1e1acbdcffcbf3cfc0343fd5938fc","sha512":"9cf7f00ad0e55cb19ad8f14cb1e27cc6acffc8cf3877d3f9fb9d1546c78aee8a3a68b6bb05b7d4b6a35b3dd692690834488c9cfdebf9278d6e9090bc4e2c87a8","ssdeep":"","tlshash":"2cc08c0bb071114b0087f005938a08883124400b01390d28368c508a3fb2f8c034e6a8","size":180,"data":"","first_seen":"2026-05-26T00:10:57.605202Z","last_seen":"2026-08-30T04:54:51.796021Z","times_seen":308,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"35b727150f72dcb5f53f0604a2622d7e","sha1":"154ea17bbb0c5b231262702a112392609fcf45b5","sha256":"9bf91e73c20f5f1288c6eccf0e2d8a1ae6a36cb3f31d3b9e5deb4f29bbad54e8","sha512":"061cf0afe7af6dcddb5b421ca4ddc7782dd567f78956a58c904348f0fa1256353939662508aa0b1bb17d3f06edcc08e46f5e3cf27952a61c516475bbe0ffaea4","ssdeep":"","tlshash":"1e51dbae527b37702d9392b61b6b2b05323150bb2420ca547eef87548f97d42a0537d3","size":2520,"data":"","first_seen":"2026-06-14T08:01:07.615969Z","last_seen":"2026-08-30T04:48:49.463978Z","times_seen":153,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7d5573d5bac6b73ab6b114313ab16c2","sha1":"bda3c5c75bc86e3adc32b02d3aa1c38a25f21cea","sha256":"51aace0c88daef26ec6a3236eee06f36997e45caa770e04d80451510b5af004a","sha512":"a4f406be5cbb9dff7693e97b2e6c21410014d8be58e8d6b84dd923118234593363420761ec3945522aa39c69dadf088e588b0b584bfeabba0512e7afc59755d3","ssdeep":"96:a5Ku84QWJXDQWHB5EcRnSXBvu96adgMea7piLskym6y0:a5K1QDrB5ZhC0VhD7piQkym6y0","tlshash":"2aa1732956f1143466936178bf2b9b063735a103b024cc287fde5784dfcea35a9933da","size":4639,"data":"","first_seen":"2026-08-30T02:25:40.635204Z","last_seen":"2026-08-30T02:25:40.635204Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"47763bd7f2dd1f4382d08390fd57543e","sha1":"02f9384db4fd1fc4fef099f30effdcf8b02ea405","sha256":"1cf5fc2e8152dd9de806c0f5cc4c3c8c643af4e766904af5351130f4803851b9","sha512":"77b376186666c380bccf3334c2ffb50b204ae71534294d2dfc65b9d4d12d1f961df14c14e6359a67b6d2c5d8325d7c6335b24af0a4f7b09d89aa28c0531de57d","ssdeep":"","tlshash":"f9c08c188032a078000a210c8ab92292322041e70e163d24b39d544a0f0aa4f43b929c","size":175,"data":"","first_seen":"2026-05-25T21:59:04.609021Z","last_seen":"2026-08-30T04:55:57.585646Z","times_seen":1402,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":true,"md5":"b5535ab9e2cacc6e00a201ea72a28a01","sha1":"b46f05588723619e241f103e1a46c795eadcd670","sha256":"8a2dc5b8f88ab849847283032eebde871122d38cb401cab2f2dcf5d1af2e0fd7","sha512":"44a194fb2e92162906ed0659d419e7547042e3ad6d64e455fe39510bc12d45e3b245481cec50f666f6ba77c777d443eba1031de9d8679e1257f8ef37ef45dac4","ssdeep":"","tlshash":"53e0f13d3c788095579200b6c0b7f1383d06302400d0c94788a7d82d6cf0fca7d416d9","size":416,"data":"","first_seen":"2026-08-30T02:25:40.639425Z","last_seen":"2026-08-30T02:25:40.639425Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.smartsuppchat.com/loader.js?","fqdn":"www.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"218d24439d4e2c0990f35338a7ac220c","sha1":"5a7b913584c1244bf61beab9dc644204d130101c","sha256":"efb497f7159de26ea5e0521d675d909dc063e36d0d23c2ad96fa9109b73ee263","sha512":"17af39bfdc350c9d1f8dd74652641d0c028881ecb3935d2d9fdb763d24136665d135d00219aabac57693112e2314d4fa91b802ba2662a1580aa35c5e0b6e624b","ssdeep":"384:2/xzy2A3wyxNeBWbEgl/EuVaBWbE0rIcvqSI/aQ/UpG:2/xzy2A3wXscuVaAxka05","tlshash":"4182b7cc7691b16543ab61b4843f620ff1376929740d8865b965eae13cb8c8ed037fb8","size":18024,"data":"","first_seen":"2026-03-30T19:01:55.527327Z","last_seen":"2026-08-30T04:54:51.7563Z","times_seen":8978,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/bootstrap.bundle.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"52a78545b39d3c5ceeabbac8cbe46cc0","sha1":"99e4421a2f4de040de5905bc15cd45d291ded586","sha256":"120666e01d671db172cecd87aaaed5cb0feb2da24d971c291fe1b8e0f64b18ac","sha512":"22cde83ff9ed88611b9307db3ec6604683d958c3d8caf879220f60146ff760d60dd5769cc5accb9655e269c21c2829fab47ad0d57963714ad435a3c4db28fc59","ssdeep":"1536:P+pbTNR2t4NEdiK5J2w8gGzjJVPOW7tI+r9ixR2nwZ7:u36WJr9ixF","tlshash":"3273c5493254b8730ade45a68037470bf3265994b14b802cb5bcadde2a3dd8672b7f7c","size":78085,"data":"","first_seen":"2023-03-08T09:18:43Z","last_seen":"2026-08-30T04:54:51.764102Z","times_seen":3301,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/slick.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"cca96dece8c053d46dfa20101388d2d3","sha1":"2c14e299764bcea9dc875e1f2e1a86afc7bc3fcf","sha256":"db5a2153f69965283f3d434959ffbee8dc61514e524fb871c6faac56a1b6f742","sha512":"a2ef71e1187f1aced8be072976d59cd360a4015fabdb3a2bc55d56df4fa06eff59e24aff355dcbf1cea7efe8c49cd3cf760152c40283803f6f08e97c88307815","ssdeep":"768:MjL0ySLGPzYbHpJIkdSAeFr8qGAOxCt/QXlGLAcB68Kmb:UrPzYbVxCt/fB6ri","tlshash":"4033b409a210172658e725f5305bc54c73ffe6ba9a01c1d878e683ca24dd1059fdfbea","size":50674,"data":"","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.170066Z","times_seen":716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/parallax.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"9a9a9442f70e0807475a21b835dce50b","sha1":"7b4755ab79dcfbe1aecb13823f78997061fd1b8f","sha256":"fde3fba1a1c3dbae530a58d3a542369cef2e0000685cb299a265e721056d4201","sha512":"20a1dd28d273d407d096be59beb4a92c260791d1cf16019cde84651f22fd69f9a62950dae7addb5f807452a32afaa02b406d72f5d79d43d8caa9716960919cb2","ssdeep":"192:t0PtdiPwbyxVZ8343NiOAZSUa89Fr15FZxY8wb84FxDco+W4+D:t0uPwGLsgNiOAZSIp15FZ68wbZWWl","tlshash":"3d52a8453ae6111502ff73ad609f57087528a232c52ace1f7c3dc2d8a580b8953bb779","size":13302,"data":"","first_seen":"2024-08-29T17:20:29.824917Z","last_seen":"2026-08-30T03:14:58.17133Z","times_seen":364,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/assets/shared-DqnxneoL.js","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"00e2016c8eaa5d81104f61ec86462ef5","sha1":"16249d91aa367532b08f1dc494900a84520301c3","sha256":"d7da9bee8ad6397d1e6788b169f82b37f111b2628a998188e707329483ce5596","sha512":"caefb7d25ba6b24a5864f3ef23b2c5200246c88d0fe8e22095b3672597b729e0b3b99447d4c1458c2c5d74204846caee20095e727b273020593b4e12dc878952","ssdeep":"6144:FMAopqOWSr8ad2jJKaQqhJp9cuRgufObV:4qOW2Rd29d/DRJfObV","tlshash":"f9443ad53294b035439b51e6906f2106f33e5c19580d812cf269ece639baec4a2f7fb8","size":274225,"data":"","first_seen":"2026-08-27T10:24:41.327319Z","last_seen":"2026-08-30T04:45:48.824482Z","times_seen":145,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/meanmenu.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"f92bd7e01c33f6a2bd73c5a2833b4874","sha1":"39533bc5c1e8128008023565e03830e00ce17808","sha256":"0927e12f94a642d9bbf07b4204102848162eeecadc02d002ace6fe334315b832","sha512":"e8a7d2768621e01fdf3e45eb187437f7c452f6fafd1d0a48add3844c7d16858ebadaa17f7b7272625f99b8a3f1f4426fab861d62cf1c0656bcca6617a12b344b","ssdeep":"96:cqHVT5bG+ESTXybNrNnaToz99MClbxXvY+CSoGZn7c6BFSEXT:zVT519XyJnl1BCSlZnl9XT","tlshash":"bfc1dd2bb5b044f8a0bb7a61b97af230f4f3660bf146d50131bd64262f31d6015a2fe9","size":6035,"data":"","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.169434Z","times_seen":616,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/odometer.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"cbbe383a299d4cd3c5afd850e23b93e2","sha1":"a57fab98eed3ee4da231031c823c0dfe71435e5d","sha256":"b98842a571aa1f32f8797a9d08186bb021f258925a8db4fe57d60129b858b1ec","sha512":"85b7267f38755128dff6d6435f050b949d6b99c72290c00d6813b16207c8e3e70ae01300f4269fe28df87960be5ef2211c3ce4929ea36ae866bb0e6ff7f849e4","ssdeep":"192:kABzlvQK8QecCHAOcu2a+OdI5s/GMb8XuulT:vBhv18QecCxVxz+7dlT","tlshash":"3b228580ba11a725835372e151bf0609b7bb99aea404401db67c9dd9be29c38e12bf74","size":10264,"data":"","first_seen":"2023-03-07T12:27:14Z","last_seen":"2026-08-30T04:54:51.781805Z","times_seen":3535,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/owl.carousel.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"efc01f2aded8e7b272ab9f9e1b3ecdb0","sha1":"eef21a57c46361f05c28d0d7b97fdc6530185c17","sha256":"668bfb67cff6b815ff9f9b82e070d4ad8721414bca6f3de21f10fb9f3e5dfa32","sha512":"20e04e83be2dbab7ec9972ac31ba5372fa53d62d046220f93e348c47f1840b636d54d8ca380eb36e7f7445123eec24e1d435fb61928eea259ccf912c5c3e8b08","ssdeep":"768:FCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSRc7UuHjRUQuFBt33:MITMFC4dbMVRSRcgRDV","tlshash":"cf137346b3202d2a869b61a0663f160bb23a241ce414547d7d79e6de6d7d88c213ffbc","size":44350,"data":"","first_seen":"2023-03-08T07:37:20Z","last_seen":"2026-08-30T03:14:58.216649Z","times_seen":1022,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/form-validator.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5cae60d0a59205f9c82928fb16ca1a6","sha1":"c03a6517da694e1ba5aa6b9dc6a647bd119b819a","sha256":"60c23945490cba413f3d6cf2cc57d5c560faeb0cf68ab38daedc80939966b108","sha512":"c43f6e446c89df6fc82c5cecd3b5727bcc226c2826f9ec8e0ac88925ade0bffc212d92759b6c8117d31fa6b032feffe91cb2519318320a16bca2e07d9cd29043","ssdeep":"96:H1MWGbU563CvldugvwYdfWA3oTa9+xcuS+5ijkunc9s5BeK7p8vmiIKpiyW:H1MW+U563CvzugvXdfZUopjkunosfR+W","tlshash":"c4c13449366321921f9234f5419b828b72b97b38c50a409435fa84f1aaf8fc167f7b39","size":6063,"data":"","first_seen":"2023-03-08T00:47:54Z","last_seen":"2026-08-30T03:14:58.211465Z","times_seen":1082,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/contact-form-script.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"3dc6989850222aee1a68cc132426f035","sha1":"f6a762662c4df511e97df3f0dd730b64aa31cd9d","sha256":"bbe7b53d11fee22a044cff9a34d37fe623ad369becd7a442e3b4f268e5d603d3","sha512":"2d2152378e98221bdf87e05c0d5fb7a97a69a335f565e5ea260dbf893d3bdb4237740a3577b6b3061759c9870b96dd0c875303c8bdb39547b6ac4f7dadc33fd7","ssdeep":"","tlshash":"5741bd08651927c40a333b7de69a9104df611363c505eb553caca9d46fb8f9831a1fbd","size":2144,"data":"","first_seen":"2023-03-10T17:30:02Z","last_seen":"2026-08-30T03:14:58.195737Z","times_seen":348,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/jquery.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e4bb227fb55271bfe9c9d4a09147bd8","sha1":"156837f75f6600ccb602b4efcbd393636c33f35e","sha256":"ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127","sha512":"f7810ef9df875a7fdfa7228f7e2f95dd34e18b57f56a46383198ebcc591e32f633b0d73cc6b271fbc669347f7fdc114cce6a6b43681104b25084fe2a1e7bee49","ssdeep":"1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vN:eIh8GgP3hujzwbhd3XvSiDQ47GK/","tlshash":"589309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:21Z","last_seen":"2026-08-30T04:54:51.791373Z","times_seen":11189,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/nice-select.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ab62d8a15524602c06b356ae74eea55c","sha1":"ae602ab104a3f8008fbcfd7967cb302dd0681e20","sha256":"cd204d095086d67e207e13bae8ceb3de8759eb9eedcd4080809c929dc7af1065","sha512":"d4798aa79f38cf35ae416780c5d8daf9333ec29440c55d6d9c164aef67cbea21984ee309b756c09628bcf69c52ed29fe5b56ac44b31cccbb78b223ae06c43f95","ssdeep":"","tlshash":"60511114b10512f648ff24d37911b147a075493dc42ac14aa97e86b21dfec02aab6d5f","size":2937,"data":"","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.184701Z","times_seen":607,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.gtranslate.net/widgets/latest/float.js","fqdn":"cdn.gtranslate.net","domain":"gtranslate.net","tld":"net"},"ip":{"addr":"172.67.68.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"68ee10aa7ede43f8bb3293b220daf775","sha1":"1f26a636577ea9aaa524c0a23ae8cf342be925e9","sha256":"76e28fc0425d80422e45305464ada45c7c9b4a00132c65012c737c22814c259f","sha512":"531d2baf5f4d61c0def2c5f45fd8d9b69b143c24d0474a01291d858b086b45c233d1cca885cc722d6e6eaff3f8cb62e637df797beca8f5aec20d090f0e23fe08","ssdeep":"384:UzCKMPZATN09o0mtvwfEXMb5TZ/dDszCnfYI:UVMhAh060svwcX0T1dhh","tlshash":"10a2c62921b3003a49531265efff165c607a02b78004ec24bfaeddc2dfd59a9caa77d5","size":23138,"data":"","first_seen":"2026-05-06T20:53:53.345523Z","last_seen":"2026-08-30T04:55:57.483116Z","times_seen":2650,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"[PWA] Service Worker registration failed:ServiceWorker script at https://ziraatsbank.cftcrecovry.com/sw.js for scope https://ziraatsbank.cftcrecovry.com/ encountered an error during installation.","filename":"https://ziraatsbank.cftcrecovry.com/","line_number":1668,"column_number":29}]},"http":[{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-8.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.160Z","timestamp":1788056698160,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-8.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2309\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2309,"size_decoded":2594,"mime_type":"image/png","magic":"PNG image data, 91 x 56, 8-bit gray+alpha, non-interlaced","md5":"50c9cf54409bebaed5eaa47dc354ed2f","sha1":"bcecf99571656410e7ba7aad2f5c206c0215b1c1","sha256":"77f31bbbbfc4d6d6979f8ea288f16650ad23091ce59696241ea258f7f0061447","sha512":"8e9087ee3970e78c19846a8e0e73b0766b299b1d5262706cb74f0ea03237ba975cd116c2e6e37c900b3f5e2c1631e5ad751793f614364849f63f31ad96853240","ssdeep":"","tlshash":"f4414bbbb1919c2eb380636b98efe9dc3a445183838f420a87259420d0901ae2d5ce2b","first_seen":"2024-08-29T17:20:29.853611Z","last_seen":"2026-08-30T03:14:58.226684Z","times_seen":199,"resource_available":false,"data":null}},"time_used":911,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":908,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/fontawesome.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.079Z","timestamp":1788056698079,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/fontawesome.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 17720\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89166,"size_decoded":18050,"mime_type":"text/css","magic":"ASCII text, with very long lines (65312), with CRLF line terminators","md5":"c858b27aa3346543c8a9fa0e8e48bf96","sha1":"682d2201ea724790a5216a74690362a32c201126","sha256":"51378e1e8afaf0d01dacb6da2997f918193e39ca0dfbf27b3d2bee66274403c9","sha512":"c28ffb3fc229404e589944c31aedbad4f453efc3e119531ace0eade726fc61460d68ac4272c717d81f18031d938a2688be7c8e15cc4ab77e42a00766a9682923","ssdeep":"1536:KbMVM6MVMkMVM9MVMNMVMispxd1zJJ29Nll3IVVUHsR+v:cd1NY95IVVUMR+v","tlshash":"5193a9e9e04c05d56732c44baf99b37c65b6f73cd5810da9f02f580c1ad26a822c6f7a","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.220455Z","times_seen":590,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/flaticon.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.083Z","timestamp":1788056698083,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/flaticon.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 439\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1569,"size_decoded":767,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"4b685b2dfd3cfb19626146177d1c95e5","sha1":"f195ad890dd1d507d2fab849448e9b737f9d6bbf","sha256":"909efd0a62bbc415e927346844061afdedd751683b6eba7142b1db3bb72ea18c","sha512":"621b491a8b01a066a23630a90ebb71fbaa89c6d10dc9581064a548f82f2c467c5b4a47237a829d4ac375ae049c47f571b96d494124d5fe314f7c565b39189ade","ssdeep":"","tlshash":"4e31e6e9c12e10818712af45e7abb6d0af48b02c99c09d1ae1751d9dfef1e35878279c","first_seen":"2025-04-09T11:54:58.551863Z","last_seen":"2026-08-30T03:14:58.168005Z","times_seen":325,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/translate.google.com/translate_a/elementa0d8a0d8?cb=googleTranslateElementInit","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.104Z","timestamp":1788056698104,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /translate.google.com/translate_a/elementa0d8a0d8?cb=googleTranslateElementInit HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nx-powered-by: PHP/8.2.33\r\ncache-control: no-cache, private\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 413\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":956,"size_decoded":670,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"0d4cace6d9e578288be59d8d97401ae4","sha1":"1067a5c6b08c362aef0ba8b963dfbd4fa2d5e1dd","sha256":"8aa4b33adcfef57fa8cd63c8ca3d3fae214dce1c87e239e14ee79e449c8e313a","sha512":"2842dfb293e577cc530ff0f45ccdb62538be6323b22cc7f8eb8e0fe47d1097a05bf3f2b68c2ffa7a9a5b8100174bf361703bfa6c85ace0a2a6d71ecfaf042b4d","ssdeep":"","tlshash":"2a111c6b44425abe1250c5e2b034332ed0dbaf3b6a826840e46711a66ac8bc5c87a098","first_seen":"2026-08-30T02:25:40.500126Z","last_seen":"2026-08-30T02:25:40.500126Z","times_seen":1,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-10.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.161Z","timestamp":1788056698161,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-10.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1750\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1750,"size_decoded":2035,"mime_type":"image/png","magic":"PNG image data, 141 x 32, 8-bit gray+alpha, non-interlaced","md5":"929ccccb0b047c31dc025c72ecc5525c","sha1":"249a2600a4ba4c31aeac4158cba7812951a2a421","sha256":"424f9421e18757e27fba8030ba3f419629eb8602818fe931581ee07566bb3809","sha512":"a2d57287a45145afc5e6d0ba6a10f4f108ce789cba14871ef7d55a84a4261bf68ec8508a6195f7c0bee91825b5d96605bd0b9bbb653ee8d8767425d3fc971705","ssdeep":"","tlshash":"77312bbf1724c9452de36757b7150cb26925175f498238a1cf7eb4878e6050da073eb3","first_seen":"2024-08-29T17:20:29.86118Z","last_seen":"2026-08-30T03:14:58.218235Z","times_seen":199,"resource_available":false,"data":null}},"time_used":909,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":909,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/fonts/fa-solid-900.woff2","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.256Z","timestamp":1788056699256,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/fonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/temp/custom/assets/css/fontawesome.min.css\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:25:00 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-length: 126828\r\ndate: Sun, 30 Aug 2026 02:25:00 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":126828,"size_decoded":127116,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 126828, version 768.256","md5":"297973a488f688271dd223d542ba2697","sha1":"ed99d812e4c88826335f93acede3fad85c90fb54","sha256":"1b099f88c06ed0869872561c157f0ec9cbe133a0939d9ece4ee1e1f54bd4683d","sha512":"83c802972d9fee9dd7e3c0de42d8636c504e65ff20e43406bb446cc95a16acaa21789a03f0e2006148abfe47100bbd0c66aa4cf98f11e9b0220f1dcdb5204f46","ssdeep":"3072:caEaIjBfXHk79vCMuMZhQqmiutWxJfU52qiAx+SMfd:caEaIf3kxa5aaVMaHAScd","tlshash":"9dc3120ef3299411c6f0af104c63d6d627617389ffd548c767993e768aac9e70c28ea0","first_seen":"2023-04-10T14:50:44Z","last_seen":"2026-08-30T05:02:28.847085Z","times_seen":11484,"resource_available":false,"data":null}},"time_used":949,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":809,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/owl.theme.default.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.094Z","timestamp":1788056698094,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/owl.theme.default.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 376\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1019,"size_decoded":704,"mime_type":"text/css","magic":"ASCII text, with very long lines (847), with CRLF line terminators","md5":"f13c9109b79ef93c06e22c3542625b72","sha1":"424a8746184ae7d2be69197cfd9b3c4032238837","sha256":"33dbcf6a027199fab7bca71ce31c80154051a658f69ef98e7ddad581fefae1aa","sha512":"7cd94029c79a246846c89dfa82244334fbe284d86863989d69dd96d54f9d9c33231d8048f647a7a9c94810ea8b618314dd579a528ae2f9461f290490434a10c4","ssdeep":"","tlshash":"5b11abc5b189221d3023c18046a842cb6b1e687e529d1af5f8ee9120c32dd053a6f7f9","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T04:54:51.751258Z","times_seen":1054,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/bootstrap.bundle.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.113Z","timestamp":1788056698113,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 22162\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":78085,"size_decoded":22506,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65294), with CRLF line terminators","md5":"52a78545b39d3c5ceeabbac8cbe46cc0","sha1":"99e4421a2f4de040de5905bc15cd45d291ded586","sha256":"120666e01d671db172cecd87aaaed5cb0feb2da24d971c291fe1b8e0f64b18ac","sha512":"22cde83ff9ed88611b9307db3ec6604683d958c3d8caf879220f60146ff760d60dd5769cc5accb9655e269c21c2829fab47ad0d57963714ad435a3c4db28fc59","ssdeep":"1536:P+pbTNR2t4NEdiK5J2w8gGzjJVPOW7tI+r9ixR2nwZ7:u36WJr9ixF","tlshash":"3273c5493254b8730ade45a68037470bf3265994b14b802cb5bcadde2a3dd8672b7f7c","first_seen":"2023-03-08T09:18:43Z","last_seen":"2026-08-30T04:54:51.764102Z","times_seen":3301,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-15.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.166Z","timestamp":1788056698166,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-15.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1250\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1250,"size_decoded":1535,"mime_type":"image/png","magic":"PNG image data, 116 x 26, 8-bit gray+alpha, non-interlaced","md5":"cf90029b422da45a8ebc2783c6dc984d","sha1":"9d43ac70f2d5e06fa1f22db4401ec36511eea07f","sha256":"d3de99b2ecbc5fad5348a4a5cb3543ef0eb94e9538f87cb12d43c2171fc8d0c2","sha512":"e360bece78fa065c2aea710d940bcdb295aafa36d321084965dcc7f727256edb2a6339e28feb1eb8cdc83a308e09faa26483bb5667ba6ad047922395997c57a3","ssdeep":"","tlshash":"be210adcc5522f628e17663884d7ee91b514d4f70d7e7594d4047b0e5ee78980930356","first_seen":"2024-08-29T17:20:29.872998Z","last_seen":"2026-08-30T03:14:58.21971Z","times_seen":199,"resource_available":false,"data":null}},"time_used":905,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":905,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-17.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.168Z","timestamp":1788056698168,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-17.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1586\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1586,"size_decoded":1871,"mime_type":"image/png","magic":"PNG image data, 106 x 27, 8-bit gray+alpha, non-interlaced","md5":"40150968b5a49ee6f5507443e2cdd3fc","sha1":"466ecbcbdbb574ad96a7fc3b12b2e91ec72e178e","sha256":"24c751c57d48f1387794f08643fcc00ca8f893429fc5b12f288bd4fe78b7eff8","sha512":"5d717f09876c22770fa2395238c129585c5702c968d963a38fab001eab81920b702edcfb562b9725f8f2cfe32ece187ce748065004ede4123758ced74145af2b","ssdeep":"","tlshash":"36312aa540291a8d0aafaf00d080c3d18bed7b3f224cb324c231b86ba587e2249a1718","first_seen":"2024-08-29T17:20:29.875445Z","last_seen":"2026-08-30T03:14:58.222024Z","times_seen":199,"resource_available":false,"data":null}},"time_used":904,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":904,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/magnific-popup.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.085Z","timestamp":1788056698085,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/magnific-popup.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1410\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5259,"size_decoded":1739,"mime_type":"text/css","magic":"ASCII text, with very long lines (5259), with no line terminators","md5":"64912a79884a20761ab19de42f85218c","sha1":"8d29cea8f84afdcaa69c0594e37263f7374dc8a6","sha256":"3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb","sha512":"f84a0fc3e162c21e9e49e44aef3c08286d8c03c8b7ad5fc319aded76db501a05b26ad1bf4a49dc4f9dca1d0692e4987d30d393ddd9852f41634d8d3c02777f0b","ssdeep":"96:VuKSCO7EWP9UrJjIjZQX8ZO9d5Zkxudls5/Dm5Mk9nCWh3:VSCO7EWP9UrpIjZQMZO9d5pd+qMk9CWB","tlshash":"43b175f3a941313ac633da16d5c39f9c3227a227f663569fcf82a419c6ce89c0525384","first_seen":"2023-04-05T08:30:27Z","last_seen":"2026-08-30T03:14:58.191611Z","times_seen":5472,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/map.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.151Z","timestamp":1788056698151,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/map.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 26716\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":26716,"size_decoded":27002,"mime_type":"image/png","magic":"PNG image data, 910 x 443, 4-bit colormap, non-interlaced","md5":"84d3bcdd189d01880e685656aede0412","sha1":"22a1f1efc40b1ee1ff616e9da1d9a0e3efec8263","sha256":"ada5be5a95130a3615d8bbbc3ffb593c68cc36d50ae335d567b71ae95a6dbfea","sha512":"366c88a7add9a6c914aae9940b1ba1747949694da7193058c7efc741225bf498a67db626c7cd9793958031d737cc485fbe69ee6785961fbcccdef90b745d8070","ssdeep":"768:h9C/LmjrGCEQspqrxVnW2/MQd9dC37wTt:h9yYGP/pqzMsm3kTt","tlshash":"2ac2e1ad0c435ef6abf126ab03f3f3b5260a320a1264de955632d4747c8017df6a7854","first_seen":"2023-05-10T09:37:00Z","last_seen":"2026-08-30T03:14:58.187312Z","times_seen":340,"resource_available":false,"data":null}},"time_used":989,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":916,"receive":73,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-4.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.155Z","timestamp":1788056698155,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-4.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1468\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1468,"size_decoded":1753,"mime_type":"image/png","magic":"PNG image data, 137 x 25, 8-bit gray+alpha, non-interlaced","md5":"89ee29b52733482f2b46ebc912ce5500","sha1":"4751c71c14d6f8d3d2bfa74cdb10296d1ae918a9","sha256":"0c6a43caf79eb9ac129df256c227492065d1744df5e9ad6b61f3c701059b2d7d","sha512":"3dd37a5d3066a949129c68e8b0a70edc6d9443b5eca96a7413c0cc49de23078533b29b892e38e89b8f681453412ed4baba9132a4d8d3f225dbc0b8b50e6c6cbf","ssdeep":"","tlshash":"fe31c494e2f886b4cae97528df3104da1b4134cb22b893328650a6c10ee2e1289e6013","first_seen":"2024-08-29T17:20:29.84554Z","last_seen":"2026-08-30T03:14:58.148876Z","times_seen":199,"resource_available":false,"data":null}},"time_used":912,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":912,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/main-pic.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.147Z","timestamp":1788056698147,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/main-pic.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 43385\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":43385,"size_decoded":43671,"mime_type":"image/png","magic":"PNG image data, 759 x 448, 8-bit colormap, non-interlaced","md5":"b506da360c46df01896073b735a5cfd4","sha1":"7ecf08e945d651a426001226de42030a59ddf94b","sha256":"4d70e9862aff6ac84d0732146c9afc39bc4f9f6f4226fe11541e326f1ca51852","sha512":"d66654b11ff53a0d35b0313877443b8acd02cb1649ec4edc694913c334aa4901d257899d616bd6b834bff3c0c97a10c074f66701f0dc362499b8cfaea9a08b24","ssdeep":"768:llcZk/3MZthb8PY9aOKX4pIdQfKE6riKWtG8eYPXFTQLkH21vKSCmKnlTXq:vcZLthb8KaLo47HrjWw8XeIKKSCblbq","tlshash":"5613f1fe387438f8de51f0f1db320835b48a1df07aa1a77849ad7985b22d5618ee2057","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.224407Z","times_seen":556,"resource_available":false,"data":null}},"time_used":994,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":920,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/animate.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.077Z","timestamp":1788056698077,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/animate.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4829\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":71756,"size_decoded":5158,"mime_type":"text/css","magic":"ASCII text, with very long lines (65342), with CRLF line terminators","md5":"b3d5b75898f1ed885c7d2b538faa8b81","sha1":"bc96496831f4df311443b8e3d76cfc17db53a988","sha256":"a61e123314188bd0453320008e01b4bbb665bee09039f4cbd9bef44de410ce67","sha512":"be097927cb6f3c12ee4140a60f11dd56bcb1e8661b35848f25f1ae2417b65190924d73d2d01c04c6763fc2c50d3931cddbc2aa74cd945f84145d3f3fe451f433","ssdeep":"1536:X6uNQ3fdPwwanleMf72yMPkZ8PFwh1nAukdDO3Xyr5Ir5eh0dTo:ykZgwh1nAukdDO3Xyr5Ir5eh0dTo","tlshash":"006329ae4891128990230f6787cd5ea84b3dc6a355721cee33552c0b8b46fee73de617","first_seen":"2023-04-05T03:30:47Z","last_seen":"2026-08-30T03:14:58.188718Z","times_seen":2911,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/contact-form-script.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.130Z","timestamp":1788056698130,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/contact-form-script.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 674\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2144,"size_decoded":1016,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"3dc6989850222aee1a68cc132426f035","sha1":"f6a762662c4df511e97df3f0dd730b64aa31cd9d","sha256":"bbe7b53d11fee22a044cff9a34d37fe623ad369becd7a442e3b4f268e5d603d3","sha512":"2d2152378e98221bdf87e05c0d5fb7a97a69a335f565e5ea260dbf893d3bdb4237740a3577b6b3061759c9870b96dd0c875303c8bdb39547b6ac4f7dadc33fd7","ssdeep":"","tlshash":"5741bd08651927c40a333b7de69a9104df611363c505eb553caca9d46fb8f9831a1fbd","first_seen":"2023-03-10T17:30:02Z","last_seen":"2026-08-30T03:14:58.195737Z","times_seen":348,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/translate.google.com/translate_a/elementa0d8a0d8?cb=googleTranslateElementInit","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.268Z","timestamp":1788056699268,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /translate.google.com/translate_a/elementa0d8a0d8?cb=googleTranslateElementInit HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nx-powered-by: PHP/8.2.33\r\ncache-control: no-cache, private\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 413\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":956,"size_decoded":670,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"0d4cace6d9e578288be59d8d97401ae4","sha1":"1067a5c6b08c362aef0ba8b963dfbd4fa2d5e1dd","sha256":"8aa4b33adcfef57fa8cd63c8ca3d3fae214dce1c87e239e14ee79e449c8e313a","sha512":"2842dfb293e577cc530ff0f45ccdb62538be6323b22cc7f8eb8e0fe47d1097a05bf3f2b68c2ffa7a9a5b8100174bf361703bfa6c85ace0a2a6d71ecfaf042b4d","ssdeep":"","tlshash":"2a111c6b44425abe1250c5e2b034332ed0dbaf3b6a826840e46711a66ac8bc5c87a098","first_seen":"2026-08-30T02:25:40.500126Z","last_seen":"2026-08-30T02:25:40.500126Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translations.smartsuppcdn.com/api/v1/widget/translations/lang/en/defaults","fqdn":"translations.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.27","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:06.629Z","timestamp":1788056706629,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1087630013.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 18:41:05 GMT","end":"Tue, 10 Nov 2026 18:41:04 GMT"},"fingerprint":{"sha1":"4C:F2:C9:AE:0A:0F:37:5A:43:AE:8B:25:45:7E:69:B8:F0:0B:25:F8","sha256":"74:06:C6:4E:FC:30:3B:58:27:F6:ED:89:28:89:31:20:1A:62:99:AF:A6:73:D6:1A:88:29:39:44:E3:B2:B1:6C"}}},"request":{"raw":"GET /api/v1/widget/translations/lang/en/defaults HTTP/1.1\r\nHost: translations.smartsuppcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:13 GMT\r\ncontent-type: application/json; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: max-age=600\r\nx-response-time: 0ms\r\nx-version: 143765d349003193ebd3783518e376c4c54f428f\r\nx-77-nzt: kxZhwHUDacNYhLsoNVqM1PIZLD4CnfzlRg6OR0jg33ShLa8YwTQqeL8372O4VCU2+WUZ0hs\r\nx-77-nzt-ray: fdb54123784994efae94936a76dd8e18\r\nage: 1\r\nx-77-cache: HIT\r\nx-77-age: 102\r\nvary: Origin, Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":7219,"size_decoded":3357,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0259a73d21d0110609c1b3d5cab20ebe","sha1":"f80fcc484290999d3c48fe3d75f434cb63a00b4a","sha256":"ff798ee596d00dfbc59c3916cde6ce6cc8fd9183e1cd673c45dc6be9b333e582","sha512":"fbb7720f87a9673084b909fc940d2861fb5b1a7ce80d7a60d469eabe47765e69bce287d2bece28eb226d2e75e1c8202283aeda38f34ff354c2466f567ee3535b","ssdeep":"192:Ccdft/hcRl6WKHSY8pZcqq+jT0UHAfoW/Ymz8:CgF/hcSWbYKZcF+jhqoWQmw","tlshash":"ede1b64f9a144ea987c643c276cfb84675bc807342509d7afd8cc9b842697cda3e3b94","first_seen":"2026-07-27T13:24:21.79927Z","last_seen":"2026-08-30T04:53:38.320489Z","times_seen":1241,"resource_available":false,"data":null}},"time_used":6790,"timings":{"blocked":0,"dns":30,"connect":8,"send":0,"wait":8,"receive":0,"ssl":6743},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/odometer.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.121Z","timestamp":1788056698121,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/odometer.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3453\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10264,"size_decoded":3796,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10241), with CRLF line terminators","md5":"cbbe383a299d4cd3c5afd850e23b93e2","sha1":"a57fab98eed3ee4da231031c823c0dfe71435e5d","sha256":"b98842a571aa1f32f8797a9d08186bb021f258925a8db4fe57d60129b858b1ec","sha512":"85b7267f38755128dff6d6435f050b949d6b99c72290c00d6813b16207c8e3e70ae01300f4269fe28df87960be5ef2211c3ce4929ea36ae866bb0e6ff7f849e4","ssdeep":"192:kABzlvQK8QecCHAOcu2a+OdI5s/GMb8XuulT:vBhv18QecCxVxz+7dlT","tlshash":"3b228580ba11a725835372e151bf0609b7bb99aea404401db67c9dd9be29c38e12bf74","first_seen":"2023-03-07T12:27:14Z","last_seen":"2026-08-30T04:54:51.781805Z","times_seen":3535,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/storage/app/public/photos/8c8YNH31xcpfT7U6gzyeP0vvpjqB7OmzAF3oNm9T.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:01.398Z","timestamp":1788056701398,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /storage/app/public/photos/8c8YNH31xcpfT7U6gzyeP0vvpjqB7OmzAF3oNm9T.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:25:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:27:02 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8140\r\ndate: Sun, 30 Aug 2026 02:25:01 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8140,"size_decoded":8425,"mime_type":"image/png","magic":"PNG image data, 738 x 246, 8-bit colormap, non-interlaced","md5":"db9cf7a3e5f016e356fb4e2e5ea7a164","sha1":"abf24c5fe5fff93fc3bf53f4d6eb89a843b50c11","sha256":"506905ceb5e49620e8b7553592ca5a40b3288f7c012513aa4ef6cfc1c23d9291","sha512":"c6998fd2d36c84c7a28ed82805cbf620d7764f7addff2cb5531363d1e18aa22d13309fee8e8a98c7256b66d0ed08c9b48ea2318b7c75d10a50a3b6f496d66eb9","ssdeep":"192:bUkm0D/AULrxfOWj9LzD3RsjmYpyz8fxyeTpgZu4lAZL:bJrvZVLzrRsSYNsQaZu4yL","tlshash":"09f1aef4d211c641e8c22c32318d9c5afc870802c9ebdbdd9e7a4c36718d24a6545ed9","first_seen":"2026-08-30T02:25:40.525206Z","last_seen":"2026-08-30T02:25:40.525206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-14.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.165Z","timestamp":1788056698165,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-14.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1047\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1047,"size_decoded":1332,"mime_type":"image/png","magic":"PNG image data, 100 x 27, 8-bit gray+alpha, non-interlaced","md5":"852f192e4a07fae0a46b10b8d333d8f5","sha1":"2609146e56eb03744497975d0f32f4cf99953e14","sha256":"df15031b2c6d0a3035eb029ae139f226cc1026f9f677bb1fb4e74e631c299647","sha512":"33eed53fd48086d3be3bf1ded795ed93b61c5d7ebe0dc7641e87e2e5830d9ccec3f890c52a80e93fc31318a3d5d8e21c4f9c7dc45fe5162a6ebbbbbabb7f66c2","ssdeep":"","tlshash":"ba11b9f10f10f968f6b93026d59f0865be426a864e52e34c8b4ec7c166d17445cd7d14","first_seen":"2024-08-29T17:20:29.87077Z","last_seen":"2026-08-30T03:14:58.228272Z","times_seen":199,"resource_available":false,"data":null}},"time_used":906,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":906,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-30T02:24:55.815Z","timestamp":1788056695815,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.2.33\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: no-cache, private\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; expires=Sat, 21-Nov-2026 10:24:57 GMT; Max-Age=7200000; path=/; samesite=lax; secure\nremedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D; expires=Sat, 21-Nov-2026 10:24:57 GMT; Max-Age=7200000; path=/; httponly; samesite=lax; secure\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 30 Aug 2026 02:24:57 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"XSRF-TOKEN","value":"eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D","quoted":false,"path":"/","expires":"2026-11-21T10:24:57Z","raw_expires":"Sat, 21-Nov-2026 10:24:57 GMT","max_age":7200000,"secure":true,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; expires=Sat, 21-Nov-2026 10:24:57 GMT; Max-Age=7200000; path=/; samesite=lax; secure"},{"name":"remedyfinance_session","value":"eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D","quoted":false,"path":"/","expires":"2026-11-21T10:24:57Z","raw_expires":"Sat, 21-Nov-2026 10:24:57 GMT","max_age":7200000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D; expires=Sat, 21-Nov-2026 10:24:57 GMT; Max-Age=7200000; path=/; httponly; samesite=lax; secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"WOW","description":"Reveal CSS animation as you scroll down a page.","website":"https://www.delac.io/WOW","common_platform_enumeration":"","icon":"","categories":["JavaScript frameworks","Web frameworks","JavaScript graphics"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Slick","description":"","website":"https://kenwheeler.github.io/slick","common_platform_enumeration":"","icon":"Slick.svg","categories":["JavaScript libraries"]},{"name":"parallax.js","description":"Simple parallax scrolling effect.","website":"https://github.com/pixelcog/parallax.js","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]}],"data":{"size":122179,"size_decoded":17107,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (379), with CRLF line terminators","md5":"4d93676b83f0f09b912fc262951e4ce2","sha1":"f7e1f0bf44631ddc135e71a18413910c7f394c0f","sha256":"6de917df6b8c67d1436d65ec4926ec0ef2f4a4521eb971228cbddc3d50c660e7","sha512":"dc8ec1a61a813af55cc4de3511ca96ebf6b848dcd78f3880201da0d3ac1cc775a1ac78f455458ab9d6dfb2d84496bab010fdc7a598a62bd6199c93a28af5c5f3","ssdeep":"1536:+RFzpPMFEPX63cftjJ4n6lbK8hFm7Ep/aGuQqe7ZAI/8l+ZBk:+P/14l","tlshash":"d7c3545541c4110550b3d2a0fe629b49fb748107c38b456c7bae3ae36f7ed688a37bb8","first_seen":"2026-08-30T02:25:40.530165Z","last_seen":"2026-08-30T02:25:40.530165Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2046,"timings":{"blocked":0,"dns":149,"connect":70,"send":0,"wait":1680,"receive":0,"ssl":147},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/nice-select.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.116Z","timestamp":1788056698116,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/nice-select.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 931\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2937,"size_decoded":1273,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2822), with CRLF line terminators","md5":"ab62d8a15524602c06b356ae74eea55c","sha1":"ae602ab104a3f8008fbcfd7967cb302dd0681e20","sha256":"cd204d095086d67e207e13bae8ceb3de8759eb9eedcd4080809c929dc7af1065","sha512":"d4798aa79f38cf35ae416780c5d8daf9333ec29440c55d6d9c164aef67cbea21984ee309b756c09628bcf69c52ed29fe5b56ac44b31cccbb78b223ae06c43f95","ssdeep":"","tlshash":"60511114b10512f648ff24d37911b147a075493dc42ac14aa97e86b21dfec02aab6d5f","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.184701Z","times_seen":607,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/jquery.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.112Z","timestamp":1788056698112,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/jquery.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 30260\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89501,"size_decoded":30604,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65446), with CRLF line terminators","md5":"3e4bb227fb55271bfe9c9d4a09147bd8","sha1":"156837f75f6600ccb602b4efcbd393636c33f35e","sha256":"ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127","sha512":"f7810ef9df875a7fdfa7228f7e2f95dd34e18b57f56a46383198ebcc591e32f633b0d73cc6b271fbc669347f7fdc114cce6a6b43681104b25084fe2a1e7bee49","ssdeep":"1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vN:eIh8GgP3hujzwbhd3XvSiDQ47GK/","tlshash":"589309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:21Z","last_seen":"2026-08-30T04:54:51.791373Z","times_seen":11189,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/form-validator.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.128Z","timestamp":1788056698128,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/form-validator.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1913\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6063,"size_decoded":2256,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5862), with CRLF line terminators","md5":"a5cae60d0a59205f9c82928fb16ca1a6","sha1":"c03a6517da694e1ba5aa6b9dc6a647bd119b819a","sha256":"60c23945490cba413f3d6cf2cc57d5c560faeb0cf68ab38daedc80939966b108","sha512":"c43f6e446c89df6fc82c5cecd3b5727bcc226c2826f9ec8e0ac88925ade0bffc212d92759b6c8117d31fa6b032feffe91cb2519318320a16bca2e07d9cd29043","ssdeep":"96:H1MWGbU563CvldugvwYdfWA3oTa9+xcuS+5ijkunc9s5BeK7p8vmiIKpiyW:H1MW+U563CvzugvXdfZUopjkunosfR+W","tlshash":"c4c13449366321921f9234f5419b828b72b97b38c50a409435fa84f1aaf8fc167f7b39","first_seen":"2023-03-08T00:47:54Z","last_seen":"2026-08-30T03:14:58.211465Z","times_seen":1082,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-11.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.162Z","timestamp":1788056698162,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-11.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1251\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1536,"mime_type":"image/png","magic":"PNG image data, 101 x 30, 8-bit gray+alpha, non-interlaced","md5":"f4d3897cbabd300e0274b6ecf9845169","sha1":"36d77dbf7b56f2e9621f54f8e00cf5302875baeb","sha256":"406f5ae5c0766833fdf1d45c4db1dafdda7458150e7d553050fce004dda744a5","sha512":"34ecb02c05ea404994449877954108364216975f4ad460263cafdeedc1fc6841bc7d7605f1e135575c030f59b7a93aeb84e3b805c104b80e33908cdbf4f785a1","ssdeep":"","tlshash":"6e21e74167d0dbecd200715f8bbd0a7a39b053624be809ab85f780a12addfc06723c93","first_seen":"2024-08-29T17:20:29.863999Z","last_seen":"2026-08-30T03:14:58.227435Z","times_seen":199,"resource_available":false,"data":null}},"time_used":909,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":909,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/3.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.145Z","timestamp":1788056698145,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/3.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7911\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7911,"size_decoded":8196,"mime_type":"image/png","magic":"PNG image data, 263 x 241, 8-bit colormap, non-interlaced","md5":"b6c271674d0f2805e789c2e76520173c","sha1":"d886710c03e7abb3bab526215605bba07c22cb92","sha256":"b95df0cd387779894568be922e2ca845497f455e397bcc8c0c6bfc0d235d137b","sha512":"e5c840c290c1a71c61b41e554d7566a1586c35b2115f238ee779c04ea6e97175a40ee972389d436d3edaf325275cfaf227b11e0d3e45b396bfeeaf3b0305b820","ssdeep":"192:hiyzhvrKRoHLXlQJlsMb+7G/QzPdf7e1D+1MGn44ve0:hrtpL1gb+76QzJ7ep+1Pn/e0","tlshash":"d8f1af8bb45c8e6f95a8520d13f52a1676044112f3c5076c3a4afcbb2e183eaaf88003","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.178642Z","times_seen":557,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":137,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.294Z","timestamp":1788056699294,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 26 Aug 2026 10:31:06 GMT\r\nexpires: Thu, 26 Aug 2027 10:31:06 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nage: 316433\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48264,"size_decoded":49077,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-08-30T05:25:52.198081Z","times_seen":64933,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/owl.carousel.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.093Z","timestamp":1788056698093,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/owl.carousel.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 912\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3358,"size_decoded":1240,"mime_type":"text/css","magic":"ASCII text, with very long lines (3186), with CRLF line terminators","md5":"f999392859d1b921f83a84adb77be572","sha1":"1cd09814267e2033eab27dac1a594e80e647c212","sha256":"4c04da57afb7c99fe3485be1e8a53273116dfd3043a504f94222a89aea345136","sha512":"ad5bf8feb977b794d2dc5d18f69e9d55ac84549b2ad3f0e71be46dd2e1f9b1b72c4b037acb7c311d41bb2a8d18ecc470c5f55e505cb6fc93d9336aea77b84dde","ssdeep":"","tlshash":"e761cbe5314a225f480f831219d81e86393dcc52d8660a8a92bbd31447dae6d213ffcf","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.202714Z","times_seen":757,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.gtranslate.net/widgets/latest/float.js","fqdn":"cdn.gtranslate.net","domain":"gtranslate.net","tld":"net"},"ip":{"addr":"172.67.68.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.132Z","timestamp":1788056698132,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gtranslate.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 23 Aug 2026 03:29:44 GMT","end":"Sat, 21 Nov 2026 04:29:42 GMT"},"fingerprint":{"sha1":"AD:56:9A:7A:0D:59:51:B4:A7:48:82:60:B8:DB:1F:A1:A1:FD:51:F3","sha256":"BD:3C:C8:79:0A:A4:32:CB:65:88:4E:EB:BC:86:AF:40:EE:41:55:58:77:2D:F1:14:A0:79:98:26:E5:1B:17:AF"}}},"request":{"raw":"GET /widgets/latest/float.js HTTP/1.1\r\nHost: cdn.gtranslate.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:01 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Thu, 20 Aug 2026 22:34:18 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nexpires: Thu, 26 Aug 2027 15:24:19 GMT\r\ncache-control: max-age=31536000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pVUSE%2FA8eoTHcl4idl8IKV7E1v2SoVpCFDPszXZtJ1u2gnbsh5OkrJbjbQHna1zdvGKNuGWvGxiZmjOdvLEI7uEIDC6rHmgzf3CV0M1ywJTJKRHdrDT9ivon44VH6r%2FCExvO4w%3D%3D\"}]}\r\nage: 298841\r\ncf-cache-status: HIT\r\netag: W/\"6a8780ea-5a62\"\r\ncontent-encoding: br\r\ncf-ray: a33057aebef7b1b8-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23138,"size_decoded":7502,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3129)","md5":"68ee10aa7ede43f8bb3293b220daf775","sha1":"1f26a636577ea9aaa524c0a23ae8cf342be925e9","sha256":"76e28fc0425d80422e45305464ada45c7c9b4a00132c65012c737c22814c259f","sha512":"531d2baf5f4d61c0def2c5f45fd8d9b69b143c24d0474a01291d858b086b45c233d1cca885cc722d6e6eaff3f8cb62e637df797beca8f5aec20d090f0e23fe08","ssdeep":"384:UzCKMPZATN09o0mtvwfEXMb5TZ/dDszCnfYI:UVMhAh060svwcX0T1dhh","tlshash":"10a2c62921b3003a49531265efff165c607a02b78004ec24bfaeddc2dfd59a9caa77d5","first_seen":"2026-05-06T20:53:53.345523Z","last_seen":"2026-08-30T04:55:57.483116Z","times_seen":2650,"resource_available":true,"data":null}},"time_used":3115,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":7,"receive":0,"ssl":3105},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/2.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.142Z","timestamp":1788056698142,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/2.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8398\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8398,"size_decoded":8683,"mime_type":"image/png","magic":"PNG image data, 259 x 239, 8-bit colormap, non-interlaced","md5":"a4895cbd0983fabb03a129eab4b30405","sha1":"1e8179843b8666448f2c7fd1c640693eb1f0c0fa","sha256":"6951f5ddaff6906a34ea3d6ef126e2a4af0d668b2c4904f26146248349da0cb2","sha512":"4cd7650f694e5b977f44c35f919a3b8bac1b4bf7ad41b3199881913a2ed23712fdfdbb34c3f4d8c2dd4dc60cd2b4c8c0537d9f41b0a11cbe6030d2078b2f722c","ssdeep":"192:tpwi7UClIdQwUTCxtwyOAlydbVevkJtSM3t8Sci:zX1CQwYdwk3SMPci","tlshash":"9102c086de3d51536dccbe65493083413c3a170ed659ba58bb23b13c6df812e82867c0","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.206197Z","times_seen":569,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":137,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.gtranslate.net/flags/32/en-us.png","fqdn":"cdn.gtranslate.net","domain":"gtranslate.net","tld":"net"},"ip":{"addr":"172.67.68.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:01.280Z","timestamp":1788056701280,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gtranslate.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 23 Aug 2026 03:29:44 GMT","end":"Sat, 21 Nov 2026 04:29:42 GMT"},"fingerprint":{"sha1":"AD:56:9A:7A:0D:59:51:B4:A7:48:82:60:B8:DB:1F:A1:A1:FD:51:F3","sha256":"BD:3C:C8:79:0A:A4:32:CB:65:88:4E:EB:BC:86:AF:40:EE:41:55:58:77:2D:F1:14:A0:79:98:26:E5:1B:17:AF"}}},"request":{"raw":"GET /flags/32/en-us.png HTTP/1.1\r\nHost: cdn.gtranslate.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 695\r\nserver: cloudflare\r\nlast-modified: Mon, 07 Nov 2022 15:42:08 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bW%2FUUaOlfZffS114fw0hIWqbMC9zz0XolA9GbPXF%2BeAtBcTh%2FKmHBeji8YQsJIU%2FtaaDEIifQqihjnHyAMufR6vcDAvLpt6gNR5n%2B98VrjsP%2B9zkfUGyVdwFZq32%2B3VtBfmAlg%3D%3D\"}]}\r\netag: \"63692750-33e\"\r\nexpires: Thu, 26 Aug 2027 05:27:17 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4;i=?0,cf-chb=(89;u=4;i=?0)\r\ncf-polished: ok, orig_size=830\r\ncf-bgj: imgq:100,h2pri\r\nage: 334664\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncf-ray: a33057aeff2db1b8-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":695,"size_decoded":1518,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"0c7d024de9ea604d5112aafc2738f21f","sha1":"19eae4ef8a7275c8cd5a6528e9c302c36feb8ac4","sha256":"529bcccc5a1659f26fe9f396a809996d064504598f145bee5abc62b94f7d1ec6","sha512":"1f2d1c7015d2b000f5b271ead4e16c3f36f049a34991d7032ee3b353ad7b1297bedcb4c75af662aa15d4b86a2f8187557d701abbdc7b32133ae1f23b9042af7f","ssdeep":"","tlshash":"670144c70d10215ccc2bcc5251eb044584a36a6a453b41ff0f2e980c56f595f5cd0305","first_seen":"2024-05-01T05:40:26Z","last_seen":"2026-08-30T04:55:57.502267Z","times_seen":2131,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/circle2.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.150Z","timestamp":1788056698150,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/circle2.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2040\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2040,"size_decoded":2325,"mime_type":"image/png","magic":"PNG image data, 199 x 194, 8-bit colormap, non-interlaced","md5":"e8dbe3b7692b2ce535ef2b6ef2790a2c","sha1":"95a7b7aeb26abeb0a0e7ee14289af8a25bfe3c73","sha256":"652d894377d69fbf54715637a7dea271c3de099be2c422acd614493bd9656bde","sha512":"295ed174620b9454516a7e510ed475f3d4083fb74fc3163196a9ff60528b6ed8a973458b48f10172412a3ae59fdd28be40e5f5380c792232e75c90a05c4c20e7","ssdeep":"","tlshash":"6141fbd979889b7c976c967733a9e916eb7e143d7a1643efc3ac6453447d0103c01051","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.183353Z","times_seen":559,"resource_available":false,"data":null}},"time_used":918,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":918,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/manifest.json","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:03.107Z","timestamp":1788056703107,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1857279285.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 18:42:46 GMT","end":"Wed, 11 Nov 2026 18:42:45 GMT"},"fingerprint":{"sha1":"02:15:23:9E:FB:D6:BA:70:A5:A0:F0:53:9D:F4:1F:AE:DD:A9:2E:44","sha256":"53:3C:17:3E:10:6F:4D:A3:B5:0D:11:42:7D:01:FA:29:0E:0C:8D:3A:BE:5C:F3:77:52:D7:EF:25:7E:8C:CA:DC"}}},"request":{"raw":"GET /manifest.json HTTP/1.1\r\nHost: widget-v3.smartsuppcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:06 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\ncache-control: max-age=300, public, s-maxage=60\r\netag: W/\"6a8ffde6-891\"\r\nexpires: Thu, 27 Aug 2026 09:14:57 GMT\r\nlast-modified: Thu, 27 Aug 2026 09:05:42 GMT\r\nx-77-nzt: k+9O6uK+wCr2Dpuwb6qgcazE3gEPG1s70ih2u9GakeaHxsfr/A01dJ6j1Ufo5anpX8slRJI\r\nx-77-nzt-ray: e2f754209160ceaaa794936aa358251b\r\nage: 0\r\nx-77-cache: HIT\r\nx-77-age: 59\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":2193,"size_decoded":1041,"mime_type":"application/json","magic":"JSON text data","md5":"3ded3abaf6c1a95ebff2e809b79b1f3f","sha1":"8bee79313cbd2343a5d8fe682c610dccfb4e7ce9","sha256":"dd0efbaaabb66b220cdb59495717217194b811a8628ac2320a7e01c0867fdda1","sha512":"9811f31ea8d46776ab6e53c1708dc2d82014654587c61be61c1bde347f9c30f83a7bc7cb647c7baae1d440885dc6182806faa17a2eede9c95a8c5ed53a840313","ssdeep":"","tlshash":"69412593c4b80d8317dc6627b89586415d908387a8893d0d36ae9a7f6f4cda910e77bc","first_seen":"2026-08-27T10:24:41.408958Z","last_seen":"2026-08-30T04:45:48.878171Z","times_seen":145,"resource_available":false,"data":null}},"time_used":3357,"timings":{"blocked":-1,"dns":30,"connect":8,"send":0,"wait":8,"receive":0,"ssl":3310},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/odometer.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.097Z","timestamp":1788056698097,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/odometer.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:59 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 436\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3274,"size_decoded":764,"mime_type":"text/css","magic":"ASCII text, with very long lines (3251), with CRLF line terminators","md5":"33857183503886a3ea32dd5f475ed489","sha1":"6a702c75c57ee5cd30c4fa6fd22a6e5ce19ee58a","sha256":"53c8d41573daafb7177733ea705128818a28503ddc9bfc261a9988199b6069c6","sha512":"5800187f2f7656cee966134f8c67c75004a533403f4ceef58b053be20e912765bd1f2b65f68b3c9c0ef303b5511c1ccc2d9ab12d399f1103d6fa0be716c7bea2","ssdeep":"","tlshash":"4e61f5154f90036863367506bac81760befce9515123e98eb35ea54bcf43db9e398b0b","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.17799Z","times_seen":769,"resource_available":false,"data":null}},"time_used":969,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":969,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Crimson+Text:wght@400;600;700\u0026family=DM+Sans:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.103Z","timestamp":1788056698103,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Crimson+Text:wght@400;600;700\u0026family=DM+Sans:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 30 Aug 2026 02:24:58 GMT\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7406,"size_decoded":1343,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"d34c4709c845524ede56493d18bcbd6a","sha1":"9dc8b77976303bb765dd43925d29969e3b78548a","sha256":"462943911a79d4366ed009b4c2a87bdfd0d12a1d2c836cc5227192f8b5d71d86","sha512":"e3e0a30a216744a6a359dcdce1915cc4260c00f68f6ce2821285cd575db394a3a353c48732f66527071ac0bea7e8eb820440faea02f3f9e98e3feb642352f36f","ssdeep":"192:cG8Kt8Khj8K+88x8IF8sD8r8zm8ZwD+rw8+Owl+NwG+3:cfKuK+K+5y9s4grNis+3","tlshash":"41e1dd90047ba510eb971dc526cebe33ee4e61547454d878affe1888fcaec291362b4d","first_seen":"2025-10-26T02:17:19.355688Z","last_seen":"2026-08-30T04:54:51.755562Z","times_seen":163,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":2,"connect":15,"send":0,"wait":34,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/circle.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.140Z","timestamp":1788056698140,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/circle.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 20034\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":20034,"size_decoded":20320,"mime_type":"image/png","magic":"PNG image data, 524 x 518, 8-bit/color RGBA, non-interlaced","md5":"8e2818145ab7c6ee51794f7dd8b04571","sha1":"8ebb84901bfd3f14211b294bb7667d655204ec14","sha256":"0b76fd0f9811d84c01404d74bb7097e9b908a06af22c37cc6e2973af4170760e","sha512":"3835d6a00544133a076cfbfdb93fae45413d32f26153ad260f5ac0b57d98d6e67bfc336a7b189710df639d366211933bad4b9a61d2cc024e1c421c79711fd834","ssdeep":"384:rUuqhYKe9wW7tacqD3dvFfBoXeQMAXdemlISxgNuyca:rUuquLacqRjoXeGekIegrv","tlshash":"3292d0aee5bc5f2bc7a4fb77b461a81848311b0c53167d71d93abae049db39c4185ec0","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.209955Z","times_seen":573,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/1.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.141Z","timestamp":1788056698141,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/1.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 25043\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":25043,"size_decoded":25329,"mime_type":"image/png","magic":"PNG image data, 682 x 448, 8-bit colormap, non-interlaced","md5":"c393722b7042005b24b5124981fa52fb","sha1":"c4faa75b0358dc94de84fe1e152c1100a15794c1","sha256":"a2592be1c2009912e7b17b4d1a5022ded8c2237ec22d9fc381d307098808af9e","sha512":"1c62546d8d8bdfb9035ca3e8758e2c382dfdba79a7aad75775abd5a126d369f5943a07e72adb8738f6676986a388ae4add17e6c44104a795c28ae820cad5a808","ssdeep":"384:xmvay2u7wM9bFIPgNkV4BIzKqKRHArznOOC2sZ8K1uteVC4mN:xm/rUkkaB4zlf+CK1uJ4A","tlshash":"3eb2e16f8a62861cfad54caf103db256e4f4ed292cd4e42fa92d5445e3f62b080627d4","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.175234Z","times_seen":556,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i\u0026amp;display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.113Z","timestamp":1788056699113,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i\u0026amp;display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 30 Aug 2026 02:24:59 GMT\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64800,"size_decoded":3062,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"2b0492055bb5b23c5ed11d557a9c290f","sha1":"26e59353da26632e9cdbddd804cb0f526f53fc00","sha256":"b56d6d4c80db94680717f75c471851d4ec67f81078099e54553046772b0f90a8","sha512":"d86e4e14d6f2cb643dbf842996ab4d78eee181f4fe7d3f0ef292798252541396c6806f76992a772a18258527a5c94e10eb7d802ec3bde489a72bcf50e5ee65c9","ssdeep":"768:yFdF9FAFNFgBFUKF7FnFwJpK5g9UEf7h4YXogEU9SWWjD8TgfUS9hMNtG9g5UoTV:wE9YIWHHIHTxj","tlshash":"83531da1041b5440ab834ce223ce7e35fe0f92547141d075ebfc9b6baedbda6526836c","first_seen":"2026-02-19T22:23:13.630851Z","last_seen":"2026-08-30T04:54:51.790315Z","times_seen":7297,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i\u0026amp;display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.114Z","timestamp":1788056699114,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i\u0026amp;display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 30 Aug 2026 02:24:59 GMT\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31212,"size_decoded":1689,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"f9308d064c8d95dd0d7f2b751df606c5","sha1":"697a5fcaaf26c9e959e578ef1483d9f096cea790","sha256":"eda15317dc0fa78f70e63940730f5e04d9a934951bbc55e3348ccbf6302aacca","sha512":"9c04884c77d7e5ffd39cd1a2508818e944e2d944821904f8a1df452e6ae993ce7505bc9901f6a42f64b788f7374b1a4fbdc98788b2b77449ee12f0bc65ae9124","ssdeep":"384:g3rw38T3z3M3dowhTCBERwmTx2nmwbTor2fwATXw5Mw1TGVQlwaT1ajKwvTs/yjp:UgYTgg2yr/F","tlshash":"28e2aca1091bd040ab476dc667cf3e36ee4e62147046993a9bfd58fcbca6d3613a070d","first_seen":"2025-09-10T18:04:04.291313Z","last_seen":"2026-08-30T03:14:58.225204Z","times_seen":2702,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/meanmenu.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.115Z","timestamp":1788056698115,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/meanmenu.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1476\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6035,"size_decoded":1819,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (397), with CRLF line terminators","md5":"f92bd7e01c33f6a2bd73c5a2833b4874","sha1":"39533bc5c1e8128008023565e03830e00ce17808","sha256":"0927e12f94a642d9bbf07b4204102848162eeecadc02d002ace6fe334315b832","sha512":"e8a7d2768621e01fdf3e45eb187437f7c452f6fafd1d0a48add3844c7d16858ebadaa17f7b7272625f99b8a3f1f4426fab861d62cf1c0656bcca6617a12b344b","ssdeep":"96:cqHVT5bG+ESTXybNrNnaToz99MClbxXvY+CSoGZn7c6BFSEXT:zVT519XyJnl1BCSlZnl9XT","tlshash":"bfc1dd2bb5b044f8a0bb7a61b97af230f4f3660bf146d50131bd64262f31d6015a2fe9","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.169434Z","times_seen":616,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bootstrap.smartsuppchat.com/widget/cf1f27f581fbc312193e9713325c768326be0177.json","fqdn":"bootstrap.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"3.79.72.4","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:02.968Z","timestamp":1788056702968,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.smartsuppchat.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 02 Dec 2025 00:00:00 GMT","end":"Wed, 30 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DC:47:26:FC:2D:4B:14:19:23:BC:B7:70:14:DA:60:A6:21:B0:1E:81","sha256":"0D:5E:FD:70:25:9E:DE:DD:47:CF:0C:58:1C:08:A2:A1:05:AC:A6:7E:0C:43:6F:50:E7:49:E0:A1:60:D0:0E:0F"}}},"request":{"raw":"GET /widget/cf1f27f581fbc312193e9713325c768326be0177.json HTTP/1.1\r\nHost: bootstrap.smartsuppchat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:03 GMT\r\ncontent-type: application/json; charset=utf-8\r\nx-version: 6cb79abf75047496934c7756b55ec6f26e7d2373\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: private, max-age=0, must-revalidate\r\nx-hit: redis\r\netag: \"4c6-7ygUy3llH4or9TAJbP6rEpwnP6I\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1222,"size_decoded":882,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fa03a49b0e19514d47b29ac412a1dad2","sha1":"ef2814cb79651f8a2bf530096cfeab129c273fa2","sha256":"2a03064b05a59f2f3c0e7c017b3660918201bad361e64eaa40fa4f7303c8fb35","sha512":"30701c3261fa7632da73ade8b355b3860cecaa922aeaa541814c702a22d3e42a7a74ec0d732a495e59fe58f9566a808f1a82b14f168f6163ceec86fa8f803224","ssdeep":"","tlshash":"2c21767d4a6822fd5245c7d6c5047a076bacdcb371003e7eea0d0a0e70db2e5223646b","first_seen":"2026-07-15T01:36:39.674085Z","last_seen":"2026-08-30T04:52:46.610493Z","times_seen":70,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":0,"dns":13,"connect":24,"send":0,"wait":47,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/bootstrap.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.076Z","timestamp":1788056698076,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/bootstrap.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 21195\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":163862,"size_decoded":21525,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65302), with CRLF line terminators","md5":"64bb2b5bc1d4ce1f2b73f49200e022d6","sha1":"4a25df2c842d0f4f038f29377b635184569e2313","sha256":"cb8e6f9631be048c0e0cac4d93fca3931f0aa2c4d6e5c83a2c22b667ed0f093b","sha512":"1660678a126d2b52787a138f99b667f0b6a4cde8de2711a7e11cebdab39956320afcf2a9a17d91c0096a37d43c9da864915cd6e422150a64f42367a695af6ed8","ssdeep":"1536:lt04T8if0W8DsEBpy0cuJBt2rIWE5e0VUpz600I4fT:lt04P0VUpz600I4fT","tlshash":"98f3b4dbf581341dd4a7c259a4d1bffd052f4586e3025aabb0277bb88b892c70963e4c","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.167319Z","times_seen":577,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/slick.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.118Z","timestamp":1788056698118,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/slick.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 10883\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":50674,"size_decoded":11227,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2614), with CRLF line terminators","md5":"cca96dece8c053d46dfa20101388d2d3","sha1":"2c14e299764bcea9dc875e1f2e1a86afc7bc3fcf","sha256":"db5a2153f69965283f3d434959ffbee8dc61514e524fb871c6faac56a1b6f742","sha512":"a2ef71e1187f1aced8be072976d59cd360a4015fabdb3a2bc55d56df4fa06eff59e24aff355dcbf1cea7efe8c49cd3cf760152c40283803f6f08e97c88307815","ssdeep":"768:MjL0ySLGPzYbHpJIkdSAeFr8qGAOxCt/QXlGLAcB68Kmb:UrPzYbVxCt/fB6ri","tlshash":"4033b409a210172658e725f5305bc54c73ffe6ba9a01c1d878e683ca24dd1059fdfbea","first_seen":"2023-03-10T10:53:12Z","last_seen":"2026-08-30T03:14:58.170066Z","times_seen":716,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-2.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.153Z","timestamp":1788056698153,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-2.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1236\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1236,"size_decoded":1521,"mime_type":"image/png","magic":"PNG image data, 100 x 29, 8-bit gray+alpha, non-interlaced","md5":"69b9119147b6f9dec48186e35d9ce627","sha1":"9374da481d2d8edcc050dc4161d91a33ff8788fb","sha256":"efb6c876499145626d0b61553231ac8a7a739d6f6f3858525d86b3fddd981a69","sha512":"19df4d5ffa9666e8f73a484686ad70128a2db63aa3cfbbfa7219b7d4db06a3bed5b8530f26c67c7314686afcea49bdb093ac869e8773b306719009d98efd0ba2","ssdeep":"","tlshash":"06211a8b71f548e9ac837685b135741abe81a0c1b812d79e036ec5f10fcd24c0f9e143","first_seen":"2024-08-29T17:20:29.841148Z","last_seen":"2026-08-30T03:14:58.202074Z","times_seen":199,"resource_available":false,"data":null}},"time_used":915,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":915,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/main-mobile.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.171Z","timestamp":1788056698171,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/main-mobile.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 55689\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":55689,"size_decoded":55975,"mime_type":"image/png","magic":"PNG image data, 549 x 541, 8-bit colormap, non-interlaced","md5":"c59a7bff6b59e7c447efa275cee75f4c","sha1":"677b86ed85ef05bfe71d23ad2ad9f8b7cdb2e761","sha256":"b3fa0e45d454ad8b4f6efec14c2861d78948bc0319754e53148362f7ee5b66a2","sha512":"30c157ac5eeba634395ac39d29934196ffdf795614aefaa1b82d80008303a558da569ad6e010ac736c7187ea054cb5dee379ec515a76665cf578143396f27bd8","ssdeep":"1536:RtdyITWfgPk+OXmOz0Ya6PqM3i43qEfoQCadXz08nAC0F:RbWYPJqmo0j6Pxh6Efeahr8","tlshash":"ab4302a8c9f53da4e3188505001fde329759229bf1df7b10e1d9631a982e2aabc4f5c3","first_seen":"2024-08-29T11:46:34Z","last_seen":"2026-08-30T03:14:58.154766Z","times_seen":350,"resource_available":false,"data":null}},"time_used":960,"timings":{"blocked":33,"dns":0,"connect":0,"send":0,"wait":856,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.261Z","timestamp":1788056699261,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 27 Aug 2026 05:14:37 GMT\r\nexpires: Fri, 27 Aug 2027 05:14:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 249022\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":37745,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-30T05:31:35.887205Z","times_seen":34912,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":20,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJXsCxGDNNQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.541Z","timestamp":1788056699541,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJXsCxGDNNQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26012\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 29 Aug 2026 01:02:11 GMT\r\nexpires: Sun, 29 Aug 2027 01:02:11 GMT\r\ncache-control: public, max-age=31536000\r\nage: 91368\r\nlast-modified: Tue, 24 May 2022 18:30:40 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26012,"size_decoded":26824,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26012, version 1.0","md5":"d7a5ae87e50b75fb48940e32792aa13b","sha1":"a09c276f3bc0261ef1c701820e663e3bdc0cc481","sha256":"e2ca4f57a77f4db70d61c4d16e748545ce2000e0252be1f67fa1c964040f9b9b","sha512":"a3a98d99186bd1df8aae3cc8de26835d6ff59e9d64c562ad8d4d74f2669a9bf059a286c30d1b593be986fd79b8b1e200e25bf4bc22ca28f471b20cb73a96ae6a","ssdeep":"384:qkpgd+DendA7JeJ5+FrHTtBrqWKcdPpZFixN8JObcaA348WBlXLzMlUaTnsM6SKx:qkOQiKJeCrgUP3ANdKOwlUUsiihp4i9l","tlshash":"52c2e1285467229b84e746b56646f2bc334ad4494c805fff85361332d1f6fb67349d1c","first_seen":"2023-05-02T18:44:39Z","last_seen":"2026-08-30T04:54:51.773136Z","times_seen":1542,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-7.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.159Z","timestamp":1788056698159,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-7.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1149\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1149,"size_decoded":1434,"mime_type":"image/png","magic":"PNG image data, 95 x 33, 8-bit gray+alpha, non-interlaced","md5":"6759e6dddd6e292492c9ef91292d8c22","sha1":"ceab17fa5e625fbcfd22870a999641dcb4b27258","sha256":"268913d7271b6238b1ae3f570aae11f13a78d05d96a362d1a2387e5aa95ee997","sha512":"eb6ab572a9c1e223421933b3fe49d938849d9f8ea8e246cd421959c5310d564517934ccef196bccbddb61e134129db1a21e260671d21a33af853885d998bd2dd","ssdeep":"","tlshash":"2f21d3b1261801368892203732668cede2b4a0f89fd02793289147db9e0ae2438d58eb","first_seen":"2024-08-29T17:20:29.851196Z","last_seen":"2026-08-30T03:14:58.20472Z","times_seen":199,"resource_available":false,"data":null}},"time_used":909,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":909,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/main.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.131Z","timestamp":1788056698131,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/main.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1962\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5916,"size_decoded":2305,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"47bc986391ae43304be7544164cf022d","sha1":"e42afdb45a95bee3a021a79a24bb0357f84b62b8","sha256":"f7f7c12c779f4100a67c0a9c853a1f4a534183c36746df58d358bb5d02e548f8","sha512":"95d746af3aa95c33c01f8ad9e80ba17b7390bae9c4df4c0d2d85762bb84ac18604bfe07eab20d2106486a7a1b26e83c621d84b1d3b7fa0a064ce6d94be6f483b","ssdeep":"96:705I1XuiMlvMsW638DBpUtr+LIZDu7dQzqvcr8r:705I1Xx0tuIZDTA","tlshash":"15c17344714c143dc5fb32a4d139d5098f7d6111e203b2f5f8fe00ac1b686aeb6ba99e","first_seen":"2024-08-29T17:20:29.828451Z","last_seen":"2026-08-30T03:14:58.192368Z","times_seen":334,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/4.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.146Z","timestamp":1788056698146,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/4.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 10230\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10230,"size_decoded":10516,"mime_type":"image/png","magic":"PNG image data, 265 x 253, 8-bit colormap, non-interlaced","md5":"104d3badf1ad26c48c6dd2979d8311e1","sha1":"914b2a40ec189e760998009d7f9c1925a62c3fbd","sha256":"60f9c169c73ace0533f2d8129220d72e650956ce2486fbaa37e81f2a5e10257b","sha512":"2dc2c8e8fdfb4977d9b7d6fcf2b4e45b5014eb0776c6bd9477b097fa6cbde9e1a555668bb8962484adbea629c077cecf3a4c117fc69972e004013ad93467a3ed","ssdeep":"192:v3AbHQbwHuu2QU3+9vAVi5+2ZZlgOpR/+iJcDK:fAbw0o6IVu+2ZwOX+Ccu","tlshash":"0122c0841dd5bd0b6f1da7b66f635badf3861e980f738fc3fba0193a005018068a75a4","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.146885Z","times_seen":569,"resource_available":false,"data":null}},"time_used":925,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":920,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/owl.carousel.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.124Z","timestamp":1788056698124,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/owl.carousel.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 11146\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":44350,"size_decoded":11490,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (31998), with CRLF line terminators","md5":"efc01f2aded8e7b272ab9f9e1b3ecdb0","sha1":"eef21a57c46361f05c28d0d7b97fdc6530185c17","sha256":"668bfb67cff6b815ff9f9b82e070d4ad8721414bca6f3de21f10fb9f3e5dfa32","sha512":"20e04e83be2dbab7ec9972ac31ba5372fa53d62d046220f93e348c47f1840b636d54d8ca380eb36e7f7445123eec24e1d435fb61928eea259ccf912c5c3e8b08","ssdeep":"768:FCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSRc7UuHjRUQuFBt33:MITMFC4dbMVRSRcgRDV","tlshash":"cf137346b3202d2a869b61a0663f160bb23a241ce414547d7d79e6de6d7d88c213ffbc","first_seen":"2023-03-08T07:37:20Z","last_seen":"2026-08-30T03:14:58.216649Z","times_seen":1022,"resource_available":true,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/main-banner2.jpg","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.138Z","timestamp":1788056698138,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/main-banner2.jpg HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 176206\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":176206,"size_decoded":176494,"mime_type":"image/jpeg","magic":"PNG image data, 333 x 500, 8-bit/color RGB, non-interlaced","md5":"9bd7f16a525c819fecf84b526735ca96","sha1":"909319e17fbd5d712149476dd62d36bf39d40880","sha256":"c9d463431eb53ff0cb84fe062468d1eb6c395758967007edba1b78b22bfd3daa","sha512":"e0d4115408c14d663c2cef76a02cf073b7880d42c89c8f67c7dc72e601fdf6f2c00b63ce1ba5309fee132cfe1fe208341436c08f007d897d8a8721c09d68e69d","ssdeep":"3072:1sUBiFs8cERrKxCPk8MiyvBxe8D6l9QbHZVH8gzIxL4lo7X+F:1sUBiFtvKIPlyUQbHzcgzIxLOo7Y","tlshash":"f50422afd15acd801334d71c2b2d2de981bcb4a4963ae9063c65cac755fe39a524f8f0","first_seen":"2025-09-07T19:34:52.134989Z","last_seen":"2026-08-30T04:54:51.788432Z","times_seen":206,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-5.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.156Z","timestamp":1788056698156,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-5.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 830\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":830,"size_decoded":1114,"mime_type":"image/png","magic":"PNG image data, 89 x 24, 8-bit gray+alpha, non-interlaced","md5":"2237dabc3197d00e0ad5cfadc06b76ea","sha1":"6e1c127da23efd79be63c19fab37c486aa174fb9","sha256":"d25904d8c3bc764185137092649b23cc5942e5d0f40ed0a8f2a5a6c7fa572a57","sha512":"cca886c4b50c1752bd9e9c0652d89aa0dde8e96b8c0a8f549b5afc02038b041c9a5d11969b501e8ff36654ff6cd7b20aa92ff870efef44897dcd26226eb03111","ssdeep":"","tlshash":"f501569d93d16530e8b909a2bcb25583dd95055fc8629a4084a6630d29b462152f528b","first_seen":"2024-08-29T17:20:29.846635Z","last_seen":"2026-08-30T03:14:58.185377Z","times_seen":199,"resource_available":false,"data":null}},"time_used":911,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":911,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/mobile-app2.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.170Z","timestamp":1788056698170,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/mobile-app2.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 35393\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":35393,"size_decoded":35679,"mime_type":"image/png","magic":"PNG image data, 315 x 507, 8-bit colormap, non-interlaced","md5":"e26bba463d260e078ac8629c81b0880d","sha1":"b1193b6a599af24e147823b8937032c7f58945aa","sha256":"00b9f3ded7bd55a409b41a1d92ee4cd67bf765a665442de53065675ca575e0fa","sha512":"4ed8eccac70c37f73e12010bda61dfed74d842e51c5c660648388ee085dc796e7768117c9049d1e076bfc913331ee2aaa29ae68422816e189a360121c00ce2d1","ssdeep":"768:lyvgW+RPOTm9mw/xJme5brdAK2v1TD6HnZ1CxYBaax+kV4RXXrWS:QKS6/GeJdC21CxYBVSV","tlshash":"bdf2f2c702291c89307d7eebb3e73760252a9a8c5de29de010b383d1ee155a834592e7","first_seen":"2024-08-29T11:46:34Z","last_seen":"2026-08-30T03:14:58.215172Z","times_seen":341,"resource_available":false,"data":null}},"time_used":971,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":901,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/responsive.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.100Z","timestamp":1788056698100,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/responsive.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4725\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":42016,"size_decoded":5054,"mime_type":"text/css","magic":"ASCII text","md5":"0c84a81a7dee675b6713af510b5725d8","sha1":"2ebb9bb229c01f940e0506c8d260947d9c48a996","sha256":"7b7658d6d943c42439e53284af5caef22a924806eba3501e6c0b11b88aa8a2fe","sha512":"c2c0b2cd39d3e338d5a56c5e5d9f26708341e44e6f7a7080db61814418971e4a0bbcf72ad786a7d1178aca1cd0443ee77207bf95f1120dde48b9106b5a397cfb","ssdeep":"768:88wvXFz1EdMOnP6FeVFMF530Cbms3LWg+6O2HFzR:88wvXF1EdlP6UVC7bms3Cg+6O2HVR","tlshash":"d713989f7aa3110c786aa6b96abd3a12b745d453d38edce379c4206ccfd46d00ad274c","first_seen":"2024-08-29T17:20:29.816202Z","last_seen":"2026-08-30T03:14:58.223611Z","times_seen":335,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":967,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/dark-style.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.101Z","timestamp":1788056698101,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/dark-style.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2558\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":38764,"size_decoded":2887,"mime_type":"text/css","magic":"ASCII text, with very long lines (1191)","md5":"8c1ac4fa64c95a86f75e12ed2d732159","sha1":"7ebcbde56a39fae94bb808f1fdae5c0fa6348539","sha256":"193fd9dfc7b3b076646a4efbf74285486c93cc56f7b1f48ab083ff11400ecee6","sha512":"c3931898c92663a481cb0dc0fa8f2386288bcdd96ce0fb96198c872a64c7c9baf576efe6594b2510c2a2a6fcfe2c4b08c50c09fa24c1e7de50d3767447643a81","ssdeep":"768:JHYmOwoL86Kn4GurcaqHYmOL86Kn4GurcaqI0oUIvkxvXpBANLbERP3gtr7kxvX7:JHYmOwoL86Kn4GurcaqHYmOL86Kn4GuU","tlshash":"0e03168599fbad5015d3041c79c8ce601ffa62d0572cf3bf793781acaa8660c12baf59","first_seen":"2025-03-07T12:16:50.258205Z","last_seen":"2026-08-30T03:14:58.190856Z","times_seen":325,"resource_available":false,"data":null}},"time_used":966,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":966,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/fonts/Flaticon.woff2","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.258Z","timestamp":1788056699258,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/fonts/Flaticon.woff2 HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/temp/custom/assets/css/flaticon.css\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:25:00 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4012\r\ndate: Sun, 30 Aug 2026 02:25:00 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4012,"size_decoded":4298,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 4012, version 1.0","md5":"59a3e44fffe01a82bd2c76e1b0b35e78","sha1":"058a144b3f6b5648c4dcf87f9be917be1ad97bb9","sha256":"8a0cdff6e76a8bbdeb9b412165ded677648e805fa58a39d5feedd20743f4c5fa","sha512":"337d05e3691e5c112af5d33573f349c66d60efaf5d83aff8c4a5b337b66be6dd7d7e25787462ab584e23b492c48d77161257ef20b8f5cf42663127c328f1e2ab","ssdeep":"","tlshash":"fb816d06b44db340cc16f131402742f7ba778699e81d152cdf4e564fe671b20b9abe46","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.194391Z","times_seen":632,"resource_available":false,"data":null}},"time_used":806,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":806,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.259Z","timestamp":1788056699259,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 27 Aug 2026 05:14:37 GMT\r\nexpires: Fri, 27 Aug 2027 05:14:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 249022\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":37745,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-30T05:31:35.887205Z","times_seen":34912,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":27,"dns":0,"connect":0,"send":0,"wait":27,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.smartsuppchat.com/loader.js?","fqdn":"www.smartsuppchat.com","domain":"smartsuppchat.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.553Z","timestamp":1788056699553,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1161431244.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 18:42:43 GMT","end":"Wed, 11 Nov 2026 18:42:42 GMT"},"fingerprint":{"sha1":"4D:89:37:9F:84:1B:FF:C9:39:F5:29:BC:64:5C:81:B9:FC:B4:62:34","sha256":"19:44:D1:D4:0E:46:63:2F:1C:79:F2:43:C1:52:6B:F1:4B:C5:2B:F4:3D:04:55:0E:C7:74:B5:03:A3:6F:91:CA"}}},"request":{"raw":"GET /loader.js? HTTP/1.1\r\nHost: www.smartsuppchat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:02 GMT\r\ncontent-type: application/javascript\r\ncache-control: max-age=300, public, s-maxage=60\r\netag: W/\"6a2663cd-4668\"\r\nexpires: Mon, 08 Jun 2026 06:46:12 GMT\r\nlast-modified: Mon, 08 Jun 2026 06:40:13 GMT\r\nx-77-nzt: k+3Ac7XzRxbocR1FUDl5vol5xrhLyomjcV0zoKJ/1znc7Yc55shvpq2XHrEGohUT8+YgN6s\r\nx-77-nzt-ray: e2f75420847bb993a394936a55798c37\r\nx-77-cache: HIT\r\nx-77-age: 34\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":18024,"size_decoded":6042,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17951)","md5":"218d24439d4e2c0990f35338a7ac220c","sha1":"5a7b913584c1244bf61beab9dc644204d130101c","sha256":"efb497f7159de26ea5e0521d675d909dc063e36d0d23c2ad96fa9109b73ee263","sha512":"17af39bfdc350c9d1f8dd74652641d0c028881ecb3935d2d9fdb763d24136665d135d00219aabac57693112e2314d4fa91b802ba2662a1580aa35c5e0b6e624b","ssdeep":"384:2/xzy2A3wyxNeBWbEgl/EuVaBWbE0rIcvqSI/aQ/UpG:2/xzy2A3wXscuVaAxka05","tlshash":"4182b7cc7691b16543ab61b4843f620ff1376929740d8865b965eae13cb8c8ed037fb8","first_seen":"2026-03-30T19:01:55.527327Z","last_seen":"2026-08-30T04:54:51.7563Z","times_seen":8978,"resource_available":true,"data":null}},"time_used":3387,"timings":{"blocked":0,"dns":93,"connect":8,"send":0,"wait":8,"receive":0,"ssl":3278},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/assets/style-CliJwUTR.css","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:06.535Z","timestamp":1788056706535,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1857279285.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 18:42:46 GMT","end":"Wed, 11 Nov 2026 18:42:45 GMT"},"fingerprint":{"sha1":"02:15:23:9E:FB:D6:BA:70:A5:A0:F0:53:9D:F4:1F:AE:DD:A9:2E:44","sha256":"53:3C:17:3E:10:6F:4D:A3:B5:0D:11:42:7D:01:FA:29:0E:0C:8D:3A:BE:5C:F3:77:52:D7:EF:25:7E:8C:CA:DC"}}},"request":{"raw":"GET /assets/style-CliJwUTR.css HTTP/1.1\r\nHost: widget-v3.smartsuppcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:06 GMT\r\ncontent-type: text/css\r\naccess-control-allow-origin: *\r\ncache-control: max-age=31536000, public, immutable\r\netag: W/\"6a4cb803-8d68\"\r\nexpires: Wed, 07 Jul 2027 08:30:01 GMT\r\nlast-modified: Tue, 07 Jul 2026 08:25:39 GMT\r\nx-77-nzt: kx95x+/CbE7agLqjCXvT6pSc8WOlymi4X9HOLLdh6bahwrFJmLRQ4DwUo8XKUfOCPNDRwSQ\r\nx-77-nzt-ray: e2f754209160ceaaa794936a01804420\r\nx-77-cache: HIT\r\nx-77-age: 4643664\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":36200,"size_decoded":8208,"mime_type":"text/css","magic":"ASCII text, with very long lines (36187)","md5":"840dfdb09fc1a11a5c3a5b5f808e3160","sha1":"46140a50b100fa33b974027c13bb9f2de5c784b7","sha256":"b5b9a339413a55a0d828ab6be236e2a495594a19fb3283f846c607d7b6996ad7","sha512":"61e37700ee60ed584c8ae7b6313c5dddf6950c9664aa57f32bb4a70d775b1a1d5bfc249c6c1238495ef2cb7e12bae5f00c4ddb3df4dde44a01081117b74e2ba2","ssdeep":"384:F8fY2l091g7Tc6/WYtGLadKzSVX8Kj6+eZcrNSN56qB56YR9evZLLq51vZLLq5G:F8wM091gTcCWYtG4XqcrNSN56DwQ43","tlshash":"05f2966daad9093dac23c179e3f8e58c911af5d5df3226daf74239008ac17ff0986514","first_seen":"2026-07-07T11:50:17.712499Z","last_seen":"2026-08-30T04:53:38.385649Z","times_seen":3873,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-13.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.164Z","timestamp":1788056698164,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-13.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1376\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1376,"size_decoded":1661,"mime_type":"image/png","magic":"PNG image data, 102 x 26, 8-bit gray+alpha, non-interlaced","md5":"975f743a88dc1bd813b8dd210514fddf","sha1":"6130b18ae827bcf85560d75e3faf985b30669da9","sha256":"3a47a82603c408a98be3a4ebdee4ab34f12f2cc14f8eb847eaf9b3d68577b9af","sha512":"bcc7c16839c4167bcb3cd8fdebd19299f427145868502323ee762080a934c9e51e8a2352124db7180e79f1d93ee6db68dbc30578aa7b25504202063f045a0e41","ssdeep":"","tlshash":"cd21d82860bd96ed80716627fad04853e2d15fd12615a377c91baff42c1391492f5a05","first_seen":"2024-08-29T17:20:29.86877Z","last_seen":"2026-08-30T03:14:58.186028Z","times_seen":199,"resource_available":false,"data":null}},"time_used":907,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":907,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/mobile-app1.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.169Z","timestamp":1788056698169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/mobile-app1.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 34784\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":34784,"size_decoded":35070,"mime_type":"image/png","magic":"PNG image data, 379 x 516, 8-bit colormap, non-interlaced","md5":"699b168204a76ad1e27c5f4143ad1fba","sha1":"72c7b5eeb71c55ac41c695398869ad037d9973a9","sha256":"35e92b0810c69325db809fc3b87efe340a6701156e2c8ba28a7107b591b4204c","sha512":"40f01539416852d5ae43e6cb8f8f9b252deba45c7cfe3b1741780ddf8381b4beb571dd945df74ad6c5df92b2fa4c3ecb2350e9c994b352a82699c4b60babc2c6","ssdeep":"768:n9jREbqf7qd/qd07jKufx3++WK5ENO9bvwGc8C1tvNmeRrmI:9ji67J6nKu9++WY9boGVCXvNmeR9","tlshash":"6cf2f1e5c11d9d83912bc1ea33558ac9003a1bb505c68b26e447fbbee859f07cf9b611","first_seen":"2024-08-29T11:46:34Z","last_seen":"2026-08-30T03:14:58.193069Z","times_seen":350,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":902,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/magnific-popup.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.119Z","timestamp":1788056698119,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/magnific-popup.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7046\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":20219,"size_decoded":7389,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20087), with CRLF line terminators","md5":"b37d7edf99565d3858eaa1ad80df3cff","sha1":"786a4343711e9af5e5dfcc493e7d2331b48875bb","sha256":"b0a45cd5aed66e27bd8ee861d0e3b782c8e79849bde32f90f078b9f2451a36f2","sha512":"a48797bf6796ab59e1b40003c98ac999a877c8b07adbf317b087ff49046c943a11c3922b92f228e88c1c770b1e4d80b75240c79e9958de50fcf1fbb9c35dbd1a","ssdeep":"384:iPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:iPBIt8I5h5t1qkOLCMst","tlshash":"bf921894f2b2b21383a735b8686f60093a729952ed06c855a55d94d87efcec89027f3c","first_seen":"2023-03-07T01:03:21Z","last_seen":"2026-08-30T05:29:15.275592Z","times_seen":25399,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/parallax.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.126Z","timestamp":1788056698126,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/parallax.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3805\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13302,"size_decoded":4148,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (611), with CRLF line terminators","md5":"9a9a9442f70e0807475a21b835dce50b","sha1":"7b4755ab79dcfbe1aecb13823f78997061fd1b8f","sha256":"fde3fba1a1c3dbae530a58d3a542369cef2e0000685cb299a265e721056d4201","sha512":"20a1dd28d273d407d096be59beb4a92c260791d1cf16019cde84651f22fd69f9a62950dae7addb5f807452a32afaa02b406d72f5d79d43d8caa9716960919cb2","ssdeep":"192:t0PtdiPwbyxVZ8343NiOAZSUa89Fr15FZxY8wb84FxDco+W4+D:t0uPwGLsgNiOAZSIp15FZ68wbZWWl","tlshash":"3d52a8453ae6111502ff73ad609f57087528a232c52ace1f7c3dc2d8a580b8953bb779","first_seen":"2024-08-29T17:20:29.824917Z","last_seen":"2026-08-30T03:14:58.17133Z","times_seen":364,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/1.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.139Z","timestamp":1788056698139,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/1.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 26015\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":26015,"size_decoded":26301,"mime_type":"image/png","magic":"PNG image data, 643 x 549, 8-bit colormap, non-interlaced","md5":"ed658f5b5db3a2af058849799dc5d7fb","sha1":"9ebeab3076cd153296cf536941d817ef4bd347f1","sha256":"547a51b8e826dcfb618037d9ae63cd7dccc1b27a42931a60bb97ebd35f30557a","sha512":"f4e4ea1a7a5a932d1999bd9bc77c29a6a82a55518892363a1349ae1d8c865bc2533eb51753995303228f2db96ec7ad112562518a8bb939d8e210a79244e9ca58","ssdeep":"384:HjVdAf1VzD2WmCnGttPgZUEiCJG4pbP2Huu9P2qDBRlgLGble/OKYkRXm1:5e95C4ZUEiaG4FxqD/0Ale//ho","tlshash":"81c2f1833b93df03d53112e15fc0ae6b5783ee114e638848fb654509515c6fa5be0e27","first_seen":"2023-11-18T02:28:27Z","last_seen":"2026-08-30T03:14:58.204093Z","times_seen":329,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":138,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-12.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.163Z","timestamp":1788056698163,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-12.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2024\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2024,"size_decoded":2309,"mime_type":"image/png","magic":"PNG image data, 117 x 32, 8-bit gray+alpha, non-interlaced","md5":"1d03f49caa8ea7ca202782acf3c1a3b9","sha1":"eccdb16ccfcd151a1219156d3f388d3586f7d6ba","sha256":"3208ac21e6336ea2c5ae916e7e5d63b5dea3fa0a2a8290dff51b7bcac96976a3","sha512":"4874bc24df2ac2e437286abab87506d1e160ae98aef498d88bbfdfc6153d027413fa9b83bc01154cc9b7f70d3e3fdc2b1adbae098e42b7faae26065c91f5b60c","ssdeep":"","tlshash":"0e414af44a8aa3bbce3b3591c6064d36d333c092843f22724ced083007693aa60138ea","first_seen":"2024-08-29T17:20:29.866635Z","last_seen":"2026-08-30T03:14:58.175988Z","times_seen":199,"resource_available":false,"data":null}},"time_used":908,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":908,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.295Z","timestamp":1788056699295,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 27 Aug 2026 05:14:37 GMT\r\nexpires: Fri, 27 Aug 2027 05:14:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 249022\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":37745,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-30T05:31:35.887205Z","times_seen":34912,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/style.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.099Z","timestamp":1788056698099,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/style.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 16864\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":155715,"size_decoded":17194,"mime_type":"text/css","magic":"ASCII text","md5":"2f48d50b42acdcffe5d9e5fd20b7237c","sha1":"ba0cb591de881029a3a36f0630b5133dfd90ccac","sha256":"4655f9d69b73295f521d26f7339aa565b0d235304823c167efb7d624d22047c8","sha512":"32559c77b3f9d5104f47e9a7bca65845476d725951ef54c603ee8daa9ffbb5a444c5c0afd826b57e610d64f8c14bc3ef3ad5637e986207559af340b8d05da783","ssdeep":"3072:m2KQRe5PUk06PSEnZB8BcgSS3ZQhqLpDpViAnL2Moc2S0YWHZj5JOQ9ZBbqcVNyA:iIe5Pf06VWc+3ZztFL2MP2PlHZmQ9PFH","tlshash":"4ce385d55ba52144364f90a829e5eb142fad50c3ea4fcdb97af3604cbf843881167f1e","first_seen":"2025-03-07T12:16:50.182098Z","last_seen":"2026-08-30T03:14:58.190155Z","times_seen":312,"resource_available":false,"data":null}},"time_used":973,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":968,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/nice-select.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.086Z","timestamp":1788056698086,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/nice-select.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 864\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3185,"size_decoded":1192,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (3070), with CRLF line terminators","md5":"573b75cc4e984f9fd2d7f0bfdef2eed4","sha1":"318d8e184c0b00ea15e324fd3b564ea7912cd7b8","sha256":"d8ba2f0d8e2516ee382a764e506ab91b4b1b02c8078bac475b10aa2d83494529","sha512":"47a28314bf50043971d2d62fadf7c1478cf2195b0c4dcee1e7417cd078bcb97b4bf9f125ffccbfd73cee763ecbdd0cc79281ff488a058b760b413e58fe052f5c","ssdeep":"","tlshash":"cd610f35d551216ff07fca3bbec53b68243dd20368324a9ef244ea07834a16998ce70b","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.205493Z","times_seen":582,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/meanmenu.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.096Z","timestamp":1788056698096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/meanmenu.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 808\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3151,"size_decoded":1136,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"93fae0ffb1b096b0233875f166557866","sha1":"f49ed4ded57ffc6bdef92496e2a6e35cc77a2c71","sha256":"3886b107ba24c98a804e32fc22b2751b84e0b40acdf33a32142902ce076fc045","sha512":"61174a758227ac8950578feacfbd6906b1dd1c8981585800b4b98cf27d08f8929461207428576479fbc445925b57baaff3fab18a92d86f493dcfc2969727de51","ssdeep":"","tlshash":"cb51ac54da7b1099fbab967ce671d3287ee4b05baf0fc1acb4fce520c28435824611c9","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.203356Z","times_seen":604,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-1.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.152Z","timestamp":1788056698152,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-1.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1355\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1355,"size_decoded":1640,"mime_type":"image/png","magic":"PNG image data, 103 x 33, 8-bit gray+alpha, non-interlaced","md5":"452ce7124fd1072acb07c0f8fb903628","sha1":"4dcd4ed698a8e5cb1069016b696f6681b6e4e78d","sha256":"dd08691f8f21a611e73bec24c59e3b0f5dc5108a5ef5b264f6c33279da6b06c7","sha512":"6d8f1c37c59e9a81c0e8f715846ba0aac97c0681bf25c6f4171880566cf996500a9b01bacb9ca39284fcd43875a83782d2ceba7423b94fdcda38f76af1765834","ssdeep":"","tlshash":"3021db685f2cb95ced6da2774590a3d0ff98e0191150179b674c9e766450ac4820231c","first_seen":"2024-08-29T17:20:29.838877Z","last_seen":"2026-08-30T03:14:58.172058Z","times_seen":199,"resource_available":false,"data":null}},"time_used":916,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":916,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-16.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.167Z","timestamp":1788056698167,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-16.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1236\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1236,"size_decoded":1521,"mime_type":"image/png","magic":"PNG image data, 100 x 29, 8-bit gray+alpha, non-interlaced","md5":"69b9119147b6f9dec48186e35d9ce627","sha1":"9374da481d2d8edcc050dc4161d91a33ff8788fb","sha256":"efb6c876499145626d0b61553231ac8a7a739d6f6f3858525d86b3fddd981a69","sha512":"19df4d5ffa9666e8f73a484686ad70128a2db63aa3cfbbfa7219b7d4db06a3bed5b8530f26c67c7314686afcea49bdb093ac869e8773b306719009d98efd0ba2","ssdeep":"","tlshash":"06211a8b71f548e9ac837685b135741abe81a0c1b812d79e036ec5f10fcd24c0f9e143","first_seen":"2024-08-29T17:20:29.841148Z","last_seen":"2026-08-30T03:14:58.202074Z","times_seen":199,"resource_available":false,"data":null}},"time_used":905,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":905,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GDNNQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.292Z","timestamp":1788056699292,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/crimsontext/v19/wlppgwHKFkZgtmSR3NB0oRJX1C1GDNNQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 25540\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 27 Aug 2026 10:40:43 GMT\r\nexpires: Fri, 27 Aug 2027 10:40:43 GMT\r\ncache-control: public, max-age=31536000\r\nage: 229456\r\nlast-modified: Tue, 24 May 2022 18:29:16 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":25540,"size_decoded":26353,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25540, version 1.0","md5":"19ab149056827f64d640fa3d65f4e536","sha1":"754c09533c5b386067e762ae85f39c345ec10915","sha256":"60b9b9640fc716abd752df41f38ad81052f4905e42be2ff3c1f78e851863aee0","sha512":"e382cfcf784ef72503ccd007642f5b3e285de7b5515cd76457855896034b7ee26908a1f491527b9fe7a603a6627fb3db0fc9618cdbd52724b8f4d309f7de33d1","ssdeep":"768:whjhD1rmXBpEcXoaazQAU5L9lg+Atku/N4XyJVa:kFOvEcXNa0A6c3tk47a","tlshash":"08b2f18a2721ef2cc94dc5a65b0b056fe58afe6e44d15cde481fb3aa430430ec2afd54","first_seen":"2023-05-01T23:05:16Z","last_seen":"2026-08-30T04:54:51.757387Z","times_seen":2254,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/js/wow.min.js","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.127Z","timestamp":1788056698127,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/js/wow.min.js HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 06 Aug 2026 21:26:57 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2529\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8183,"size_decoded":2872,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8152), with CRLF line terminators","md5":"ed4b12ef0f7e4bf5d5ff3555d18718cb","sha1":"258fa26dec8fcf4769d49eaca6712ef56923673e","sha256":"3162b6468674133d7b6c903e4b8a06f7faf51216d1e7f8b3edc8f326b1bfe461","sha512":"40d8f96697d393a5301d2960394cbea52ea64330a8b706a0982e9b17176bfc0d55394dd4f0fbea2cd1798c938e66ccccc671d803b2802f8b37c2c41f40c1200a","ssdeep":"96:xrZgL1xvPV6GqKyR6TYdtHFMLzA4pOROVEE1fosvGeaMozHImBaokbl:xry9PVfSnAPAjROVEEdos+eatzHILoe","tlshash":"17f175c9ba967035c75792f2833f0106b23a5aeea028047cb5b98dd57d38c58523bf78","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-08-30T03:14:58.21291Z","times_seen":2654,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:59.254Z","timestamp":1788056699254,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Yp2ywxg089UriI5-g4vlH9VoD8Cmcqbu0-K6z8GXhnU0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36932\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 27 Aug 2026 05:14:37 GMT\r\nexpires: Fri, 27 Aug 2027 05:14:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 249022\r\nlast-modified: Wed, 10 Sep 2025 16:31:03 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36932,"size_decoded":37745,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36932, version 1.0","md5":"7c87a648293fbb5b2924aafaa59e8aea","sha1":"c57593e0adc4cf99dd9e67cb782242220a061a9d","sha256":"9fea608a947e67020c33cad9a6fe3d60c54119dfb8cff87768a8117a15ed7543","sha512":"764ced325a768dca84e1fb0cc458818239ce379dbcbdb324ee8849bbe15f54e3f0254ae6e52ee5a92741840637b4f9885d246a0978af23176b3acfe5b9cec23f","ssdeep":"768:mMQPOAQQKW6GccoXQ+OGpHNzXgtDM0SVu7P3nqtPl9Bf2csDpHUjbYE8j2:mMQz4W5og+tpH6tDJku73EPlPOcs5U/l","tlshash":"c0f2f23e7ea5691487c2b0be506b00935344c9bd37c18121bbb953f44ea67addc5d63c","first_seen":"2025-09-11T17:08:25.889763Z","last_seen":"2026-08-30T05:31:35.887205Z","times_seen":34912,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":2,"connect":30,"send":0,"wait":18,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/storage/app/public/photos/8r5PMnclyBedwBQ975WEYuQFKu1zFCsxYT6DcJ9j.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:01.396Z","timestamp":1788056701396,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /storage/app/public/photos/8r5PMnclyBedwBQ975WEYuQFKu1zFCsxYT6DcJ9j.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:25:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:27:02 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8140\r\ndate: Sun, 30 Aug 2026 02:25:01 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8140,"size_decoded":8425,"mime_type":"image/png","magic":"PNG image data, 738 x 246, 8-bit colormap, non-interlaced","md5":"db9cf7a3e5f016e356fb4e2e5ea7a164","sha1":"abf24c5fe5fff93fc3bf53f4d6eb89a843b50c11","sha256":"506905ceb5e49620e8b7553592ca5a40b3288f7c012513aa4ef6cfc1c23d9291","sha512":"c6998fd2d36c84c7a28ed82805cbf620d7764f7addff2cb5531363d1e18aa22d13309fee8e8a98c7256b66d0ed08c9b48ea2318b7c75d10a50a3b6f496d66eb9","ssdeep":"192:bUkm0D/AULrxfOWj9LzD3RsjmYpyz8fxyeTpgZu4lAZL:bJrvZVLzrRsSYNsQaZu4yL","tlshash":"09f1aef4d211c641e8c22c32318d9c5afc870802c9ebdbdd9e7a4c36718d24a6545ed9","first_seen":"2026-08-30T02:25:40.525206Z","last_seen":"2026-08-30T02:25:40.525206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://websocket-visitors.smartsupp.com/socket/?EIO=3\u0026transport=websocket","fqdn":"websocket-visitors.smartsupp.com","domain":"smartsupp.com","tld":"com"},"ip":{"addr":"63.188.129.148","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:13.460Z","timestamp":1788056713460,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.smartsupp.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 24 Jun 2026 00:00:00 GMT","end":"Thu, 07 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"4F:1A:3B:79:00:E3:DC:1F:92:62:7C:DC:85:3A:BE:8C:D1:68:F2:57","sha256":"7F:93:E6:29:5D:CA:78:BD:30:0D:25:11:3B:E2:01:C9:DC:80:3C:80:90:3F:84:D2:72:1B:0D:42:F1:20:13:D9"}}},"request":{"raw":"GET /socket/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: websocket-visitors.smartsupp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: rXRdMbP46vCpt5xm/zmAxA==\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Sun, 30 Aug 2026 02:25:13 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: 5Y3TG4KaUToLrOqsUiQRxLCNNgs=\r\nSec-WebSocket-Version: 13\r\nWebSocket-Server: uWebSockets\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}],"data":{"size":0,"size_decoded":224,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-30T05:22:59.288808Z","times_seen":18179577,"resource_available":true,"data":null}},"time_used":750,"timings":{"blocked":0,"dns":340,"connect":358,"send":0,"wait":27,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-3.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.154Z","timestamp":1788056698154,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-3.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1369\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1369,"size_decoded":1654,"mime_type":"image/png","magic":"PNG image data, 114 x 22, 8-bit gray+alpha, non-interlaced","md5":"e3dd3b08b94057617edc3eae067e1352","sha1":"228c71ddeeba354e2fb5d9e44c63b788efff400e","sha256":"8b8db48734cb98e99ae3c1267f3ca4c4570f50a0d6f1eb2ecad46fe6cd453c77","sha512":"08ce4a37d11292d8c6567928d0aaa7caeaf5e9477f262128d9bf5742639101942e270fd4eaeb231235b235b475469d904e6575fac8b6e18f7795f31f899debda","ssdeep":"","tlshash":"7321068f9a1aef81d152d037f06993b5c9900a8be132056dc47c2a0c22767c0c5dcb39","first_seen":"2024-08-29T17:20:29.843381Z","last_seen":"2026-08-30T03:14:58.19927Z","times_seen":199,"resource_available":false,"data":null}},"time_used":914,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":914,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/assets/main-DabC6aZO.js","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:06.532Z","timestamp":1788056706532,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1857279285.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 18:42:46 GMT","end":"Wed, 11 Nov 2026 18:42:45 GMT"},"fingerprint":{"sha1":"02:15:23:9E:FB:D6:BA:70:A5:A0:F0:53:9D:F4:1F:AE:DD:A9:2E:44","sha256":"53:3C:17:3E:10:6F:4D:A3:B5:0D:11:42:7D:01:FA:29:0E:0C:8D:3A:BE:5C:F3:77:52:D7:EF:25:7E:8C:CA:DC"}}},"request":{"raw":"GET /assets/main-DabC6aZO.js HTTP/1.1\r\nHost: widget-v3.smartsuppcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:06 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: max-age=31536000, public, immutable\r\netag: W/\"6a8ffde6-3e9c\"\r\nexpires: Fri, 27 Aug 2027 09:09:57 GMT\r\nlast-modified: Thu, 27 Aug 2026 09:05:42 GMT\r\nx-77-nzt: k6gQFh3ICGbfdj8G6+Snr0z/UGg9VAuaIF+1PFb04skvZNS6f9A6pTd1bJvLDdIvOMf1A4A\r\nx-77-nzt-ray: e2f754209160ceaaa794936ac2dab11f\r\nage: 0\r\nx-77-cache: HIT\r\nx-77-age: 234890\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":16028,"size_decoded":6763,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (15620)","md5":"484b339ab8994cd2aa6196b02c94bf40","sha1":"4859d1218ce4eabd728109388b5e999e361399cf","sha256":"6f1773ddd0916b4b176d423ef1ac87883da34e76dd895250be5ccca462fbf0b6","sha512":"ed195878480c14d1a519189d01ea5f90e05ba387f64c7f6958515af3a5cb3375f3a73ff98cf9f9602eaf50f779fc32521c76640ae170c056a00d76ec42f0cf92","ssdeep":"384:a2NcFT88tMPdBgaw5O+mvRan7/AKsDoKVwA3Q+crsbUzgfTtQfQIeIa:ZNcFX+dBgaw5O+aanrkoK2A3Q+cwbUwZ","tlshash":"9672e8741210743f712fac492a6df497723ad298e597c5289a2fdd5c36c8cc0a873bb5","first_seen":"2026-08-27T10:24:41.410826Z","last_seen":"2026-08-30T04:45:48.816118Z","times_seen":145,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/invoicing-image/circle1.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.149Z","timestamp":1788056698149,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/invoicing-image/circle1.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1868\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1868,"size_decoded":2153,"mime_type":"image/png","magic":"PNG image data, 180 x 181, 8-bit colormap, non-interlaced","md5":"3dc7e9a6a12a32389eabe691980a5039","sha1":"755848207b7f9149b3c9959dfbdae59c2486a9f0","sha256":"c4be331bc355e304e8227874a23bce8eb923d34031d32649a364863fa49ac5f5","sha512":"9d1736bf5f51e3689e2f0d9bcdbaeee71b8051484832562ac7951a2a2511814e632669888508123416c2b3780d10d156b32038b5d59b2a75b866396b8a517db3","ssdeep":"","tlshash":"fa3108fbbb2cbfc19f700aa742909a94c1f0030827b0612b89b742f0a5e9af41167d15","first_seen":"2023-05-23T06:22:12Z","last_seen":"2026-08-30T03:14:58.197824Z","times_seen":560,"resource_available":false,"data":null}},"time_used":919,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":919,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-6.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.157Z","timestamp":1788056698157,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-6.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1294\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1294,"size_decoded":1579,"mime_type":"image/png","magic":"PNG image data, 120 x 33, 8-bit gray+alpha, non-interlaced","md5":"167e5679a7895c209a59d6163a850692","sha1":"6f66d2025a0fc11fbb1392868aeb8721872f06eb","sha256":"c6f8102bd42e059d387885a5ab3d2b98a9e89d911063651a199b8322a57c1763","sha512":"1cf5a7b9544fe42b798388ae30932461d3616c9ac3c501d014eeb40a161fe56653a704941c34c35d9c0ec7696f5d9036dd8be3ace976cf68f3980975f96c7746","ssdeep":"","tlshash":"05211a6001323c7aa1ed9b390d255872fbb696e5275397f50d39d03e340e6a18f8de2a","first_seen":"2024-08-29T17:20:29.848996Z","last_seen":"2026-08-30T03:14:58.18001Z","times_seen":199,"resource_available":false,"data":null}},"time_used":910,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":910,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/css/slick.min.css","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.091Z","timestamp":1788056698091,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/css/slick.min.css HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 726\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1814,"size_decoded":1054,"mime_type":"text/css","magic":"ASCII text, with very long lines (1332), with CRLF line terminators","md5":"e1bb8aca0ada1361d15eac06412538b4","sha1":"51f8be05d8b482766bbe8550181ee66b95a1a10f","sha256":"6c3b07b65a2bae0d0b8430524dbcffac75c20125514b04dbe5ebb48faca4df64","sha512":"9a1120caca16be2f5e6bd422a569e1042b81948f15a36d85fa41508773ff93f938deb8594d1d02b922cf4292378e8a06255a3c3b3b36cbb8683a83154ca9a079","ssdeep":"","tlshash":"8a31eb990056118a4037e7136ae3eb8a39e7f1125c3206c9f75c8715cf8feda1dc25da","first_seen":"2023-04-07T03:58:23Z","last_seen":"2026-08-30T03:14:58.182722Z","times_seen":707,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/storage/app/public/photos/8r5PMnclyBedwBQ975WEYuQFKu1zFCsxYT6DcJ9j.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.137Z","timestamp":1788056698137,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /storage/app/public/photos/8r5PMnclyBedwBQ975WEYuQFKu1zFCsxYT6DcJ9j.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:27:02 GMT\r\naccept-ranges: bytes\r\ncontent-length: 8140\r\ndate: Sun, 30 Aug 2026 02:24:58 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8140,"size_decoded":8425,"mime_type":"image/png","magic":"PNG image data, 738 x 246, 8-bit colormap, non-interlaced","md5":"db9cf7a3e5f016e356fb4e2e5ea7a164","sha1":"abf24c5fe5fff93fc3bf53f4d6eb89a843b50c11","sha256":"506905ceb5e49620e8b7553592ca5a40b3288f7c012513aa4ef6cfc1c23d9291","sha512":"c6998fd2d36c84c7a28ed82805cbf620d7764f7addff2cb5531363d1e18aa22d13309fee8e8a98c7256b66d0ed08c9b48ea2318b7c75d10a50a3b6f496d66eb9","ssdeep":"192:bUkm0D/AULrxfOWj9LzD3RsjmYpyz8fxyeTpgZu4lAZL:bJrvZVLzrRsSYNsQaZu4yL","tlshash":"09f1aef4d211c641e8c22c32318d9c5afc870802c9ebdbdd9e7a4c36718d24a6545ed9","first_seen":"2026-08-30T02:25:40.525206Z","last_seen":"2026-08-30T02:25:40.525206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-9.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.160Z","timestamp":1788056698160,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-9.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1356\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1356,"size_decoded":1641,"mime_type":"image/png","magic":"PNG image data, 112 x 27, 8-bit gray+alpha, non-interlaced","md5":"558f0c35aa541850af470e4683219364","sha1":"60cc6834e3ced57f2b849955e2d6bb204dbb362f","sha256":"af42372a144350be48e2d13d92df4b11a783e71137f81bcf172c7d142173960d","sha512":"d2684da77ddedae60e08b443c9f88c40d51bdd104a704b36f05d7f365c10c738367012b5ec0351511f4b641c441265d18f71edab5aa02d181a4671ff16e18cc8","ssdeep":"","tlshash":"9021d8c724a4fb3ccfec3db9ab4b0e5244202162fe6b18344d553266ed569416d6384a","first_seen":"2024-08-29T17:20:29.855803Z","last_seen":"2026-08-30T03:14:58.15281Z","times_seen":199,"resource_available":false,"data":null}},"time_used":910,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":910,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"widget-v3.smartsuppcdn.com/assets/shared-DqnxneoL.js","fqdn":"widget-v3.smartsuppcdn.com","domain":"smartsuppcdn.com","tld":"com"},"ip":{"addr":"185.76.9.12","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:25:06.534Z","timestamp":1788056706534,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1857279285.rsc.cdn77.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 18:42:46 GMT","end":"Wed, 11 Nov 2026 18:42:45 GMT"},"fingerprint":{"sha1":"02:15:23:9E:FB:D6:BA:70:A5:A0:F0:53:9D:F4:1F:AE:DD:A9:2E:44","sha256":"53:3C:17:3E:10:6F:4D:A3:B5:0D:11:42:7D:01:FA:29:0E:0C:8D:3A:BE:5C:F3:77:52:D7:EF:25:7E:8C:CA:DC"}}},"request":{"raw":"GET /assets/shared-DqnxneoL.js HTTP/1.1\r\nHost: widget-v3.smartsuppcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ziraatsbank.cftcrecovry.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 30 Aug 2026 02:25:06 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: max-age=31536000, public, immutable\r\netag: W/\"6a8ffde6-42f31\"\r\nexpires: Fri, 27 Aug 2027 09:09:57 GMT\r\nlast-modified: Thu, 27 Aug 2026 09:05:42 GMT\r\nx-77-nzt: k4zOv76qFdzoSfjQSHmVUwEKq7FJM8MtVenuHpMAyld4usAE1Pn64LD21BVW8Yi1seaTwEs\r\nx-77-nzt-ray: e2f754209160ceaaa794936ab3fdc61f\r\nage: 0\r\nx-77-cache: HIT\r\nx-77-age: 234890\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":274225,"size_decoded":93070,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44710)","md5":"00e2016c8eaa5d81104f61ec86462ef5","sha1":"16249d91aa367532b08f1dc494900a84520301c3","sha256":"d7da9bee8ad6397d1e6788b169f82b37f111b2628a998188e707329483ce5596","sha512":"caefb7d25ba6b24a5864f3ef23b2c5200246c88d0fe8e22095b3672597b729e0b3b99447d4c1458c2c5d74204846caee20095e727b273020593b4e12dc878952","ssdeep":"6144:FMAopqOWSr8ad2jJKaQqhJp9cuRgufObV:4qOW2Rd29d/DRJfObV","tlshash":"f9443ad53294b035439b51e6906f2106f33e5c19580d812cf269ece639baec4a2f7fb8","first_seen":"2026-08-27T10:24:41.327319Z","last_seen":"2026-08-30T04:45:48.824482Z","times_seen":145,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ziraatsbank.cftcrecovry.com/temp/custom/assets/img/partner-image/partner-18.png","fqdn":"ziraatsbank.cftcrecovry.com","domain":"cftcrecovry.com","tld":"com"},"ip":{"addr":"198.251.89.144","port":443,"asn":53667,"as":"PONYNET","country":"Luxembourg","country_code":"LU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ziraatsbank.cftcrecovry.com/","date":"2026-08-30T02:24:58.169Z","timestamp":1788056698169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ziraatsbank.cftcrecovry.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 20:21:49 GMT","end":"Wed, 04 Nov 2026 20:21:48 GMT"},"fingerprint":{"sha1":"46:88:6F:40:80:07:20:4E:58:8B:84:C4:85:8B:CC:C2:B0:00:25:F3","sha256":"38:32:16:CC:69:D1:90:63:4D:89:CE:E3:83:FC:E5:DF:03:D2:A9:A4:16:88:9D:26:ED:9D:F8:05:27:6C:4B:64"}}},"request":{"raw":"GET /temp/custom/assets/img/partner-image/partner-18.png HTTP/1.1\r\nHost: ziraatsbank.cftcrecovry.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ziraatsbank.cftcrecovry.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlhXa2VaZkNxdjZCcXhzalhNTGJEZnc9PSIsInZhbHVlIjoiOHlINHJjUGJWSTBUajJDMHNlZnBsendwemRhaktNTVdZbGR6T0xOQ0JRMjVXRy9hdzJYSUFwN09kTThrQUxZWnNyUGJ0STdkREM3elg5b1FNbFYwRlhTczFCeFh2R09Dd2hoamx3K0xiR2FQRnYwbzNvQkRYRUhneXJqMXNnQmUiLCJtYWMiOiJlZGRmZDM0NDUwNTg4NDg1ZDM2NWFkODUzN2E2MGNkZGFmMzc0MjllZjk4NjQ2MjBlMzg4MmYwZWI1ZGZjZDQ0IiwidGFnIjoiIn0%3D; remedyfinance_session=eyJpdiI6IjQ5N2h2Z2JEc29XVUNpSGZqQnFJdmc9PSIsInZhbHVlIjoiblVwVkNOOGoyRktENUpoSGVwNTJzaTJNd2FnVjZtSkpoMThSdXRCVExhUk12VjhCSFdYa1lZcklvTVAxRW1uOUlCTXI3eWE3V25uWWUrR0ZlYTUrdFkzN3RsQ0wzajd6MW9seTZVZ0l1dWZLRFRVQXp1Y0RocEo0bStUTWczbFgiLCJtYWMiOiI1ZDkwZDI5ZWJkMzI0NGQ3ZTg2OTM1YjIwMTM0ZGYzZjU2OTVkMTQ5ZjY3YTE1MTczMDA4OTY3YWVhYTVmYmUyIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 06 Sep 2026 02:24:59 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 06 Aug 2026 21:26:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1586\r\ndate: Sun, 30 Aug 2026 02:24:59 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1586,"size_decoded":1871,"mime_type":"image/png","magic":"PNG image data, 119 x 27, 8-bit gray+alpha, non-interlaced","md5":"669f054a19689ec08666b44767d0aa4a","sha1":"64b6bb65791e6af6283ebe95baa3d716fa346646","sha256":"c45130bc4ccd1557536f26a7b352a3eaea8b86859cff70cf300beca940370f6c","sha512":"d0406474390a4c319c7f025148bb4ff29f3a00f632a016acedef9da63b25810548486b7ff991f4805ebc714eadb64fe5c0a010f89002cea2e8ce0d80d92d5df1","ssdeep":"","tlshash":"9c31eac37e09e91d095a07b7490028dbe5aa794c72e3b34d291079776cec13d11ca264","first_seen":"2024-08-29T17:20:29.877611Z","last_seen":"2026-08-30T03:14:58.176614Z","times_seen":199,"resource_available":false,"data":null}},"time_used":903,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":903,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-30","alert":"Sinkholed","trigger":"ziraatsbank.cftcrecovry.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}