# PhishDestroy domain threat record: prosmart.com.tr Content language: English Canonical HTML report: https://phishdestroy.io/domain/prosmart.com.tr/ Machine-readable companion: https://phishdestroy.io/domain/prosmart.com.tr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-23 19:33:00 UTC - Last availability or vendor check: 2026-10-22 10:33:33 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: whatsapp ## Stored infrastructure - Observed IP address: 136.243.71.174 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2012-01-29 23:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0cfca-2329-7139-9ffd-ca8b3bee5beb/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/prosmart.com.tr - Certificate Transparency search: https://crt.sh/?q=%25.prosmart.com.tr - Web Archive lookup: https://web.archive.org/web/*/https://prosmart.com.tr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview prosmart.com.tr presents itself as PROSMART, a Gebze-based web design, engineering, architecture, IT, construction and consultancy company, complete with a local 0262 phone number in its page title. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-09-23. The page title shows an ordinary Turkish business site, while our classification is impersonation phishing. As of 2026-10-19 the site was online and still serving its content. How the scam works Impersonation pages borrow the identity of a real or plausible business so visitors trust what they are asked to do. A site posing as a local engineering and web design firm can request quotes, invoices, client portal logins or contact forms, collecting names, phone numbers, email credentials or payment details. Victims may lose account access, pay money to the wrong party, or have their details reused in follow-up fraud calls and emails that refer to the same company. Evidence Nine of 91 engines on VirusTotal flagged the domain as of 2026-10-03, among them alphaMountain.ai, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar, URLQuery and VIPRE. That is a minority of engines, but the flags come from several unrelated vendors rather than a single source. The domain appears in 31 AlienVault OTX threat pulses, showing it has repeatedly come up in community threat reporting. Among blocklists, it is currently listed by PhishDestroy. Infrastructure The domain was registered on 2012-01-30, more than fourteen years before PhishDestroy flagged it, so a long history should not be read as a sign of safety here. It is hosted on Hetzner Online GmbH in Germany, not in Turkey where the business it claims to be is located. The site uses a free Let's Encrypt certificate, so the browser padlock only confirms an encrypted connection, not who operates the page. What to do If you submitted a login on this site, change that password and any account that shares it, and turn on two-factor authentication. If you paid an invoice or deposit through it, contact your bank right away to dispute the charge. Treat any later call or email that claims to be from PROSMART with suspicion, and verify through an independent channel. Security teams should block the domain at DNS and proxy level, search mail logs for messages linking to it, and report it to the hosting provider. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0cfca-2329-7139-9ffd-ca8b3bee5beb/ VirusTotal report: https://www.virustotal.com/gui/domain/prosmart.com.tr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=prosmart.com.tr Archived copy: https://web.archive.org/web/20260720200541/https://prosmart.com.tr/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:35:20 UTC ## Stored page captures - Primary capture: https://i.ibb.co/6JyTNyfN/bc1fd9b7ca02.png Captured: 2026-09-23 19:43:34 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0cfca-2329-7139-9ffd-ca8b3bee5beb.png Captured: 2026-09-23 19:43:34 UTC Source report: https://urlscan.io/result/01a0cfca-2329-7139-9ffd-ca8b3bee5beb/ - URLScan capture 2: https://urlscan.io/screenshots/01a03906-2fb4-7176-aa74-351974e6f8d3.png Captured: 2026-09-23 19:33:00 UTC Source report: https://urlscan.io/result/01a0cfca-2329-7139-9ffd-ca8b3bee5beb/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aeb187bb-918d-4252-a302-ea0cff8c3bd5.png Captured: 2026-09-23 19:37:16 UTC Source report: https://radar.cloudflare.com/scan/aeb187bb-918d-4252-a302-ea0cff8c3bd5 SHA-256: d490f29b7a74165a17d1d8f4b425edcf1d1fe02caf2a0e845f5644cb4fff83ff - URLQuery: https://screenshots.phishdestroy.io/uq/900e49a6-d31c-4966-897e-f31fd7e5d379.png Source report: https://urlquery.net/report/900e49a6-d31c-4966-897e-f31fd7e5d379 SHA-256: ce61ff421250c5b58636ed51dda6c29df653a7ac1c7c6c3016906b18325db9b2 - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03906-2fb4-7176-aa74-351974e6f8d3.png Captured: 2026-08-25 13:05:11 UTC Source report: https://urlscan.io/result/01a03906-2fb4-7176-aa74-351974e6f8d3/ SHA-256: d21a9071ae920df5c2ab36eb3a9f9938678874744a70a3afe9ce2df017b4237f - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cfcb-ce4f-727d-a3b1-0f8f25bcf192.png Captured: 2026-09-23 19:44:04 UTC Source report: https://urlscan.io/result/01a0cfcb-ce4f-727d-a3b1-0f8f25bcf192/ SHA-256: e19d05a887d4c2b1b1d282d518016679352a5b3826b979fd68473c6f61408d9f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T21:00:44Z", "uuid": "01a0cfca-2329-7139-9ffd-ca8b3bee5beb", "scanned_at": "2026-09-23T19:42:19Z", "final_url": "https://prosmart.com.tr/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://prosmart.com.tr/", "from": "http://prosmart.com.tr/", "status": 307 } ], "ip": "136.243.71.174", "ptr": "baris.kebirhost.com", "domains": [ "mc.yandex.com", "pagead2.googlesyndication.com", "mc.yandex.ru", "ep2.adtrafficquality.google", "ep1.adtrafficquality.google", "www.google-analytics.com", "www.youtube.com", "fonts.gstatic.com", "static.getbutton.io", "region1.google-analytics.com", "www.googletagmanager.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.132", "142.251.110.156", "216.239.32.36", "142.251.110.97", "142.250.154.155", "77.88.21.119", "142.251.110.139", "142.251.156.4", "142.250.154.157", "142.251.13.94", "104.26.15.221", "142.251.14.95", "136.243.71.174" ], "asns": [ "15169", "13238", "13335", "24940" ], "countries": [ "US", "RU", "DE" ], "link_domains": [ "api.whatsapp.com", "gebzewebajans.com", "gebzenotebookservisi.com", "gebzemarkapatent.com", "gebzekartustoner.com", "gebzeguvenlikkamerasi.com", "getbutton.io" ], "social": [ "https://api.whatsapp.com/send" ], "doc_hash": "cba1ad78ee5df8151dfe54c05ae2ebcf6736e6f4d199877b0d32652cd0f93fbc", "script_hashes": [ "696921582a1a8e3884dbaa99719aeeb18dace24906c4487f9395625b680d02b2", "89a6f0a4ec6edcb884a5796369e3b109c75315edac8841c3d6f3d43bb46dc134", "517d22fc7a8efc8948b10a362550ca0ff40db1cd3d2bf2396d682cb2e7518d76", "b2eaba936659e5567e92464dde20e3539695592d2239faff07507ccc1c0d434d", "3f128638b3d5692b9b53db43a38bfa2895a344c417f354703b80a57908e8afab", "e0e2bc4e1d3ee5024c4e1aa58a6cad9aa42fc63a8c89ce18013a1c8f2b94875c", "2f23d0e1f30c83d014ad6e3d19d438a1ce3992e5994896f968953110130e525c", "9770048ee1a053b01b685ca75a3d1061d98c3dcea0c8561f737171ff209d37e9", "e7f1eb1f8904645629e93ee0ee17f2078354d5c750416e850105c77418196c71", "a1f5068662394f45a08364dfbda05381858ab884c5fc9bbc168a2e1b4441e9e9" ], "globals": [ "setImmediate", "clearImmediate", "GBBTN", "WhWidgetSendButton", "$", "jQuery", "Waypoint", "Retina", "RetinaImagePath", "RetinaImage", "GoogleAnalyticsObject", "ga", "ym", "adsbygoogle", "google_js_reporting_queue", "google_srt", "BGtEY", "google_logging_queue", "ggeac", "google_persistent_state_async", "google_measure_js_timing", "google_tag_data", "google_reactive_ads_global_state", "google_ad_modifications", "google_sa_queue", "google_process_slots", "google_unique_id", "google_rum_task_id_counter", "google_user_agent_client_hint", "google_sa_impl", "googFloatingToolbarManagerAsyncPositionUpdate", "google_global_correlator", "google_prev_clients", "ampInaboxIframes", "ampInaboxPendingMessages", "scriptUrl", "ttPolicy", "YT", "YTConfig", "onYTReady" ], "cookies": [ "PHPSESSID", "bh", "__Secure-YNID", "YSC", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__Secure-ROLLOUT_TOKEN", "_ym_uid", "_ym_d", "_ym_isad", "sync_cookie_csrf", "_ga", "_gid", "_gat", "yabs-sid", "i", "yandexuid", "yuidss", "ymex", "sync_cookie_csrf_secondary" ], "storage_keys": [ "google_auto_fc_cmp_setting", "_ymBRC", "_ym_synced", "_ym51882053_lsid", "_ym51882053:0_reqNum", "_ym_uid", "_ym_retryReqs", "_ym_jn" ], "tls": { "san": [ "mail.prosmart.com.tr", "prosmart.com.tr", "www.prosmart.com.tr" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "mail.prosmart.com.tr", "protocol": "TLS 1.3", "valid_to": "2026-10-27T20:45:38Z", "valid_from": "2026-07-29T20:45:39Z" }, "domain_age_days": 3727, "apex_age_days": 3727, "tls_age_days": 55, "tls_valid_days": 89, "requests": 78, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -32, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:07:26Z", "uuid": "aeb187bb-918d-4252-a302-ea0cff8c3bd5", "scanned_at": "2026-09-23T19:37:16Z", "final_url": "https://prosmart.com.tr/", "status": 200, "history": [ { "url": "https://prosmart.com.tr/", "status": 200 } ], "dom_hash": "76b86457c97d2a8d93dfb1b4ae0b3d3c694771e59dc123f3bf0cfdb2c4999a1b", "doc_hash": "aedd44b2befd954b49e4fdc7c29745a64a78ad29856599b789bd64b482f76da4", "domain_risks": [ "Business", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "prosmart.com.tr", "type": "A", "value": "136.243.71.174" } ], "dnssec_valid": false, "ip": "136.243.71.174", "whois": { "created": "2012-01-30T00:00:00Z", "expires": "2027-01-29T00:00:00Z" } }, "vt": { "v": 1, "fetched_at": "2026-10-21T19:37:33Z", "analysis_at": "2026-10-18T09:17:37Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 8, "suspicious": 1, "undetected": 32 }, "detections": { "VIPRE": "phishing", "Webroot": "malicious", "Fortinet": "malware", "SOCRadar": "phishing", "URLQuery": "suspicious", "Gridinsoft": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Alexa": 645850, "Statvoo": 645850 }, "first_seen": "2023-10-14T08:39:10Z", "dns": [ { "ttl": 3600, "type": "TXT", "value": "v=spf1 a mx ip4:136.243.71.174 ip6:2a01:4f8:212:259b:0:0:0:2 ~all" }, { "ttl": 3600, "type": "NS", "value": "ns2.tekmer.net" }, { "ttl": 3600, "type": "SOA", "rname": "hasanodabas.hotmail.com", "value": "ns1.tekmer.net" }, { "ttl": 3600, "type": "A", "value": "136.243.71.174" }, { "ttl": 3600, "type": "MX", "value": "prosmart.com.tr", "priority": 0 }, { "ttl": 3600, "type": "NS", "value": "ns1.tekmer.net" } ], "dns_at": "2026-10-18T09:22:46Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "mail.prosmart.com.tr", "prosmart.com.tr", "www.prosmart.com.tr" ], "issuer": "Let's Encrypt / YR2", "serial": "588c798f37639a22acd6838389ec7e67e56", "sha256": "d15a023536bfcf1ed43cdc8c70a6f31dc2a052054147230d1d4a1000f6f24c1f", "subject": "mail.prosmart.com.tr", "valid_to": "2026-12-26T21:34:39Z", "valid_from": "2026-09-27T21:34:40Z" }, "whois": { "status": [ "Active" ] } } } ```