What Gridinsoft observed on Otokarne.com.tr
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260821040250-5ffa4f83
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context โ not used for this decision
The independent current review supports a Safe classification for otokarne.com.tr. Official TRABIS evidence shows that the domain was reopened and registered again on 2026-08-20, after the active Gridinsoft signature dated 2026-05-06. The present server, certificate, and static vehicle-inspection business page were established after that registration reset. Both specifically reported legacy PHP objects and their parent upload paths return consistent 404 responses, and the current root contains no form, iframe, external script, concealed redirect, credential request, executable link, automatic download, or specific malicious payload. The existing Suspicious Website classification is not supported by the reproducible current first-party evidence. External warnings remain separate contradictory context and should be reassessed against the new registration.
Analyst findings
Review 7 documented observations View evidence
The HTTPS root returned HTTP 200 and displayed a Turkish corporate holding page for an independent vehicle testing and inspection business in Ankara. Desktop, mobile, Googlebot, and Gridinsoft user agents received the same 11,355-byte HTML body with the same SHA-256 digest and no redirect. The response reported a last-modified time of 2026-08-20T13:39:36Z.
-
HTTP status
200 -
Final URL
https://otokarne.com.tr/ - Page element otokarne โ Profesyonel Araรง Test ve Ekspertiz | Ankara
- File SHA-256 202584df7d1ad485e7a5615545bc0eb44f3d9dbbeea6957568e31b1169c204c9
- Analyst observation Four reviewed user-agent profiles produced the same current homepage body.
The current root consisted of inline HTML and CSS, two same-origin SVG images, Google Fonts, public map and social-profile links, and one inline statement that updates the displayed year. It contained no form, iframe, external script, meta refresh, PHP reference, uploads reference, credential request, executable or archive link, obfuscated script, or automatic download.
- Public artifact URL https://otokarne.com.tr/tse-hyb.svg
- Public artifact URL https://otokarne.com.tr/logo-r.svg
- Page element document.getElementById('y').textContent=new Date().getFullYear()
- Analyst observation The reviewed HTML contained zero forms, zero iframes, zero external scripts, zero meta-refresh directives, and zero executable or archive links.
Both specifically reported legacy PHP paths returned HTTP 404 without redirection for desktop, mobile, Googlebot, and Gridinsoft user agents. The /uploads/, /uploads/doc/, and /uploads/doc/mineoldoffice/ parent paths also returned the same 808-byte 404 body, as did an unrelated random path. Direct requests to the current A-record address with the correct Host and TLS name produced the same result.
-
HTTP status
404 - File SHA-256 b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
- Public artifact URL https://otokarne.com.tr/uploads/x3x12.php
- Analyst observation The exact two legacy objects and the reviewed parent upload directories were not present on the current host.
The official TRABIS list identified otokarne.com.tr among domains reopened for allocation on 2026-08-20. Current TRABIS WHOIS reported the domain active, created on 2026-08-20, expiring on 2027-08-19, and delegated to ns124.tagmat.net and ns124b.tagmat.net. The active Gridinsoft signature was dated 2026-05-06, more than three months before this new registration event.
- Public artifact URL https://www.trabis.gov.tr/yenidenTahsiseAcilanAlanAdlari
- Page element otokarne.com.tr โ 20/08/2026
- DNS fact Current TRABIS WHOIS: created 2026-08-20; expires 2027-08-19; domain status Active.
- Analyst observation The current Gridinsoft signature timestamp, 2026-05-06T13:00:09Z, predates the official reallocation and current registration.
The apex resolved to 188.132.181.124 and served the reviewed root directly. Plain HTTP redirected to the same-domain HTTPS URL with HTTP 301. The current Let's Encrypt certificate covered otokarne.com.tr and its wildcard, was issued on 2026-08-20, and is valid through 2026-11-18.
- DNS fact A record observed: 188.132.181.124.
-
HTTP status
301 -
Final URL
https://otokarne.com.tr/ - Certificate fact Certificate subject CN=otokarne.com.tr; issuer Let's Encrypt YR1; SAN otokarne.com.tr and *.otokarne.com.tr.
- Certificate fact Certificate validity: 2026-08-20T11:34:28Z through 2026-11-18T11:34:27Z.
The rendered page consistently presented the company name MC Sรถnmez Danฤฑลmanlฤฑk Otomotiv Ekspertiz Taahhรผt Ticaret ve Sanayi Limited ลirketi, an Ankara vehicle-inspection address, vehicle test services, same-domain contact details, and public map and social-profile links. It displayed a TSE-HYB mark, but no certificate number was present and the certification claim was not used to establish the security verdict.
- Page element MC Sรถnmez Danฤฑลmanlฤฑk Otomotiv Ekspertiz Taahhรผt Ticaret ve Sanayi Limited ลirketi
- Page element Baฤฤฑmsฤฑz Otomobil Test Merkezi ยท Ankara
- Page element TSE-HYB
- Analyst observation The site presented coherent vehicle-inspection services and identity, but the displayed certification was not independently confirmed during this review.
The current review did not identify phishing impersonation, a credential or payment collector, an unrelated redirect, a malicious or unwanted file, an executable download, an exploit, an obfuscated loader, or a specific malicious payload attributable to the current site. Claims about the private server document root, absence of a database, and complete absence of PHP could not be established from public HTTP access and were not used for the verdict.
- Analyst observation No reproducible phishing or malware artifact was found in the accessible current scope.
- Analyst observation Private filesystem and backend-implementation claims were outside the independently observable scope.
Scope and limitations
- The review assessed the current public root, same-origin assets, named legacy paths, parent upload paths, DNS, TLS, registration data, redirects, and visible linked destinations; it did not audit the private server filesystem.
- Public HTTP behavior cannot prove that no PHP interpreter, database, unpublished virtual host, or private file exists anywhere on the server, so those requester claims were not used for the verdict.
- The site displays a TSE-HYB mark but no certificate number; the certification claim was not independently confirmed and did not determine the security verdict.
- The company displayed on the page was not the name shown in the public WHOIS registrant field, which identified the registration or hosting provider; beneficial ownership was not inferred.
- The Safe verdict describes the reviewed current deployment and does not guarantee future content or certify every non-public server component.
- External provider labels were recorded separately as contradictory context and did not control the independent verdict.
Help protect others by sharing this page on social media! The more people who know about otokarne.com.tr, the fewer chances they have to deceive someone else. Help others evaluate otokarne.com.tr by sharing this page on social media!