sige.si
Open in
urlscan Pro
82.149.22.77
Malicious Activity!
Public Scan
Submitted URL: https://bit.ly/2NskH8F
Effective URL: http://sige.si/international/impo/
Submission: On September 18 via manual from FR
Effective URL: http://sige.si/international/impo/
Submission: On September 18 via manual from FR
Summary
This website contacted 2 IPs
in 2 countries
across 3 domains to perform 4 HTTP transactions.
The main IP is 82.149.22.77, located in
Maribor, Slovenia and
belongs to TELEMACH Broadband Access & Carrier Services, SI.
The main domain is sige.si.
This is the only time sige.si was scanned on urlscan.io!
This is the only time sige.si was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Impots Gouv (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 67.199.248.11 67.199.248.11 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
| 1 | 107.180.40.18 107.180.40.18 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 3 | 82.149.22.77 82.149.22.77 | 3212 (TELEMACH ...) (TELEMACH Broadband Access & Carrier Services) | |
| 4 | 2 |
1
107.180.40.18
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-40-18.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-40-18.ip.secureserver.net
| www.ecokraft.in |
3
82.149.22.77
(Maribor, Slovenia)
ASN3212 (TELEMACH Broadband Access & Carrier Services, SI)
ASN3212 (TELEMACH Broadband Access & Carrier Services, SI)
| sige.si |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
sige.si
sige.si |
84 KB |
| 1 |
ecokraft.in
www.ecokraft.in |
422 B |
| 1 |
bit.ly
1 redirects
bit.ly |
423 B |
| 4 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | sige.si |
sige.si
|
| 1 | www.ecokraft.in | |
| 1 | bit.ly | 1 redirects |
| 4 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://sige.si/international/impo/
Frame ID: 2B9882C7E7BE6A530B75225D37DBB927
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bit.ly/2NskH8F
HTTP 301
http://www.ecokraft.in/go.html Page URL
- http://sige.si/international/impo/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/2NskH8F
HTTP 301
http://www.ecokraft.in/go.html Page URL
- http://sige.si/international/impo/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/2NskH8F HTTP 301
- http://www.ecokraft.in/go.html
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
go.html
www.ecokraft.in/ Redirect Chain
|
79 B 422 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
sige.si/international/impo/ |
17 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
button.jpg
sige.si/international/impo/img/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.png
sige.si/international/impo/img/ |
76 KB 76 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Impots Gouv (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
sige.si
www.ecokraft.in
107.180.40.18
67.199.248.11
82.149.22.77
1313aaa35ecabd1176e9c33c3a53668c9383ffd328f2d6dc8887b692134e2b06
931b54faf897bcd96b75738671d77caebd6a7701272bf0e6c0580313043a108d
93890b4c814a06dd92b26c27d4e8156066b5ba771f7cde29cee07640dcbe4e50