simaterial.si Open in urlscan Pro
217.174.149.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://simaterial.si/W56v
Effective URL:
https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8p...
Submission: On September 02 via api (September 2nd 2020, 7:51:13 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 217.174.149.3, located in Bulgaria and belongs to TELEPOINT, BG. The main domain is simaterial.si.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 4th 2020. Valid for: 3 months.

This is the only time simaterial.si was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 8	217.174.149.3 217.174.149.3	31083 (TELEPOINT) (TELEPOINT)
1	2600:9000:205... 2600:9000:2057:e400:1e:c291:240:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2

8 217.174.149.3 (Bulgaria) 1 redirects

ASN31083 (TELEPOINT, BG)
PTR: peace.vivawebhost.com

simaterial.si	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:e400:1e:c291:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

s1.rui.au.reastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	simaterial.si 1 redirects simaterial.si	381 KB
1	reastatic.net s1.rui.au.reastatic.net	15 KB
8	2

	Domain	Requested by
8	simaterial.si	1 redirects simaterial.si
1	s1.rui.au.reastatic.net	simaterial.si
8	2

This site contains no links.

Subject Issuer	Validity	Valid
webmail.simaterial.si Let's Encrypt Authority X3	`2020-07-04` - `2020-10-02`	3 months	crt.sh
s1.rui.au.reastatic.net Amazon	`2020-08-19` - `2021-09-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM
Frame ID: DC9F0099D049465DD301A8DF2F8C4D8F
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://simaterial.si/W56v HTTP 301
https://simaterial.si/W56v/ Page URL
https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Z... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

397 kB
Transfer

393 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://simaterial.si/W56v HTTP 301
https://simaterial.si/W56v/ Page URL
https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://simaterial.si/W56v HTTP 301
https://simaterial.si/W56v/

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response simaterial.si/W56v/ Redirect Chain https://simaterial.si/W56v https://simaterial.si/W56v/	201 B 247 B	100ms 100ms	Document text/html	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Full URL https://simaterial.si/W56v/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `3d1bec7d391fbba5c9779bebd7fa4a1a1d492c149628874e9f75adf500235b62` Request headers :method GET :authority simaterial.si :scheme https :path /W56v/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Wed, 02 Sep 2020 19:50:52 GMT server Apache mod_bwlimited/1.4 content-length 201 content-type text/html; charset=UTF-8 Redirect headers status 301 date Wed, 02 Sep 2020 19:50:52 GMT server Apache mod_bwlimited/1.4 location https://simaterial.si/W56v/ content-length 235 content-type text/html; charset=iso-8859-1
GET H2	200	Primary Request / Show response simaterial.si/W56v/home/	8 KB 8 KB	82ms 81ms	Document text/html	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Full URL https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Requested by Host: simaterial.si URL: https://simaterial.si/W56v/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `a7f66a2444166037c83d63e8094b50af923eb9947851203c1aad53c49cb649cc` Request headers :method GET :authority simaterial.si :scheme https :path /W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://simaterial.si/W56v/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://simaterial.si/W56v/ Response headers status 200 date Wed, 02 Sep 2020 19:50:52 GMT server Apache mod_bwlimited/1.4 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=f813193690f4654f08c781c607d8d78e; path=/ content-length 7916 content-type text/html; charset=UTF-8
GET H2	200	rui-core.min.css simaterial.si/W56v/home/root/	69 KB 70 KB	95ms 93ms	Stylesheet text/css	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Full URL https://simaterial.si/W56v/home/root/rui-core.min.css Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `ae7201b3cbcdee4d90a5ac451789bf02d4095d08207aad62be33c2e1ea07991e` Request headers Referer https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:50:52 GMT last-modified Fri, 21 Aug 2020 19:44:12 GMT server Apache mod_bwlimited/1.4 etag "5782f4a-11538-5ad6876081b00" content-type text/css status 200 accept-ranges bytes content-length 70968
GET H2	200	rui-forms-all.min.css simaterial.si/W56v/home/root/	14 KB 15 KB	94ms 92ms	Stylesheet text/css	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Full URL https://simaterial.si/W56v/home/root/rui-forms-all.min.css Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `9fc58f0089d1f9b5bbf896d7c345c7f2880b6000f34acfc518c8fcd580600c8a` Request headers Referer https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:50:52 GMT last-modified Fri, 21 Aug 2020 19:44:12 GMT server Apache mod_bwlimited/1.4 etag "5782f4f-39fe-5ad6876081b00" content-type text/css status 200 accept-ranges bytes content-length 14846
GET H2	200	auth-login.css simaterial.si/W56v/home/root/	142 KB 143 KB	54ms 52ms	Stylesheet text/css	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Full URL https://simaterial.si/W56v/home/root/auth-login.css Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `3af11ecc276c43a57fd031e2377a4e2f027c3dc17b36af4abb19ccd2284994ef` Request headers Referer https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:50:52 GMT last-modified Tue, 01 Sep 2020 19:28:22 GMT server Apache mod_bwlimited/1.4 etag "5782f46-23927-5ae4585a96180" content-type text/css status 200 accept-ranges bytes content-length 145703
GET H2	200	loop.png simaterial.si/W56v/FUNC/	26 KB 27 KB	57ms 56ms	Image image/png	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Show image Full URL https://simaterial.si/W56v/FUNC/loop.png Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `9fc1596deb549cbcf4772ed470bd01e461a625525ad632bf394e2401000f50e7` Request headers Referer https://simaterial.si/W56v/home/?sslchannel=true&sessionid=DG3DukesaLF6J7wQSnJTGhc6x8Q6q33iZnEGw5Zu7cWt3FndkUSP8vy0R8paUgWYSVYLAyT261iiIEyM User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:50:52 GMT last-modified Thu, 24 Oct 2019 14:12:14 GMT server Apache mod_bwlimited/1.4 etag "57a3b8a-69be-595a89ec04b80" content-type image/png status 200 accept-ranges bytes content-length 27070
GET H2	200	0b.jpg simaterial.si/W56v/home/root/	118 KB 119 KB	53ms 53ms	Image image/jpeg	217.174.149.3 TELEPOINT
General Check archive.org Show headers Download Go to Show image Full URL https://simaterial.si/W56v/home/root/0b.jpg Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/root/auth-login.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.174.149.3 , Bulgaria, ASN31083 (TELEPOINT, BG), Reverse DNS peace.vivawebhost.com Software Apache mod_bwlimited/1.4 / Resource Hash `b50adbf5b4dc387ad81d2773f1b03692c682eefbf67dd5c07f8bf488e0c63b0b` Request headers Referer https://simaterial.si/W56v/home/root/auth-login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:50:53 GMT last-modified Tue, 25 Aug 2020 22:14:40 GMT server Apache mod_bwlimited/1.4 etag "5782f52-1d6a3-5adbb0781f400" content-type image/jpeg status 200 accept-ranges bytes content-length 120483
GET H2	200	museo-sans-500-v1.woff s1.rui.au.reastatic.net/rui-static/font/	15 KB 15 KB	7ms 7ms	Font application/font-woff	2600:9000:2057:e400:1e:c291:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s1.rui.au.reastatic.net/rui-static/font/museo-sans-500-v1.woff Requested by Host: simaterial.si URL: https://simaterial.si/W56v/home/root/rui-core.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:e400:1e:c291:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `7e5491716d4bab50405712cc09b025aa10456a119e206e2677f8a30358846703` Request headers Origin https://simaterial.si Referer https://simaterial.si/W56v/home/root/rui-core.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Sep 2020 19:49:53 GMT via 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront) age 63 x-cache Hit from cloudfront status 200 content-length 15420 last-modified Thu, 06 Feb 2014 04:47:57 GMT server AmazonS3 etag "beecaad8180ee6ab9625fbe8aa2d6d18" vary Origin access-control-allow-methods GET, HEAD x-amz-version-id null access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA6-C1 accept-ranges bytes content-type application/font-woff x-amz-cf-id 3rO7PJPc3wqAgk64_kcgPh2J2opAO7ff6nuEdkH1B7YP5qZUk4Whkw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			simaterial.si/	1969-12-31 23:59:59	Name: PHPSESSID Value: f813193690f4654f08c781c607d8d78e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s1.rui.au.reastatic.net
simaterial.si
217.174.149.3
2600:9000:2057:e400:1e:c291:240:93a1
3af11ecc276c43a57fd031e2377a4e2f027c3dc17b36af4abb19ccd2284994ef
3d1bec7d391fbba5c9779bebd7fa4a1a1d492c149628874e9f75adf500235b62
7e5491716d4bab50405712cc09b025aa10456a119e206e2677f8a30358846703
9fc1596deb549cbcf4772ed470bd01e461a625525ad632bf394e2401000f50e7
9fc58f0089d1f9b5bbf896d7c345c7f2880b6000f34acfc518c8fcd580600c8a
a7f66a2444166037c83d63e8094b50af923eb9947851203c1aad53c49cb649cc
ae7201b3cbcdee4d90a5ac451789bf02d4095d08207aad62be33c2e1ea07991e
b50adbf5b4dc387ad81d2773f1b03692c682eefbf67dd5c07f8bf488e0c63b0b

simaterial.si Open in urlscan Pro 217.174.149.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

397 kBTransfer

393 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

simaterial.si Open in urlscan Pro
217.174.149.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

397 kB
Transfer

393 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!