elearning.ncdc.go.ug

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 154.72.194.117, located in Kampala, Uganda and belongs to NITA, UG. The main domain is elearning.ncdc.go.ug.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 17th 2021. Valid for: 3 months.

This is the only time elearning.ncdc.go.ug was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	103.227.252.195 103.227.252.195	59279 (IDNIC-RMI...) (IDNIC-RMI-AS-ID PT Raja Mitra Informatika)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
3	154.72.194.117 154.72.194.117	327724 (NITA) (NITA)
6	3

2 103.227.252.195 (Jakarta, Indonesia)

ASN59279 (IDNIC-RMI-AS-ID PT Raja Mitra Informatika, ID)
PTR: server-iix.hostingmedan.com

uth.nn4.pa-fakfak.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 154.72.194.117 (Kampala, Uganda)

ASN327724 (NITA, UG)
PTR: wh5.nita.go.ug

elearning.ncdc.go.ug	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ncdc.go.ug elearning.ncdc.go.ug	79 KB
2	pa-fakfak.go.id uth.nn4.pa-fakfak.go.id	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 584	83 KB
6	3

	Domain	Requested by
3	elearning.ncdc.go.ug	uth.nn4.pa-fakfak.go.id elearning.ncdc.go.ug
2	uth.nn4.pa-fakfak.go.id	code.jquery.com
1	code.jquery.com	uth.nn4.pa-fakfak.go.id
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
elearning.ncdc.go.ug cPanel, Inc. Certification Authority	`2021-12-17` - `2022-03-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm
Frame ID: E67E626ED90680B7DEB83879EA58BED8
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Purchase Order.xlsx

Page URL History Show full URLs

http://uth.nn4.pa-fakfak.go.id///mpmc Page URL
https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

163 kB
Transfer

360 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://uth.nn4.pa-fakfak.go.id///mpmc Page URL
https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK mpmc Show response
uth.nn4.pa-fakfak.go.id/// 955 B
1 KB 656ms
184ms Document
text/html 103.227.252.195
IDNIC-RMI-AS-ID P...

General

Check archive.org

Show headers Download Go to

Full URL: http://uth.nn4.pa-fakfak.go.id///mpmc
Protocol: HTTP/1.1
Server: 103.227.252.195 Jakarta, Indonesia, ASN59279 (IDNIC-RMI-AS-ID PT Raja Mitra Informatika, ID),
Reverse DNS: server-iix.hostingmedan.com
Software: Apache /
Resource Hash: cc529125d4bfb3ff350a8a4f50b43c715f19c9370be339d67e8250c94b8824fa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Thu, 20 Jan 2022 16:04:16 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 jquery-3.5.1.js Show response
code.jquery.com/ 281 KB
83 KB 307ms
18ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.js
Requested by: Host: uth.nn4.pa-fakfak.go.id
URL: http://uth.nn4.pa-fakfak.go.id///mpmc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Referer: http://uth.nn4.pa-fakfak.go.id/
Origin: http://uth.nn4.pa-fakfak.go.id
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:04:16 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-4638e"
vary: Accept-Encoding
x-hw: 1642694656.dop033.ml1.t,1642694656.cds208.ml1.hn,1642694656.cds015.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 84374

POST
H/1.1 200
OK api.php
uth.nn4.pa-fakfak.go.id/wild/ 94 B
300 B 185ms
185ms XHR
text/html 103.227.252.195
IDNIC-RMI-AS-ID P...

General

Check archive.org

Show headers Download Go to

Full URL: http://uth.nn4.pa-fakfak.go.id/wild/api.php
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.js
Protocol: HTTP/1.1
Server: 103.227.252.195 Jakarta, Indonesia, ASN59279 (IDNIC-RMI-AS-ID PT Raja Mitra Informatika, ID),
Reverse DNS: server-iix.hostingmedan.com
Software: Apache /
Resource Hash

Request headers

Accept: */*
Referer: http://uth.nn4.pa-fakfak.go.id///mpmc
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Thu, 20 Jan 2022 16:04:16 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 Primary Request ogm Show response
elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ 979 B
1 KB 1920ms
563ms Document
text/html 154.72.194.117
NITA

General

Check archive.org

Show headers Download Go to

Full URL: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm
Requested by: Host: uth.nn4.pa-fakfak.go.id
URL: http://uth.nn4.pa-fakfak.go.id///mpmc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 154.72.194.117 Kampala, Uganda, ASN327724 (NITA, UG),
Reverse DNS: wh5.nita.go.ug
Software: Apache /
Resource Hash: 1136c9a45ab2405d21b3a4cd6d716333db1e7b68e5d6a7b53db89426ba38ae38

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://uth.nn4.pa-fakfak.go.id/

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 20 Jan 2022 16:04:17 GMT
server: Apache

GET
H2 200 loading.gif
elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ 4 KB
4 KB 183ms
183ms Image
image/gif 154.72.194.117
NITA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/loading.gif

Requested by

Host: elearning.ncdc.go.ug
URL: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

154.72.194.117 Kampala, Uganda, ASN327724 (NITA, UG),

Reverse DNS

wh5.nita.go.ug

Software

Apache /

Resource Hash

523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:04:17 GMT
x-content-type-options: nosniff
last-modified: Fri, 29 Nov 2019 02:21:28 GMT
server: Apache
content-type: image/gif
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 3717
expires: Thu, 03 Feb 2022 16:04:17 GMT

GET
H2 200 xls.png
elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ 73 KB
74 KB 183ms
182ms Image
image/png 154.72.194.117
NITA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/xls.png

Requested by

Host: elearning.ncdc.go.ug
URL: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

154.72.194.117 Kampala, Uganda, ASN327724 (NITA, UG),

Reverse DNS

wh5.nita.go.ug

Software

Apache /

Resource Hash

bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://elearning.ncdc.go.ug/cgibin/ionos/controller/IK/ogm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:04:17 GMT
x-content-type-options: nosniff
last-modified: Fri, 29 Nov 2019 02:21:38 GMT
server: Apache
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 74994
expires: Thu, 03 Feb 2022 16:04:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
elearning.ncdc.go.ug
uth.nn4.pa-fakfak.go.id
103.227.252.195
154.72.194.117
2001:4de0:ac18::1:a:1b
1136c9a45ab2405d21b3a4cd6d716333db1e7b68e5d6a7b53db89426ba38ae38
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
cc529125d4bfb3ff350a8a4f50b43c715f19c9370be339d67e8250c94b8824fa

elearning.ncdc.go.ug Open in urlscan Pro 154.72.194.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

67 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

163 kBTransfer

360 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

elearning.ncdc.go.ug Open in urlscan Pro
154.72.194.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

163 kB
Transfer

360 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!