ispc.co.ug Open in urlscan Pro
192.185.14.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ispc.co.ug/irs/cc-info.php
Submission: On May 03 via automatic, source openphish (May 3rd 2019, 7:10:47 pm UTC)

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 192.185.14.200, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is ispc.co.ug.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 11th 2019. Valid for: 3 months.

This is the only time ispc.co.ug was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

	IP Address	AS Autonomous System
8	192.185.14.200 192.185.14.200	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
9	3

8 192.185.14.200 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: ns8243.websitewelcome.com

ispc.co.ug	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ispc.co.ug ispc.co.ug	60 KB
1	googleapis.com ajax.googleapis.com	33 KB
9	2

	Domain	Requested by
8	ispc.co.ug	ispc.co.ug ajax.googleapis.com
1	ajax.googleapis.com	ispc.co.ug
9	2

This site contains links to these domains. Also see Links.

Domain
directpay.irs.gov

Subject Issuer	Validity	Valid
ispc.co.ug Let's Encrypt Authority X3	`2019-04-11` - `2019-07-10`	3 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-04-16` - `2019-07-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ispc.co.ug/irs/cc-info.php
Frame ID: 9FD31A6F0F59B91042F13A133C684377
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+foundation[^>"]+css/i
html /<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

94 kB
Transfer

222 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://directpay.irs.gov/directpay/payment?execution=e2s2#content
Title: Skip Navigation

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request cc-info.php Show response
ispc.co.ug/irs/ 11 KB
4 KB 2594ms
2589ms Document
text/html 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: 1e1881661554887807384205743963a6f30691e1e25e219b2f4a2447b4ba6c3e

Request headers

:method: GET
:authority: ispc.co.ug
:scheme: https
:path: /irs/cc-info.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: nginx/1.14.1
date: Fri, 03 May 2019 19:10:24 GMT
content-type: text/html
content-encoding: gzip

GET
H2 200 foundation6.min.css
ispc.co.ug/irs/src/ 41 KB
11 KB 305ms
298ms Stylesheet
text/css 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://ispc.co.ug/irs/src/foundation6.min.css
Requested by: Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: 09c349050558ce0eb84f8f6f605ee4c027e4c921a16f028de1b82fafd90bc0c8

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 03 May 2019 19:10:26 GMT
content-encoding: gzip
last-modified: Fri, 03 May 2019 13:31:23 GMT
server: nginx/1.14.1
content-type: text/css

GET
H2 200 all_directpay_7.11.6.css
ispc.co.ug/irs/src/ 40 KB
11 KB 306ms
301ms Stylesheet
text/css 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://ispc.co.ug/irs/src/all_directpay_7.11.6.css
Requested by: Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: 815633360ba59e73859274a0a9997d81703033cc91c0ef0710975b6082c0af94

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 03 May 2019 19:10:26 GMT
content-encoding: gzip
last-modified: Fri, 03 May 2019 13:31:23 GMT
server: nginx/1.14.1
content-type: text/css

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 95 KB
33 KB 15ms
10ms Script
text/javascript 2a00:1450:4001:816::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 09 Mar 2019 04:35:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4804506
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 33951
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Mar 2020 04:35:20 GMT

GET
H2 200 irs_logo.svg
ispc.co.ug/irs/src/ 7 KB
7 KB 347ms
342ms Image
image/svg+xml 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ispc.co.ug/irs/src/irs_logo.svg
Requested by: Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: 59481b296926f37d85b305c82875a411f50b19f597f8e9eba5f8fbd9443d013d

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 03 May 2019 19:10:26 GMT
last-modified: Fri, 03 May 2019 13:31:23 GMT
server: nginx/1.14.1
accept-ranges: bytes
content-length: 7534
content-type: image/svg+xml

GET
H2 200 icon_help.svg
ispc.co.ug/irs/src/ 1 KB
1 KB 422ms
418ms Image
image/svg+xml 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ispc.co.ug/irs/src/icon_help.svg
Requested by: Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: c2049226a0b4878aa93c570c05d232ff65ae25f1f4b677c28a8febe20ef4f85a

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 03 May 2019 19:10:26 GMT
last-modified: Fri, 03 May 2019 13:31:23 GMT
server: nginx/1.14.1
accept-ranges: bytes
content-length: 1196
content-type: image/svg+xml

GET
H2 200 spinner_sm_030415.gif
ispc.co.ug/irs/src/ 3 KB
3 KB 311ms
310ms Image
image/gif 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ispc.co.ug/irs/src/spinner_sm_030415.gif
Requested by: Host: ispc.co.ug
URL: https://ispc.co.ug/irs/cc-info.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: e6128a3c98719237d52c85ca4ba81aea1400d356b9829839e53e84286741c915

Request headers

Referer: https://ispc.co.ug/irs/cc-info.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 03 May 2019 19:10:27 GMT
last-modified: Fri, 03 May 2019 13:31:23 GMT
server: nginx/1.14.1
accept-ranges: bytes
content-length: 3428
content-type: image/gif

GET
H2 404 bgBody.png
ispc.co.ug/irs/img/ 12 KB
12 KB 339ms
337ms Image
text/html 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ispc.co.ug/irs/img/bgBody.png
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482

Request headers

Referer: https://ispc.co.ug/irs/src/all_directpay_7.11.6.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Fri, 03 May 2019 19:10:27 GMT
content-encoding: gzip
last-modified: Tue, 23 Apr 2019 05:53:24 GMT
server: nginx/1.14.1
content-type: text/html

GET
DATA 200
OK truncated
/ 176 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3fda9a0570cbcbddcf14c2d8b8a34c0a2c9f0361aa83dd44cbf1345b2aaade6c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 404 arrow_right.svg
ispc.co.ug/irs/img/ 12 KB
12 KB 273ms
271ms Image
text/html 192.185.14.200
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ispc.co.ug/irs/img/arrow_right.svg
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.185.14.200 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns8243.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482

Request headers

Referer: https://ispc.co.ug/irs/src/all_directpay_7.11.6.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 404
date: Fri, 03 May 2019 19:10:27 GMT
content-encoding: gzip
last-modified: Tue, 23 Apr 2019 05:53:24 GMT
server: nginx/1.14.1
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
ispc.co.ug
192.185.14.200
2a00:1450:4001:816::200a
09c349050558ce0eb84f8f6f605ee4c027e4c921a16f028de1b82fafd90bc0c8
1e1881661554887807384205743963a6f30691e1e25e219b2f4a2447b4ba6c3e
3fda9a0570cbcbddcf14c2d8b8a34c0a2c9f0361aa83dd44cbf1345b2aaade6c
59481b296926f37d85b305c82875a411f50b19f597f8e9eba5f8fbd9443d013d
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
815633360ba59e73859274a0a9997d81703033cc91c0ef0710975b6082c0af94
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
c2049226a0b4878aa93c570c05d232ff65ae25f1f4b677c28a8febe20ef4f85a
e6128a3c98719237d52c85ca4ba81aea1400d356b9829839e53e84286741c915

ispc.co.ug Open in urlscan Pro 192.185.14.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

94 kBTransfer

222 kBSize

0 Cookies

1 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

ispc.co.ug Open in urlscan Pro
192.185.14.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

94 kB
Transfer

222 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!