santa.jujapreparatory.ac.ke Open in urlscan Pro
169.239.252.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://clicklo.life/4crkp
Effective URL:
https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81M...
Submission: On December 20 via manual (December 20th 2022, 9:33:46 pm UTC) from FR — Scanned from FR

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 169.239.252.78, located in Kenya and belongs to NODE-AFRICA, KE. The main domain is santa.jujapreparatory.ac.ke.
TLS certificate: Issued by R3 on December 8th 2022. Valid for: 3 months.

This is the only time santa.jujapreparatory.ac.ke was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Assurance Maladie (Healthcare)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3034::ac43:bf4a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 6	169.239.252.78 169.239.252.78	327997 (NODE-AFRICA) (NODE-AFRICA)
4	2

1 2606:4700:3034::ac43:bf4a (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

clicklo.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 169.239.252.78 (Kenya) 2 redirects

ASN327997 (NODE-AFRICA, KE)
PTR: host-2.nodeafrica.com

santa.jujapreparatory.ac.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	jujapreparatory.ac.ke 2 redirects santa.jujapreparatory.ac.ke	569 KB
1	clicklo.life 1 redirects clicklo.life	2 KB
4	2

	Domain	Requested by
6	santa.jujapreparatory.ac.ke	2 redirects santa.jujapreparatory.ac.ke
1	clicklo.life	1 redirects
4	2

This site contains no links.

Subject Issuer	Validity	Valid
www.santa.jujapreparatory.ac.ke R3	`2022-12-08` - `2023-03-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU=
Frame ID: A0EEBD2D2189DE248A35A4654C1294FD
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

remboursement | Ameli

Page URL History Show full URLs

http://clicklo.life/4crkp HTTP 301
https://santa.jujapreparatory.ac.ke/ameli/home/AML HTTP 301
https://santa.jujapreparatory.ac.ke/ameli/home/AML/ HTTP 302
https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExK... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

658 kB
Transfer

806 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://clicklo.life/4crkp HTTP 301
https://santa.jujapreparatory.ac.ke/ameli/home/AML HTTP 301
https://santa.jujapreparatory.ac.ke/ameli/home/AML/ HTTP 302
https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request AML-infos.php Show response santa.jujapreparatory.ac.ke/ameli/home/AML/ Redirect Chain http://clicklo.life/4crkp https://santa.jujapreparatory.ac.ke/ameli/home/AML https://santa.jujapreparatory.ac.ke/ameli/home/AML/ https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2...	342 KB 342 KB	661ms 660ms	Document text/html	169.239.252.78 NODE-AFRICA
General Check archive.org Show headers Download Go to Full URL https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE), Reverse DNS host-2.nodeafrica.com Software Apache / Resource Hash `985cb9451a48390213ba0ef98940bdb771a9fb663a226ceceb0c521f761c6ead` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 20 Dec 2022 21:33:39 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 20 Dec 2022 21:33:38 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked location AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU=
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a4378f8d6faa5e999d889eafd5cc9629baf351c252910c28d667fc942e86c907` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	120 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3eb3265dddf3a7527147670249ad8a956870e0fa4c3dfaf99a3b4d737ca56c8` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	14 KB 14 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b` Request headers Referer Origin https://santa.jujapreparatory.ac.ke accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	75 KB 75 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe` Request headers Referer Origin https://santa.jujapreparatory.ac.ke accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	23 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `feb2c90181ca199fe02f5f33f99d418953958a514fd8952f771ffe8210808e20` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	jquery.min.js Show response santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/	86 KB 86 KB	194ms 194ms	Script application/javascript	169.239.252.78 NODE-AFRICA
General Check archive.org Show headers Download Go to Full URL https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/jquery.min.js Requested by Host: santa.jujapreparatory.ac.ke URL: https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE), Reverse DNS host-2.nodeafrica.com Software Apache / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers accept-language fr-FR,fr;q=0.9 Referer https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Date Tue, 20 Dec 2022 21:33:41 GMT Last-Modified Mon, 05 Jul 2021 20:29:30 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 88145
GET H/1.1	200 OK	imask.min.js Show response santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/	45 KB 45 KB	190ms 189ms	Script application/javascript	169.239.252.78 NODE-AFRICA
General Check archive.org Show headers Download Go to Full URL https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/imask.min.js Requested by Host: santa.jujapreparatory.ac.ke URL: https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE), Reverse DNS host-2.nodeafrica.com Software Apache / Resource Hash `8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d` Request headers accept-language fr-FR,fr;q=0.9 Referer https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Date Tue, 20 Dec 2022 21:33:41 GMT Last-Modified Mon, 05 Jul 2021 20:29:30 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 45591
GET H/1.1	200 OK	infos.js Show response santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/	95 KB 95 KB	387ms 193ms	Script application/javascript	169.239.252.78 NODE-AFRICA
General Check archive.org Show headers Download Go to Full URL https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML_files/infos.js Requested by Host: santa.jujapreparatory.ac.ke URL: https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 169.239.252.78 , Kenya, ASN327997 (NODE-AFRICA, KE), Reverse DNS host-2.nodeafrica.com Software Apache / Resource Hash `31d6c83c556571fbd4cbac36e0319c9d9b9d275fbe6c8156ce39bb4e878193f4` Request headers accept-language fr-FR,fr;q=0.9 Referer https://santa.jujapreparatory.ac.ke/ameli/home/AML/AML-infos.php?token=TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDExKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBNb2JpbGUgU2FmYXJpLzUzNy4zNjM3LjU5LjE2NC4xMDYyMDIyOkRlYzpUdWU= User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Date Tue, 20 Dec 2022 21:33:41 GMT Last-Modified Mon, 05 Jul 2021 20:29:30 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 96865

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Assurance Maladie (Healthcare)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			clicklo.life/	1970-01-20 08:19:39	Name: XSRF-TOKEN Value: eyJpdiI6IjdGcnVPQkhmc1JtR3FhWXp3Z0tGSHc9PSIsInZhbHVlIjoiRERZc3pxWU53OVwvZVZQamw2XC9ucHl5VU40NEJYQnpRRStKc3Y1Z3VhWXVqOVBFeExHYmsyOWZ6MFk4ZmZab0tCZklWZXRpdTR6RTJqbDczWXVtTTNvRUNtaE1FS0tMeXlncGwzaE1CZ0tSRGdTZHRWb09OSGVQMWRsYUdXZE1FUyIsIm1hYyI6IjBlMTA1YTYwMTFkNjViNTI5NTA2ZjBmNGVlMmJhNmRhODFjNTQ5ZTcyZGM1MmZkM2UyZjA1OTdhZGRiNDU4NmYifQ%3D%3D
			clicklo.life/	1970-01-20 08:19:39	Name: phpshort_session Value: eyJpdiI6Ik16UVZZbEN1RWx0ZExkeDN5WlZyWVE9PSIsInZhbHVlIjoiVkJCU1VOYktYVllhb1BRMVZpNjg3V0tcL251ejgrdExhOEd2OWlGUGhXMDh6V1JPdnE5dHNxNHdPWVVCcWgrRlhEZnhUSnhRMkZiakJiT0h1Wml3UFBwRFVNc1VSMXBnUGRyRDJMZWpFMnFvSkFuQmJldzV2MHlmNmpqdEk5NnppIiwibWFjIjoiMzdiZWFiNTc1ODY0OGVjYTkwNDRiYTBkYTZmM2Y1MjkzNzk0MzY2ZGQ2ZjU0M2NmYmE5ZmY3ZDNiMjk4MjFjZSJ9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

clicklo.life
santa.jujapreparatory.ac.ke
169.239.252.78
2606:4700:3034::ac43:bf4a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
31d6c83c556571fbd4cbac36e0319c9d9b9d275fbe6c8156ce39bb4e878193f4
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
985cb9451a48390213ba0ef98940bdb771a9fb663a226ceceb0c521f761c6ead
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4378f8d6faa5e999d889eafd5cc9629baf351c252910c28d667fc942e86c907
c3eb3265dddf3a7527147670249ad8a956870e0fa4c3dfaf99a3b4d737ca56c8
feb2c90181ca199fe02f5f33f99d418953958a514fd8952f771ffe8210808e20

santa.jujapreparatory.ac.ke Open in urlscan Pro 169.239.252.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

658 kBTransfer

806 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

Indicators

santa.jujapreparatory.ac.ke Open in urlscan Pro
169.239.252.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

658 kB
Transfer

806 kB
Size

2
Cookies

4 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!