urlscan.io logo urlscan.io
SecurityTrails logo

ibn.gov.np Open in urlscan Pro
50.87.153.144  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Submission: On July 12 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 50.87.153.144, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is ibn.gov.np.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 15th 2018. Valid for: 3 months.
This is the only time ibn.gov.np was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: University of Iowa (Education)

Domain & IP information

IP Address AS Autonomous System
1 50.87.153.144 46606 (UNIFIEDLA...)
5 2620:0:e50:68... 3676 (UIOWA-AS)
6 2
Apex Domain
Subdomains		 Transfer
5 uiowa.edu
idp.uiowa.edu
270 KB
1 ibn.gov.np
ibn.gov.np
2 KB
6 2
Domain Requested by
5 idp.uiowa.edu ibn.gov.np
idp.uiowa.edu
1 ibn.gov.np
6 2

This site contains links to these domains. Also see Links.

Domain
apps.its.uiowa.edu
its.uiowa.edu
Subject Issuer Validity Valid
ibn.gov.np
Let's Encrypt Authority X3		 2018-06-15 -
2018-09-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Frame ID: A262C5AADDFC6C571F905AB879C6DFD3
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

6
Requests

17 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

272 kB
Transfer

272 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request uiowa.edu.html
ibn.gov.np/images/serial/modules/1/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.87.153.144 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
50-87-153-144.unifiedlayer.com
Software
nginx/1.14.0 /
Resource Hash
4ff711c1051dd91bc3ce7523290eb3225ce46816db0883babcfde893235564eb

Request headers

Host
ibn.gov.np
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
A262C5AADDFC6C571F905AB879C6DFD3

Response headers

Server
nginx/1.14.0
Date
Thu, 12 Jul 2018 13:36:32 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Wed, 11 Jul 2018 18:34:00 GMT
Content-Encoding
gzip
bootstrap.min.css
idp.uiowa.edu/idp/bs-3.3.6/ 		118 KB
119 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://idp.uiowa.edu/idp/bs-3.3.6/bootstrap.min.css
Requested by
Host: ibn.gov.np
URL: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Protocol
HTTP/1.1
Server
2620:0:e50:6813::52 , United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS
Software
/
Resource Hash
880de7665b1aaa840303313deca3352af257d55aed4584d5e17f0fbffe0fde01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 12 Jul 2018 13:36:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 09 Jul 2018 22:20:44 GMT
ETag
W/"121265-1531174844000"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css;charset=UTF-8
Accept-Ranges
bytes
Content-Length
121265
X-XSS-Protection
1; mode=block
simple-login.css
idp.uiowa.edu/idp/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://idp.uiowa.edu/idp/css/simple-login.css
Requested by
Host: ibn.gov.np
URL: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Protocol
HTTP/1.1
Server
2620:0:e50:6813::52 , United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS
Software
/
Resource Hash
be0069626586d3d9cc2505323af81e2474cf086c22582eeffa8234f7de034ee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 12 Jul 2018 13:36:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 09 Jul 2018 22:20:44 GMT
ETag
W/"2944-1531174844000"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css;charset=UTF-8
Accept-Ranges
bytes
Content-Length
2944
X-XSS-Protection
1; mode=block
jquery-1.12.4.min.js
idp.uiowa.edu/idp/scripts/ 		95 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://idp.uiowa.edu/idp/scripts/jquery-1.12.4.min.js
Requested by
Host: ibn.gov.np
URL: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Protocol
HTTP/1.1
Server
2620:0:e50:6813::52 , United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS
Software
/
Resource Hash
27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 12 Jul 2018 13:36:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 09 Jul 2018 22:20:44 GMT
ETag
W/"97168-1531174844000"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript;charset=UTF-8
Accept-Ranges
bytes
Content-Length
97168
X-XSS-Protection
1; mode=block
bootstrap.min.js
idp.uiowa.edu/idp/bs-3.3.6/ 		36 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://idp.uiowa.edu/idp/bs-3.3.6/bootstrap.min.js
Requested by
Host: ibn.gov.np
URL: https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
Protocol
HTTP/1.1
Server
2620:0:e50:6813::52 , United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS
Software
/
Resource Hash
5a4a5359110a773bd154da94c48ffd6a6233a29dfd5a9314555f5ae6c3e47459
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ibn.gov.np/images/serial/modules/1/uiowa.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 12 Jul 2018 13:36:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 09 Jul 2018 22:20:44 GMT
ETag
W/"36874-1531174844000"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript;charset=UTF-8
Accept-Ranges
bytes
Content-Length
36874
X-XSS-Protection
1; mode=block
uiowa-dome.svg
idp.uiowa.edu/idp/images/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idp.uiowa.edu/idp/images/uiowa-dome.svg
Requested by
Host: idp.uiowa.edu
URL: https://idp.uiowa.edu/idp/scripts/jquery-1.12.4.min.js
Protocol
HTTP/1.1
Server
2620:0:e50:6813::52 , United States, ASN3676 (UIOWA-AS - University of Iowa, US),
Reverse DNS
Software
/
Resource Hash
ac840b5f216d0062b5ca7c03371e887197eafdf75f0b48a6799bb08e24ceccdc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://idp.uiowa.edu/idp/css/simple-login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 12 Jul 2018 13:36:33 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 09 Jul 2018 22:20:44 GMT
ETag
W/"16547-1531174844000"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml;charset=UTF-8
Accept-Ranges
bytes
Content-Length
16547
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: University of Iowa (Education)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| removeIowaUPNSuffix function| $ function| jQuery object| jQuery112409905499681775911 object| antiClickjack

0 Cookies