UWS Cyber Breach

Prof Bill Buchanan OBE FRSE
3 min readJul 7, 2023

If you go to the University of the West of Scotland’s Web site at the current time, you get:

At first sight, this could to be a standard domain take-over, and where the HTTPs certificate is valid:

But, when we do a lookup, we see that the domain name has been parked at 3dqkz9i.x.incapdns.net:

 % nslookup www.uws.ac.uk
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
www.uws.ac.uk canonical name = 3dqkz9i.x.incapdns.net.
Name: 3dqkz9i.x.incapdns.net
Address: 107.154.112.136

Overall, Incapsula is a cloud-based hosting company — it may be that the university is using the cloud provider for their hosting. Generally, it is not recommended to actually log into the site (even though the password hint is ‘Google’), as the main page seems to have a redirected site on the redirected site:

--

--

Prof Bill Buchanan OBE FRSE

Professor of Cryptography. Serial innovator. Believer in fairness, justice & freedom. Based in Edinburgh. Old World Breaker. New World Creator. Building trust.