opengovernment.ke
Open in
urlscan Pro
199.79.62.78
Malicious Activity!
Public Scan
URL:
https://opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/
Submission: On December 03 via manual from IN — Scanned from DE
Submission: On December 03 via manual from IN — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 4 HTTP transactions.
The main IP is 199.79.62.78, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is opengovernment.ke.
TLS certificate: Issued by R3 on November 3rd 2022. Valid for: 3 months.
This is the only time opengovernment.ke was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 3rd 2022. Valid for: 3 months.
This is the only time opengovernment.ke was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 | 199.79.62.78 199.79.62.78 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 4 | 1 |
4
199.79.62.78
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 199.79.62-78.publicdomainregistry.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 199.79.62-78.publicdomainregistry.com
| opengovernment.ke |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
opengovernment.ke
opengovernment.ke |
800 KB |
| 4 | 1 |
| Domain | Requested by | |
|---|---|---|
| 4 | opengovernment.ke |
opengovernment.ke
|
| 4 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.opengovernment.ke R3 |
2022-11-03 - 2023-02-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/
Frame ID: B64F5540BF15AF21A8EB4CC09EBD9627
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lbpiaccess.jpg
opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/lb_files/img/ |
448 KB 452 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
professor.jpg
opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/lb_files/img/ |
331 KB 333 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bancnet.png
opengovernment.ke/wp-includes/rest-api/endpoints/lAccess/lb_files/img/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
opengovernment.ke
199.79.62.78
01d8f3086ff396de0c40a6199ab65a11f71ab098141d21d1116c18266bcfa7ff
31add8e4ea20a25a8cf505a2209bd79066c9df8ff08e8298ea245f9f7091a2c5
9b0aa67c227ee68e8b9b6b0ab989100e8682771458f0bc92d5e79e9e34ff6f2e
ee32bf35dba13bfb99f9584e003697102939c9cade5a7cb6241d900a3869a3f7