rif.mak.ac.ug Open in urlscan Pro
137.63.144.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/
Effective URL:
https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php
Submission: On June 18 via automatic, source openphish (June 18th 2022, 1:11:36 am UTC) — Scanned from DE

Summary HTTP 22 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 137.63.144.2, located in Kolokolo, Uganda and belongs to RENU, UG. The main domain is rif.mak.ac.ug.
TLS certificate: Issued by R3 on June 8th 2022. Valid for: 3 months.

This is the only time rif.mak.ac.ug was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: MKB Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 23	137.63.144.2 137.63.144.2		327687 (RENU) (RENU)
22	2

23 137.63.144.2 (Kolokolo, Uganda) 1 redirects

ASN327687 (RENU, UG)

rif.mak.ac.ug	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	mak.ac.ug 1 redirects rif.mak.ac.ug	429 KB
22	1

	Domain	Requested by
23	rif.mak.ac.ug	1 redirects rif.mak.ac.ug
22	1

This site contains links to these domains. Also see Links.

Domain
www.mkb.hu

Subject Issuer	Validity	Valid
dntconsults.com R3	`2022-06-08` - `2022-09-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php
Frame ID: D15E10555A63EA1DDB00770E2728B5E5
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MKB NetBANKár

Page URL History Show full URLs

https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/ HTTP 302
https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

428 kB
Transfer

423 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mkb.hu/elerhetosegek/netbankar_online_igenylese/index.html
Title: Új NetBANKár szerződés igénylése

Search URL Search Domain Scan URL

URL: http://www.mkb.hu/friss_informaciok/az_onok_biztonsagaert/index
Title: Biztonság

Search URL Search Domain Scan URL

URL: http://www.mkb.hu/friss_informaciok/kondiciok/index.html
Title: Kondíciók

Search URL Search Domain Scan URL

URL: https://www.mkb.hu/sw/static/file/MKB_NetBANKar_TechnikaiFeltetelek_FINAL_v2.pdf
Title: Támogatott böngészők

Search URL Search Domain Scan URL

URL: https://www.mkb.hu/sw/static/file/NetBANKar_kezikonyv.pdf
Title: Kézikönyv

Search URL Search Domain Scan URL

URL: http://www.mkb.hu/friss_informaciok/hirlevelek_regisztracio/index.html
Title: Hírlevél

Search URL Search Domain Scan URL

URL: https://www.mkb.hu/elerhetosegek
Title: Kapcsolat

Search URL Search Domain Scan URL

URL: https://www.mkb.hu/adatvedelmi-iranyelvek
Title: Adatvédelmi irányelvek

Search URL Search Domain Scan URL

URL: http://www.mkb.hu/az_mkb_bankrol/kozlemenyek/uzletszabalyzat/index.html
Title: Általános üzleti feltételek

Search URL Search Domain Scan URL

URL: https://www.mkb.hu/jogi-nyilatkozat
Title: Jogi nyilatkozat

Search URL Search Domain Scan URL

URL: http://www.mkb.hu/impresszum.html
Title: Impresszum

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/ HTTP 302
https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/ Redirect Chain https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/ https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php	30 KB 30 KB	202ms 202ms	Document text/html	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `c74c20f13ddf9791a019386b9fcd71569923c7a93b94558799c8d5436ea712c0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sat, 18 Jun 2022 01:11:30 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Sat, 18 Jun 2022 01:11:29 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache location login.php
GET H/1.1	200 OK	ext-all.css rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/	136 KB 136 KB	204ms 202ms	Stylesheet text/css	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/ext-all.css Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `435d4fecfdb1ca909e52db0129b8702df4d6d17881c0aec0b12bee1141e595b3` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:30 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "21efc-5deb334ce4980" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 139004
GET H/1.1	200 OK	login.css rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/	26 KB 26 KB	203ms 201ms	Stylesheet text/css	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `83711c47a9df5f6dee359da612cfc100ba333e679729d035a93a7f9d6084ca79` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:30 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "6742-5deb334ce4980" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 26434
GET H/1.1	200 OK	extending.css rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/	28 KB 28 KB	548ms 182ms	Stylesheet text/css	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/extending.css Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `3f2862eda199871f0da61515d5be5dc9dfb7b398ab8f7608e27aa4e95cff9573` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "6fbd-5deb334ce4980" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 28605
GET H/1.1	200 OK	sectigo.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	3 KB 3 KB	604ms 202ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/sectigo.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `a716acda7515ce9582f999f38e0f895f33c36421742057346f2a6b0eb5c55a99` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:08 GMT Server Apache ETag "b07-5deb334afc500" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2823
GET H/1.1	404 Not Found	s.gif rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/MKB%20NetBANK%C3%A1r_files/	8 KB 8 KB	1580ms 1174ms	Image text/html	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/MKB%20NetBANK%C3%A1r_files/s.gif Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `f7b1b48133535c98577c9d00f40c1c5e8298d129d46ee57d34430830dd659b30` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Pragma no-cache Date Sat, 18 Jun 2022 01:11:31 GMT X-TEC-API-VERSION v1 X-TEC-API-ROOT https://rif.mak.ac.ug/wp-json/tribe/events/v1/ Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Link <https://rif.mak.ac.ug/wp-json/>; rel="https://api.w.org/" X-TEC-API-ORIGIN https://rif.mak.ac.ug Keep-Alive timeout=5, max=100 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	body_bg.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	338 B 606 B	182ms 182ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/body_bg.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `48083b7e6c29ddd1a8fd0a7605f00a15411fd7ae88a5149c299baac0c96b64a9` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "152-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 338
GET H/1.1	200 OK	header_bg.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	1 KB 1 KB	203ms 202ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/header_bg.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `077876a7ddde7889f413e5c961e880ed5f37ad11c65b2a73c5285b207116ce2e` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "4d5-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1237
GET H/1.1	200 OK	mkb_logo.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	14 KB 14 KB	201ms 201ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/mkb_logo.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `4c09df8ccb8a573887d74240289ef9431301d56394661bc2674c76b6d963e737` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "3789-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 14217
GET H/1.1	200 OK	lang_icon.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	153 B 421 B	204ms 203ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/lang_icon.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `e7cf318d5a4b8afd177ce5207b52266b7e642a35594d8c935ad7bd9bd1aad68d` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:08 GMT Server Apache ETag "99-5deb334afc500" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 153
GET H/1.1	200 OK	header_spacer.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	117 B 385 B	611ms 204ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/header_spacer.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `59e5f9aea07e82c59a43c5092e213dcea58786f46fbf46dfe41111c0e8be4a20` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "75-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 117
GET H/1.1	200 OK	login_screen_bg0a07.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	167 KB 167 KB	361ms 182ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/login_screen_bg0a07.png?1311062936 Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/extending.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `dd46f81e7638f8294fcdc8d89252af6dd973f739f077d790669376c9923feee9` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/extending.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "29c1d-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 171037
GET DATA	200 OK	truncated /	411 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a39aa19a16a5c64c649bfd2dbcb9fb69584e13cfbbf98d7757b1dd471b670c92` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	login_bg0a07.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	201 B 468 B	384ms 201ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/login_bg0a07.png?1311062936 Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/extending.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `64b516793502dc4a50ecbb18ff8fb5e1586b6233cc7041f1dfd1adcf12ca4452` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/extending.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:08 GMT Server Apache ETag "c9-5deb334afc500" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 201
GET H/1.1	200 OK	mkb_btn_exit.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	1 KB 1 KB	387ms 203ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/mkb_btn_exit.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `5b3234b9a4f623013f4b33eb796cec65f86c6238efc38c4ff88aee4bef735740` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "462-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1122
GET H/1.1	200 OK	white_right_arrow.gif rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/	75 B 341 B	584ms 200ms	Image image/gif	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/white_right_arrow.gif Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `f506865926fee9c497987a79dd540c6d14459afea4e10e43f55a7bef8400ac40` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:08 GMT Server Apache ETag "4b-5deb334afc500" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 75
GET H/1.1	200 OK	demand_bg.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/	462 B 730 B	383ms 200ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/login/demand_bg.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `e6866f1edac994e412645a5c9632f7447fdec326598f295558407ca88f1c30d9` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "1ce-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 462
GET H/1.1	200 OK	mkb_footer_logo_1.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	2 KB 2 KB	586ms 202ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/mkb_footer_logo_1.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `f48134013f63f9f8ff227b2d3941875565cb94cb06a4b0318dbc635aa9a1cdac` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "71d-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 1821
GET H/1.1	200 OK	popupbg.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/popup/	185 B 452 B	203ms 203ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/popup/popupbg.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `68e9d1648afc69bb16ede55353ec2cacc08ca5089f66e34d73c0155cf16daeb5` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:31 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "b9-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 185
GET H/1.1	200 OK	extjs_mkb_tool-sprites.gif rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	3 KB 4 KB	201ms 201ms	Image image/gif	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/extjs_mkb_tool-sprites.gif Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `ccc24cbaabf3360a412affe30a8e81218ac41fc5e6630d321e79b260334e39ec` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:32 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "d82-5deb334ce4980" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 3458
GET H/1.1	200 OK	emark32x32.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/	1 KB 1 KB	202ms 202ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/emark32x32.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `1f2c141c91f6c24647e39709189c765b084388140f42ea7e0a192c5b7c3d5458` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:32 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "450-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=94 Content-Length 1104
GET H/1.1	200 OK	mkb_btn.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/	1 KB 1 KB	204ms 204ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/mkb_btn.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `b71cc473b53135f1f165994b4d0e578deb43c5a75808daf55efc43523abc937f` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:32 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "497-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1175
GET H/1.1	200 OK	bigBtn_right_arrow.png rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/	323 B 591 B	204ms 203ms	Image image/png	137.63.144.2 RENU
General Check archive.org Show headers Download Go to Show image Full URL https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/images/mkb/icons/bigBtn_right_arrow.png Requested by Host: rif.mak.ac.ug URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 137.63.144.2 Kolokolo, Uganda, ASN327687 (RENU, UG), Reverse DNS Software Apache / Resource Hash `fb15a9c84e34971fb83939575c80c4c0a8889ca2cb85b443a79156fb7ea35c6c` Request headers accept-language de-DE,de;q=0.9 Referer https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/resources/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sat, 18 Jun 2022 01:11:32 GMT Last-Modified Wed, 11 May 2022 02:29:10 GMT Server Apache ETag "143-5deb334ce4980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 323

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: MKB Bank (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rif.mak.ac.ug/	1969-12-31 23:59:59	Name: PHPSESSID Value: uq64kvetbhnjb3j9oeimjrv38d

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://rif.mak.ac.ug/wp-content/plugins/suavizar/login/mkbnetbankar/MKB%20NetBANK%C3%A1r_files/s.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rif.mak.ac.ug
137.63.144.2
077876a7ddde7889f413e5c961e880ed5f37ad11c65b2a73c5285b207116ce2e
1f2c141c91f6c24647e39709189c765b084388140f42ea7e0a192c5b7c3d5458
3f2862eda199871f0da61515d5be5dc9dfb7b398ab8f7608e27aa4e95cff9573
435d4fecfdb1ca909e52db0129b8702df4d6d17881c0aec0b12bee1141e595b3
48083b7e6c29ddd1a8fd0a7605f00a15411fd7ae88a5149c299baac0c96b64a9
4c09df8ccb8a573887d74240289ef9431301d56394661bc2674c76b6d963e737
59e5f9aea07e82c59a43c5092e213dcea58786f46fbf46dfe41111c0e8be4a20
5b3234b9a4f623013f4b33eb796cec65f86c6238efc38c4ff88aee4bef735740
64b516793502dc4a50ecbb18ff8fb5e1586b6233cc7041f1dfd1adcf12ca4452
68e9d1648afc69bb16ede55353ec2cacc08ca5089f66e34d73c0155cf16daeb5
83711c47a9df5f6dee359da612cfc100ba333e679729d035a93a7f9d6084ca79
a39aa19a16a5c64c649bfd2dbcb9fb69584e13cfbbf98d7757b1dd471b670c92
a716acda7515ce9582f999f38e0f895f33c36421742057346f2a6b0eb5c55a99
b71cc473b53135f1f165994b4d0e578deb43c5a75808daf55efc43523abc937f
c74c20f13ddf9791a019386b9fcd71569923c7a93b94558799c8d5436ea712c0
ccc24cbaabf3360a412affe30a8e81218ac41fc5e6630d321e79b260334e39ec
dd46f81e7638f8294fcdc8d89252af6dd973f739f077d790669376c9923feee9
e6866f1edac994e412645a5c9632f7447fdec326598f295558407ca88f1c30d9
e7cf318d5a4b8afd177ce5207b52266b7e642a35594d8c935ad7bd9bd1aad68d
f48134013f63f9f8ff227b2d3941875565cb94cb06a4b0318dbc635aa9a1cdac
f506865926fee9c497987a79dd540c6d14459afea4e10e43f55a7bef8400ac40
f7b1b48133535c98577c9d00f40c1c5e8298d129d46ee57d34430830dd659b30
fb15a9c84e34971fb83939575c80c4c0a8889ca2cb85b443a79156fb7ea35c6c

rif.mak.ac.ug Open in urlscan Pro 137.63.144.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

428 kBTransfer

423 kBSize

1 Cookies

11 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

rif.mak.ac.ug Open in urlscan Pro
137.63.144.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

428 kB
Transfer

423 kB
Size

1
Cookies

22 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!