rajanukul.go.th Open in urlscan Pro
210.1.58.196 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://it.chetak.co.in/restricted/fala/
Effective URL:
https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/
Submission: On September 12 via manual (September 12th 2019, 1:31:48 am UTC) from PE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 13 HTTP transactions. The main IP is 210.1.58.196, located in Thailand and belongs to CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH. The main domain is rajanukul.go.th.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 11th 2019. Valid for: 3 months.

This is the only time rajanukul.go.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Fallabela (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	14.98.68.5 14.98.68.5	45820 (TTSL-MEIS...) (TTSL-MEISISP Tata Teleservices ISP AS)
1 1	67.199.248.11 67.199.248.11	395224 (BITLY-AS) (BITLY-AS - Bitly Inc)
4 15	210.1.58.196 210.1.58.196	9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.)
2 4	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
13	2

1 14.98.68.5 (Ghaziabad, India) 1 redirects

ASN45820 (TTSL-MEISISP Tata Teleservices ISP AS, IN)
PTR: static-5.68.98.14-tataidc.co.in

it.chetak.co.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.11 (United States) 1 redirects

ASN395224 (BITLY-AS - Bitly Inc, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 210.1.58.196 (Thailand) 4 redirects

ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: nsu3.4gbhost.com

rajanukul.go.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	rajanukul.go.th 4 redirects rajanukul.go.th	219 KB
4	google.com 2 redirects www.google.com	1 KB
1	bit.ly 1 redirects bit.ly	435 B
1	chetak.co.in 1 redirects it.chetak.co.in	273 B
13	4

	Domain	Requested by
15	rajanukul.go.th	4 redirects rajanukul.go.th
4	www.google.com	2 redirects rajanukul.go.th
1	bit.ly	1 redirects
1	it.chetak.co.in	1 redirects
13	4

This site contains no links.

Subject Issuer	Validity	Valid
rajanukul.go.th Let's Encrypt Authority X3	`2019-08-11` - `2019-11-09`	3 months	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 2 frames:

Primary Page: https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/
Frame ID: 82D24079EE87BF40B83BD51FDC2C0E43
Requests: 1 HTTP requests in this frame

Frame: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html
Frame ID: F80FDBC7391AE6690CD570B81AFF5B67
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://it.chetak.co.in/restricted/fala/ HTTP 302
https://bit.ly/2mcADjn HTTP 301
https://rajanukul.go.th/bancofalabella.pe/ HTTP 302
https://rajanukul.go.th/bancofalabella.pe/TechBank/sso HTTP 301
https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

13
Requests

85 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

218 kB
Transfer

819 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://it.chetak.co.in/restricted/fala/ HTTP 302
https://bit.ly/2mcADjn HTTP 301
https://rajanukul.go.th/bancofalabella.pe/ HTTP 302
https://rajanukul.go.th/bancofalabella.pe/TechBank/sso HTTP 301
https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/icons/sign-out-icon.png HTTP 302
http://www.google.com/ HTTP 302
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPK_5usFIhkA8aeDS6Ddrtua_q-wKtDYh91EjYgjVID1MgFy

Request Chain 7

https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/login/iconoError.png HTTP 302
http://www.google.com/ HTTP 302
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPO_5usFIhkA8aeDS6yQdOkW9TnuJRxLvEps5EouEZ-sMgFy

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Redirect Chain http://it.chetak.co.in/restricted/fala/ https://bit.ly/2mcADjn https://rajanukul.go.th/bancofalabella.pe/ https://rajanukul.go.th/bancofalabella.pe/TechBank/sso https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/	352 B 478 B	875ms 290ms	Document text/html	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / PHP/5.3.29 Resource Hash `081a419e01ef8baeaf25f89351d93e1b32c47c45840286cf21c704ce52551131` Request headers Host rajanukul.go.th Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:27 GMT Server Apache/2 X-Powered-By PHP/5.3.29 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 255 Connection close Content-Type text/html Redirect headers Date Thu, 12 Sep 2019 01:31:26 GMT Server Apache/2 Location https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Content-Length 331 Connection close Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	principal.html Show response rajanukul.go.th/bancofalabella.pe/TechBank/ Frame F80F	35 KB 3 KB	849ms 288ms	Document text/html	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `f6788a59f5ad049737d7415a286c9ac87091d857e975f2df7e06b229d0f61654` Request headers Host rajanukul.go.th Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site same-origin Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/ Response headers Date Thu, 12 Sep 2019 01:31:28 GMT Server Apache/2 Last-Modified Wed, 11 Sep 2019 17:35:26 GMT ETag "8ca2-5924a72465380-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 2866 Connection close Content-Type text/html
GET H/1.1	200 OK	styleFromDB1114.css rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/ Frame F80F	608 KB 38 KB	861ms 306ms	Stylesheet text/css	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/styleFromDB1114.css?599080998 Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `94066b82dd12183fe74f9fcfad68492462363819339e724d2e26b41cd2022e46` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:29 GMT Content-Encoding gzip Last-Modified Wed, 11 Sep 2019 17:35:27 GMT Server Apache/2 ETag "97e23-5924a725595c0-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection close Accept-Ranges bytes Content-Length 38948
GET H/1.1	200 OK	fonts.css rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/externalFonts/ Frame F80F	2 KB 577 B	850ms 288ms	Stylesheet text/css	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/externalFonts/fonts.css Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `1b8f2cc8ca3dd1bf2a09498d6dff71922244dc14912159832957c91e91641eba` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:29 GMT Content-Encoding gzip Last-Modified Wed, 11 Sep 2019 17:35:26 GMT Server Apache/2 ETag "81e-5924a72465380-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection close Accept-Ranges bytes Content-Length 281
GET H/1.1	200 OK	fondo-login.jpg rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/ Frame F80F	77 KB 77 KB	851ms 290ms	Image image/jpeg	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Show image Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/fondo-login.jpg Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `247e08b6cbcc1a5bc876dab95ad2e6aa6b70d27c95edb359f6d2cdcf64c92c13` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/styleFromDB1114.css?599080998 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:30 GMT Last-Modified Wed, 11 Sep 2019 17:35:29 GMT Server Apache/2 ETag "1345c-5924a72741a40" Content-Type image/jpeg Connection close Accept-Ranges bytes Content-Length 78940
GET H/1.1	200 OK	logobanco_bfco.png rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/logos/ Frame F80F	7 KB 7 KB	857ms 291ms	Image image/png	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Show image Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/logos/logobanco_bfco.png Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `e85b73a4f08b572663bbd26fcfba69fc5a4fb07eee73ba6e0eb27e32b6d64277` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/styleFromDB1114.css?599080998 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:30 GMT Last-Modified Wed, 11 Sep 2019 17:35:29 GMT Server Apache/2 ETag "1a55-5924a72741a40" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 6741
GET H/1.1	429 Too Many Requests	index www.google.com/sorry/ Frame F80F Redirect Chain https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/icons/sign-out-icon.png http://www.google.com/ http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPK_5usFIhkA8aeDS6Ddrtua_q-wKtDYh91EjYgjVID1MgFy	0 0	13ms 13ms	Image text/html	2a00:1450:4001:81c::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPK_5usFIhkA8aeDS6Ddrtua_q-wKtDYh91EjYgjVID1MgFy Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security , , Server 2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Thu, 12 Sep 2019 01:31:31 GMT Server HTTP server (unknown) P3P CP="This is not a P3P policy! See g.co/p3phelp for more info." Location http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPK_5usFIhkA8aeDS6Ddrtua_q-wKtDYh91EjYgjVID1MgFy Cache-Control no-store, no-cache, must-revalidate Content-Type text/html; charset=UTF-8 Content-Length 341 X-XSS-Protection 0 Expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	ico_alerta.png rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/ Frame F80F	556 B 790 B	1708ms 292ms	Image image/png	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Show image Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/ico_alerta.png Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `e587e3a88d99e4e2c9d5ea12c67cd74462e1030f5239bb75fe415bfdf6ed016f` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/styleFromDB1114.css?599080998 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:31 GMT Last-Modified Wed, 11 Sep 2019 17:35:29 GMT Server Apache/2 ETag "22c-5924a72741a40" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 556
GET H/1.1	429 Too Many Requests	index www.google.com/sorry/ Frame F80F Redirect Chain https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/login/iconoError.png http://www.google.com/ http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPO_5usFIhkA8aeDS6yQdOkW9TnuJRxLvEps5EouEZ-sMgFy	0 0	14ms 13ms	Image text/html	2a00:1450:4001:81c::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPO_5usFIhkA8aeDS6yQdOkW9TnuJRxLvEps5EouEZ-sMgFy Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security , , Server 2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Thu, 12 Sep 2019 01:31:31 GMT Server HTTP server (unknown) Content-Type text/html; charset=UTF-8 Location http://www.google.com/sorry/index?continue=http://www.google.com/&q=EhAqAQT4AZJUFAAAAAAAAAACGPO_5usFIhkA8aeDS6yQdOkW9TnuJRxLvEps5EouEZ-sMgFy Cache-Control no-store, no-cache, must-revalidate Content-Length 341 X-XSS-Protection 0 Expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	pfbeausanspro-light-webfont.woff rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/ Frame F80F	30 KB 30 KB	839ms 286ms	Font application/octet-stream	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/pfbeausanspro-light-webfont.woff Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `5768ef834b1f28d29fac53556595cf72a307273f1dad7fd508974c1685213f22` Request headers Sec-Fetch-Mode cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/externalFonts/fonts.css Origin https://rajanukul.go.th User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:30 GMT Content-Encoding gzip Last-Modified Wed, 11 Sep 2019 17:35:28 GMT Server Apache/2 ETag "7798-5924a7264d800-gzip" Vary Accept-Encoding,User-Agent Connection close Accept-Ranges bytes Content-Length 30582
GET H/1.1	200 OK	icoFormTecladoFondoOscuro.png rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/ Frame F80F	235 B 468 B	830ms 281ms	Image image/png	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Show image Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/images/icoFormTecladoFondoOscuro.png Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `5f3722003565fc5b86c186812120f2b38618cddd0a82577226282e35a7523f98` Request headers Sec-Fetch-Mode no-cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/styleFromDB1114.css?599080998 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:31 GMT Last-Modified Wed, 11 Sep 2019 17:35:29 GMT Server Apache/2 ETag "eb-5924a72741a40" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 235
GET H/1.1	200 OK	pfbeausanspro-thin-webfont.woff rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/ Frame F80F	29 KB 29 KB	847ms 292ms	Font application/octet-stream	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/pfbeausanspro-thin-webfont.woff Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `b51c285531f61cc2b43fcdaddb8e653a127d2b063d782be653449a75409ce4ce` Request headers Sec-Fetch-Mode cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/externalFonts/fonts.css Origin https://rajanukul.go.th User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:30 GMT Content-Encoding gzip Last-Modified Wed, 11 Sep 2019 17:35:28 GMT Server Apache/2 ETag "73ec-5924a7264d800-gzip" Vary Accept-Encoding,User-Agent Connection close Accept-Ranges bytes Content-Length 29625
GET H/1.1	200 OK	pfbeausanspro-regular-webfont.woff rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/ Frame F80F	30 KB 31 KB	845ms 291ms	Font application/octet-stream	210.1.58.196 CSLOX-IDC-AS-AP C...
General Check archive.org Show headers Download Go to Full URL https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/fonts/PfBeauSansPro/win/pfbeausanspro-regular-webfont.woff Requested by Host: rajanukul.go.th URL: https://rajanukul.go.th/bancofalabella.pe/TechBank/principal.html Protocol HTTP/1.1 Security TLS 1.0, ECDHE_RSA, AES_256_CBC Server 210.1.58.196 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH), Reverse DNS nsu3.4gbhost.com Software Apache/2 / Resource Hash `92c004fcad4dc005df81c473fe3178d7d6fd020dd6013dc64a051c55d4179e70` Request headers Sec-Fetch-Mode cors Referer https://rajanukul.go.th/bancofalabella.pe/TechBank/sso/files/css/externalFonts/fonts.css Origin https://rajanukul.go.th User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 12 Sep 2019 01:31:30 GMT Content-Encoding gzip Last-Modified Wed, 11 Sep 2019 17:35:28 GMT Server Apache/2 ETag "798c-5924a7264d800-gzip" Vary Accept-Encoding,User-Agent Connection close Accept-Ranges bytes Content-Length 31078

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Fallabela (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
it.chetak.co.in
rajanukul.go.th
www.google.com
14.98.68.5
210.1.58.196
2a00:1450:4001:81c::2004
67.199.248.11
081a419e01ef8baeaf25f89351d93e1b32c47c45840286cf21c704ce52551131
1b8f2cc8ca3dd1bf2a09498d6dff71922244dc14912159832957c91e91641eba
247e08b6cbcc1a5bc876dab95ad2e6aa6b70d27c95edb359f6d2cdcf64c92c13
5768ef834b1f28d29fac53556595cf72a307273f1dad7fd508974c1685213f22
5f3722003565fc5b86c186812120f2b38618cddd0a82577226282e35a7523f98
92c004fcad4dc005df81c473fe3178d7d6fd020dd6013dc64a051c55d4179e70
94066b82dd12183fe74f9fcfad68492462363819339e724d2e26b41cd2022e46
b51c285531f61cc2b43fcdaddb8e653a127d2b063d782be653449a75409ce4ce
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e587e3a88d99e4e2c9d5ea12c67cd74462e1030f5239bb75fe415bfdf6ed016f
e85b73a4f08b572663bbd26fcfba69fc5a4fb07eee73ba6e0eb27e32b6d64277
f6788a59f5ad049737d7415a286c9ac87091d857e975f2df7e06b229d0f61654

rajanukul.go.th Open in urlscan Pro 210.1.58.196 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

85 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

4 Countries

218 kBTransfer

819 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

rajanukul.go.th Open in urlscan Pro
210.1.58.196 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

85 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

218 kB
Transfer

819 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!