![](/screenshots/9c457624-dfad-40e4-bc03-90537ae40f8e.png)
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net
Open in
urlscan Pro
185.27.134.125
Malicious Activity!
Public Scan
Effective URL: https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=2
Submission: On October 20 via manual from CR — Scanned from DE
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on October 20th 2021. Valid for: 3 months.
This is the only time b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Nacional (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 202.29.9.60 202.29.9.60 | 141714 (UNINET-AS...) (UNINET-AS-NPRU-AP Nakhon Pathom Rajabhat University) | |
1 3 | 185.27.134.59 185.27.134.59 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
11 | 185.27.134.125 185.27.134.125 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
2 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 3 |
ASN141714 (UNINET-AS-NPRU-AP Nakhon Pathom Rajabhat University, TH)
PTR: short.npru.ac.th
short.npru.ac.th |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
a0001.net
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net |
948 KB |
3 |
66ghz.com
1 redirects
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com |
32 KB |
2 |
gstatic.com
fonts.gstatic.com |
33 KB |
1 |
npru.ac.th
1 redirects
short.npru.ac.th |
1022 B |
15 | 4 |
Domain | Requested by | |
---|---|---|
11 | b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net |
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net |
3 | uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com |
1 redirects
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com
|
2 | fonts.gstatic.com |
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net
|
1 | short.npru.ac.th | 1 redirects |
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net ZeroSSL RSA Domain Secure Site CA |
2021-10-20 - 2022-01-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=2
Frame ID: 5F10C2E9C5548059E6BEFC49A78F5621
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/9c457624-dfad-40e4-bc03-90537ae40f8e.png)
Page Title
Banco Nacional de Costa Rica. Inicio de SesionPage URL History Show full URLs
-
https://short.npru.ac.th/qn72c7m2biyxm4x5xedpvijf6k3tf8
HTTP 301
http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/ Page URL
-
http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/?i=1
HTTP 301
https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=1 Page URL
- https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=2 Page URL
Detected technologies
![](/vendor/wappa/icons/Laravel.png)
Detected patterns
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://short.npru.ac.th/qn72c7m2biyxm4x5xedpvijf6k3tf8
HTTP 301
http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/ Page URL
-
http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/?i=1
HTTP 301
https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=1 Page URL
- https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://short.npru.ac.th/qn72c7m2biyxm4x5xedpvijf6k3tf8 HTTP 301
- http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/
- http://uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/?i=1 HTTP 301
- https://b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/?i=1
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/ Redirect Chain
|
851 B 848 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/ Redirect Chain
|
867 B 724 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aes.js
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/ |
36 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
29 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
2 KB 2 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css(1)
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
664 B 821 B |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css(2)
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
5 KB 5 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BNChat.png
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/ |
36 KB 36 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fondo.png
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/files/ |
849 KB 850 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v12/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v23/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Nacional (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
short.npru.ac.th/ | Name: XSRF-TOKEN Value: eyJpdiI6IklFRjNTK0p1dTVZa0dXUnIwQXVQd2c9PSIsInZhbHVlIjoiNG9pYlJkXC9ZSHhnNWJvb0JzT0xMTzhEZGpDZGozRUVzVUJcL2RFV0dkdlE5WjE0ZmVzNTBVaklMazQyWGs0YVRpMUMxdEQ4N1wva0MxUk04ZEpwYmFOZ2c9PSIsIm1hYyI6IjUzOTc0YWE1MzFiN2VhZDBiOGQzN2EwMzVkMTljNjliNmY4YTFlNGI2NDJjMGMxMGRlYmM3N2ZmMDJlMWM1YzAifQ%3D%3D |
|
short.npru.ac.th/ | Name: laravel_session Value: eyJpdiI6Ijh2XC9sV3RxVWhDM3JzNm9sTWRzUjFnPT0iLCJ2YWx1ZSI6IkwzNkFOOTdjRUZMTDhkbmhpMHQ1ZExjRTlBVmNLTENDSk81dHNEblMyVmRoSUp6ZzIyenhBb1ZxYWlMVHlEa2hJWUpEXC9cL1kwaklQTXR5aExTWGl3V2c9PSIsIm1hYyI6ImY3MGVkZWM2MTc2ZDgwYTI0OTg2ZGEyOTEyNTcwNzEyZGQyNTIyNTA2NDA0ZjZkOTg5MjAyM2M3MWNjMzVhMWUifQ%3D%3D |
|
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com/ | Name: __test Value: a025134b481e9ee61e72b3486f59339e |
|
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net/ | Name: __test Value: a025134b481e9ee61e72b3486f59339e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b05ecffxqxgrtwfgwgajrqvhzjpauimfvckpxpjbbzawp.a0001.net
fonts.gstatic.com
short.npru.ac.th
uiynqrycwamxfwuzpkqvjukiywptxb.66ghz.com
185.27.134.125
185.27.134.59
202.29.9.60
2a00:1450:4001:82b::2003
07f298455e75fcd947aaf460e7d4dbf0ce4aab7955a8abe198f6834cd2c80308
23ab99b7f665a16e8d45b8f73ef8c72c5edc6aba75ada2542e1113bbe0ffd04a
2e4ecfa7866203cf7f8f705c2c9fffa8cdeb3b11bea0cae4399f6bc974b07b6f
3a57826dd4437403ec9dffe3d8a907466926d7123e4a765ec724d79ae24e1d54
3f32059e545cf6209aaf4491c7815705bbfe67b9e4eacf2446e537b99728a406
4177b514e7cbf5efef5263662a21547172ba18f0c2832dd9aac189f48dcfe095
4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2
6451ef37208aea06cc6e7f67029068452b2567624f17044164f918e5cb06817b
a11306b40a20c1d8d40e2746d1ee259b7556c00bcbc719e5e1065f02b7cc427c
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f8f5705ee03667d1a28565f6dc84b7748bb9d7c4ded30c270354edd054b86b32
fb910830b2e34b6b4dbdba9be150094353f65754a387100dcf50b5fc36e016c9