urlscan.io logo urlscan.io
SecurityTrails logo

secondary.obec.go.th Open in urlscan Pro
202.29.173.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Submission: On June 13 via manual from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 202.29.173.3, located in Bangkok, Thailand and belongs to OBEC-AS-AP Office of the basic education commission, TH. The main domain is secondary.obec.go.th.
TLS certificate: Issued by R3 on May 31st 2024. Valid for: 3 months.
This is the only time secondary.obec.go.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 202.29.173.3 133042 (OBEC-AS-A...)
3 23.218.217.134 20940 (AKAMAI-ASN1)
1 104.194.8.120 23470 (RELIABLESITE)
3 151.101.129.16 54113 (FASTLY)
8 4
Apex Domain
Subdomains		 Transfer
3 media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 436
61 KB
3 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 852
28 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 10139
4 KB
1 obec.go.th
secondary.obec.go.th
4 KB
8 4
Domain Requested by
3 m.media-amazon.com images-na.ssl-images-amazon.com
3 images-na.ssl-images-amazon.com secondary.obec.go.th
1 i.ibb.co secondary.obec.go.th
1 secondary.obec.go.th
8 4

This site contains no links.

Subject Issuer Validity Valid
secondary.obec.go.th
R3		 2024-05-31 -
2024-08-29		 3 months crt.sh
m.media-amazon.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-08-29 -
2024-08-28		 a year crt.sh
ibb.co
R3		 2024-04-22 -
2024-07-21		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2024-03-18 -
2025-03-09		 a year crt.sh

This page contains 1 frames:

Primary Page: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Frame ID: A7863C27DC49AA13454EC2E415198C2A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Verification

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

97 kB
Transfer

253 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
secondary.obec.go.th/newweb/wp-admin/includes/front/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
202.29.173.3 Bangkok, Thailand, ASN133042 (OBEC-AS-AP Office of the basic education commission, TH),
Reverse DNS
Software
Apache/2.4.55 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/7.4.30 / PHP/7.4.30
Resource Hash
ee09c6311fad39537f176558c3cf86246535d27f08b52248acc30d550a13804d

Request headers

Accept-Language
en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Length
4082
Content-Type
text/html; charset=UTF-8
Date
Thu, 13 Jun 2024 22:44:43 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache/2.4.55 (FreeBSD) OpenSSL/1.1.1o-freebsd PHP/7.4.30
X-Powered-By
PHP/7.4.30
61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css
images-na.ssl-images-amazon.com/images/I/ 		137 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI
Requested by
Host: secondary.obec.go.th
URL: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.218.217.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-218-217-134.deploy.static.akamaitechnologies.com
Software
Server /
Resource Hash
8ff52030ae312e1688bd111f80d21dc533e457cdefd9cdf07722ec9f51de79bb

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://secondary.obec.go.th/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
content-encoding
br
akamai-cache-status
Miss from child, Hit from parent
akamai-grn
0.8601de17.1718318685.1759f4f
x-cache
Hit from akamai
x-nginx-cache-status
HIT
server-timing
provider;desc="ak"
alt-svc
h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length
19544
surrogate-key
x-cache-292 /images/I/61Brdu0o6LL
last-modified
Wed, 03 Jan 2018 00:13:54 GMT
server
Server
content-type
text/css; charset=utf-8
access-control-allow-origin
*
peer-cache
Hit
cache-control
public, max-age=630720000
x-amz-ir-id
9c827244-98e7-41be-90c0-63a04cba39ef
timing-allow-origin
https://secondary.obec.go.th/
expires
Wed, 08 Jun 2044 22:44:45 GMT
01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41yEFdgL45L.css_.css
images-na.ssl-images-amazon.com/images/I/ 		46 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41yEFdgL45L.css_.css?AUIClients/AuthenticationPortalAssets
Requested by
Host: secondary.obec.go.th
URL: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.218.217.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-218-217-134.deploy.static.akamaitechnologies.com
Software
Server /
Resource Hash
8c23ec3cf642a3bdb329d68c6038db8172b01fcad5270f36cf447235c2594ffa

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://secondary.obec.go.th/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
content-encoding
br
akamai-cache-status
Miss from child, Hit from parent
akamai-grn
0.8601de17.1718318685.1759f50
x-cache
Hit from akamai
x-nginx-cache-status
HIT
server-timing
provider;desc="ak"
content-length
7165
surrogate-key
x-cache-413 /images/I/01SdjaY0ZsL
last-modified
Sat, 30 May 2015 02:58:48 GMT
server
Server
content-type
text/css
access-control-allow-origin
*
peer-cache
Hit
cache-control
public, max-age=630720000
x-amz-ir-id
dadeec1e-3333-4828-aa4a-4145075b0e0f
timing-allow-origin
https://secondary.obec.go.th/
expires
Wed, 08 Jun 2044 22:44:45 GMT
11E08O3eXDL.css
images-na.ssl-images-amazon.com/images/I/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/11E08O3eXDL.css?AUIClients/CVFAssets
Requested by
Host: secondary.obec.go.th
URL: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.218.217.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-218-217-134.deploy.static.akamaitechnologies.com
Software
Server /
Resource Hash
122a38d736dd4b129af47e1d4f6d955d335f55256f2f231d8ccd1a58562cd381

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://secondary.obec.go.th/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
content-encoding
br
akamai-cache-status
Miss from child, Hit from parent
akamai-grn
0.8601de17.1718318685.1759f53
x-cache
Hit from akamai
x-nginx-cache-status
HIT
server-timing
provider;desc="ak"
content-length
759
surrogate-key
x-cache-552 /images/I/11E08O3eXDL
last-modified
Fri, 27 Mar 2020 19:40:05 GMT
server
Server
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
peer-cache
Hit
cache-control
public, max-age=630720000
x-amz-ir-id
f859b768-9956-4ca5-8627-fcb4ec5b1fd8
timing-allow-origin
https://secondary.obec.go.th/
expires
Wed, 08 Jun 2044 22:44:45 GMT
828028a4f4a84acabd1a94001a5c8a7c.jpg
i.ibb.co/1XvK992/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/1XvK992/828028a4f4a84acabd1a94001a5c8a7c.jpg
Requested by
Host: secondary.obec.go.th
URL: https://secondary.obec.go.th/newweb/wp-admin/includes/front/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.194.8.120 Los Angeles, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software
nginx /
Resource Hash
9d021be18c53ca0d51304debf94034495d7b6bb25bccc673e58fd715ae51ed46

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://secondary.obec.go.th/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
last-modified
Fri, 24 Jul 2020 00:21:29 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
4043
expires
Thu, 31 Dec 2037 23:55:55 GMT
AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI#us.not-trident
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://images-na.ssl-images-amazon.com/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
age
1171910
x-cache
HIT from fastly, HIT from fastly
x-nginx-cache-status
MISS
server-timing
provider;desc="fy"
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
27972
x-served-by
cache-iad-kjyo7100116-IAD, cache-yyz4536-YYZ
last-modified
Fri, 22 Sep 2017 00:23:19 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
e7813be5-eb12-4625-aa62-cde45e3882bc
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
expires
Mon, 21 Sep 2043 11:52:38 GMT
AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2
m.media-amazon.com/images/G/01/AUIClients/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI#us.not-trident
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://images-na.ssl-images-amazon.com/
Origin
https://secondary.obec.go.th
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
age
4438961
x-cache
HIT from fastly, HIT from fastly
x-nginx-cache-status
HIT
server-timing
provider;desc="fy"
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
16616
x-served-by
cache-iad-kcgs7200099-IAD, cache-yyz4576-YYZ
last-modified
Sat, 11 Jun 2016 01:31:21 GMT
content-type
application/font-woff2; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
1d1ead34-1cb0-496c-82a9-42e987c3f786
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
expires
Tue, 25 Aug 2043 06:10:32 GMT
AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2
m.media-amazon.com/images/G/01/AUIClients/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI#us.not-trident
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.16 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://images-na.ssl-images-amazon.com/
Origin
https://secondary.obec.go.th
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 22:44:45 GMT
age
9548940
x-cache
HIT from fastly, HIT from fastly
x-nginx-cache-status
HIT
server-timing
provider;desc="fy"
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
16460
x-served-by
cache-iad-kjyo7100130-IAD, cache-yyz4576-YYZ
last-modified
Sat, 11 Jun 2016 01:31:24 GMT
content-type
application/font-woff2; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
174f2354-34b5-4713-a018-d51dbce0e9b4
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
expires
Sat, 19 Sep 2043 00:13:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

1 Cookies

Domain/Path Name / Value
secondary.obec.go.th/ Name: PHPSESSID
Value: khceeql1jksott1iic0ab0g8oa