mathayomspb.go.th Open in urlscan Pro
103.4.217.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.gld-battery.com/fidl/
Effective URL:
https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2...
Submission: On November 07 via manual (November 7th 2022, 5:40:35 am UTC) from AU — Scanned from AU

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 103.4.217.200, located in Thailand and belongs to DRAGONHISPEED-AS-AP dragonhispeed, TH. The main domain is mathayomspb.go.th.
TLS certificate: Issued by R3 on September 24th 2022. Valid for: 3 months.

This is the only time mathayomspb.go.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	219.234.31.106 219.234.31.106	139021 (WEST263GO...) (WEST263GO-HK West263 International Limited)
1 14	103.4.217.200 103.4.217.200	63940 (DRAGONHIS...) (DRAGONHISPEED-AS-AP dragonhispeed)
17	3

1 219.234.31.106 (China)

ASN139021 (WEST263GO-HK West263 International Limited, HK)

www.gld-battery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 103.4.217.200 (Thailand) 1 redirects

ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH)

mathayomspb.go.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	mathayomspb.go.th 1 redirects mathayomspb.go.th	211 KB
1	gld-battery.com www.gld-battery.com	439 B
17	2

	Domain	Requested by
14	mathayomspb.go.th	1 redirects mathayomspb.go.th
1	www.gld-battery.com
17	2

This site contains no links.

Subject Issuer	Validity	Valid
bigdata.mathayomspb.go.th R3	`2022-09-24` - `2022-12-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO
Frame ID: 13C431C687969BF68AE7EC105459E869
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BT.com Log in

Page URL History Show full URLs

http://www.gld-battery.com/fidl/ Page URL
https://mathayomspb.go.th/wp-admin/css/btinternet/ HTTP 302
https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6... Page URL

Page Statistics

17
Requests

76 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

254 kB
Transfer

672 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.gld-battery.com/fidl/ Page URL
https://mathayomspb.go.th/wp-admin/css/btinternet/ HTTP 302
https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.gld-battery.com/fidl/	118 B 439 B	1510ms 481ms	Document text/html	219.234.31.106 WEST263GO-HK West...
General Check archive.org Show headers Download Go to Full URL http://www.gld-battery.com/fidl/ Protocol HTTP/1.1 Server 219.234.31.106 , China, ASN139021 (WEST263GO-HK West263 International Limited, HK), Reverse DNS Software wts/1.6.4 / Resource Hash `d10d075240fe44ee68ac2df178ee96b927ff33b2b3e95e5837603270b904d6fb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Encoding gzip Content-Length 125 Content-Type text/html Date Mon, 07 Nov 2022 05:40:28 GMT ETag "76-5ec842b8c3380-gzip" Last-Modified Wed, 02 Nov 2022 22:14:54 GMT Server wts/1.6.4 Vary Accept-Encoding Accept-Encoding
GET H2	200	Primary Request loginform Show response mathayomspb.go.th/wp-admin/css/btinternet/ Redirect Chain https://mathayomspb.go.th/wp-admin/css/btinternet/ https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBP...	11 KB 3 KB	343ms 343ms	Document text/html	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `97ca24f3727412ad61093bbf38feec0ebf5188807d1da9376dcf6e7fd7fc89d3` Request headers Referer http://www.gld-battery.com/fidl/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 2580 content-type text/html; charset=UTF-8 date Mon, 07 Nov 2022 05:40:31 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding,User-Agent Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Mon, 07 Nov 2022 05:40:30 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO pragma no-cache server nginx vary User-Agent
GET H2	200	override.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	6 KB 2 KB	342ms 341ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/override.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `a2ea72aac1d255823b18f4e67a137511ba739e11b3d8267bdfe6ea63c43abb7d` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-192d" vary Accept-Encoding content-type text/css
GET H2	200	common-reset.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	65 KB 37 KB	1025ms 1023ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/common-reset.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-10413" vary Accept-Encoding content-type text/css
GET H2	200	common.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	181 KB 42 KB	686ms 684ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/common.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `c381e48fc69749f45747ea97b7a8402ad114b8630141157fa0ce30800046843b` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-2d395" vary Accept-Encoding content-type text/css
GET H2	200	index.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	125 KB 24 KB	1024ms 1022ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/index.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `19f825f28d000a1068b0b516da43406ded060e97fafc3ccae6bfb0733dd70aaa` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-1f2eb" vary Accept-Encoding content-type text/css
GET H2	200	bts-common.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	88 KB 15 KB	1025ms 1024ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/bts-common.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-161cb" vary Accept-Encoding content-type text/css
GET H2	200	login-index.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	76 KB 16 KB	1022ms 1021ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/login-index.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `ff9fe27ec02d4ccc1a6c8abea7c4b55b0d91777c2b8fc07b682fccd3f24e2414` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-130d2" vary Accept-Encoding content-type text/css
GET H2	200	responsive-footer.css mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/	9 KB 2 KB	1023ms 1023ms	Stylesheet text/css	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/responsive-footer.css Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `d8fadce09275617570780b7871ff349dfcae4da102617dc5595fc7f679dd5a50` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-2247" vary Accept-Encoding content-type text/css
GET H2	200	rebrand-bt-logo-login-page-136440342141502601-220809094057.png mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/	2 KB 2 KB	1009ms 1009ms	Image image/png	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Show image Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/rebrand-bt-logo-login-page-136440342141502601-220809094057.png Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx accept-ranges bytes etag "63501ca3-6b8" content-length 1720 content-type image/png
GET H2	200	logo-footer2018.svg mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/	1 KB 764 B	1009ms 1009ms	Image image/svg+xml	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Show image Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/logo-footer2018.svg Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/loginform?sslchannel=true&sessionid=MzOoPErumLEIhyx6NWe3ax1yeDUm6KGTnnw2Uql0YKdoLgXYnbXix9XRhEgqpZ46xH9mSgq3wRZyJdoTCPxg8QYoSypQVW101xopq7lQvo9MpBPdMdD7BW77amm9xBDTnO User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:31 GMT content-encoding gzip last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx etag W/"63501ca3-419" vary Accept-Encoding content-type image/svg+xml
GET		logintextboxbg.png mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/images/	0 0

GET		icons-sprite-8bit.png mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/	0 0

GET H2	200	LoginButtonBg.png mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/	211 B 371 B	351ms 350ms	Image image/png	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Show image Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/LoginButtonBg.png Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/common.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8` Request headers accept-language en-AU,en;q=0.9 Referer https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/common.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:32 GMT last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx x-accel-version 0.01 etag "d3-5eb6528fb04dd" content-type image/png accept-ranges bytes content-length 211
GET		login-back.png mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/	0 0

GET DATA	200 OK	truncated /	42 KB 42 KB		Font font/truetype
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3b08992554ee957c4fa7e6f2a2a743bf222c14e3b641dbd36cb7a8998741a55d` Request headers Referer Origin https://mathayomspb.go.th accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type font/truetype;charset=utf-8
GET H2	200	BTFont_Rg.woff mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/fonts/	58 KB 58 KB	371ms 370ms	Font application/x-font-woff	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/fonts/BTFont_Rg.woff Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/responsive-footer.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `ef203c78f49eb32821e0c6ce993bb2d35a0c58fe770fe5ccbcfe5585a01e2ba4` Request headers Referer https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/responsive-footer.css Origin https://mathayomspb.go.th accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:32 GMT last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx accept-ranges bytes etag "63501ca3-e6d4" content-length 59092 content-type application/x-font-woff
GET H2	200	bttvicons.woff mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/fonts/	8 KB 8 KB	372ms 372ms	Font application/x-font-woff	103.4.217.200 DRAGONHISPEED-AS-...
General Check archive.org Show headers Download Go to Full URL https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/fonts/bttvicons.woff Requested by Host: mathayomspb.go.th URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/responsive-footer.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 103.4.217.200 , Thailand, ASN63940 (DRAGONHISPEED-AS-AP dragonhispeed, TH), Reverse DNS Software nginx / Resource Hash `c471c762b4eb8ce3aac5aec2b1aac9bf9e8ccb8d2fe84d74c940e9ad2c5bc168` Request headers Referer https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/css/responsive-footer.css Origin https://mathayomspb.go.th accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 05:40:32 GMT last-modified Wed, 19 Oct 2022 15:49:55 GMT server nginx accept-ranges bytes etag "63501ca3-20a4" content-length 8356 content-type application/x-font-woff

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mathayomspb.go.th
URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/images/logintextboxbg.png

Domain: mathayomspb.go.th
URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/icons-sprite-8bit.png

Domain: mathayomspb.go.th
URL: https://mathayomspb.go.th/wp-admin/css/btinternet/btu_assetz/img/login-back.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mathayomspb.go.th/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4tfsdtpempo3qs0j3rnjfirjan

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mathayomspb.go.th
www.gld-battery.com
mathayomspb.go.th
103.4.217.200
219.234.31.106
07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1
19f825f28d000a1068b0b516da43406ded060e97fafc3ccae6bfb0733dd70aaa
3b08992554ee957c4fa7e6f2a2a743bf222c14e3b641dbd36cb7a8998741a55d
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43
97ca24f3727412ad61093bbf38feec0ebf5188807d1da9376dcf6e7fd7fc89d3
a2ea72aac1d255823b18f4e67a137511ba739e11b3d8267bdfe6ea63c43abb7d
c381e48fc69749f45747ea97b7a8402ad114b8630141157fa0ce30800046843b
c471c762b4eb8ce3aac5aec2b1aac9bf9e8ccb8d2fe84d74c940e9ad2c5bc168
d10d075240fe44ee68ac2df178ee96b927ff33b2b3e95e5837603270b904d6fb
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015
d8fadce09275617570780b7871ff349dfcae4da102617dc5595fc7f679dd5a50
ef203c78f49eb32821e0c6ce993bb2d35a0c58fe770fe5ccbcfe5585a01e2ba4
ff9fe27ec02d4ccc1a6c8abea7c4b55b0d91777c2b8fc07b682fccd3f24e2414

mathayomspb.go.th Open in urlscan Pro 103.4.217.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

76 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

254 kBTransfer

672 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

Indicators

mathayomspb.go.th Open in urlscan Pro
103.4.217.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

76 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

254 kB
Transfer

672 kB
Size

1
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!