donkheaw.ac.th Open in urlscan Pro
119.59.120.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://donkheaw.ac.th/money/message.htm
Submission: On May 02 via automatic, source openphish (May 2nd 2017, 8:17:28 pm UTC)

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 119.59.120.52, located in Thailand and belongs to METRABYTE-TH 453 Ladplacout Jorakhaebua, TH. The main domain is donkheaw.ac.th.

This is the only time donkheaw.ac.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address		AS Autonomous System
14	119.59.120.52 119.59.120.52		56067 (METRABYTE...) (METRABYTE-TH 453 Ladplacout Jorakhaebua)
14	1

14 119.59.120.52 (Thailand)

ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH)
PTR: ln21.hostingdynamo.net

donkheaw.ac.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	donkheaw.ac.th donkheaw.ac.th	24 KB
14	1

	Domain	Requested by
14	donkheaw.ac.th	donkheaw.ac.th
14	1

This site contains links to these domains. Also see Links.

Domain
onlineeast.bankofamerica.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://donkheaw.ac.th/money/message.htm
Frame ID: 26025.1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

14
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

24 kB
Transfer

90 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://onlineeast.bankofamerica.com/cgi-bin/ias/4KTs2fjNOSVa4JgTQE9WI4BvbjhaFHngFjech7og29088/1/bofa/ibd/IAS/presentation/GotoResetPasscodeWithPinPage#skipqh
Title: Skip Quick Help

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request message.htm Show response donkheaw.ac.th/money/	14 KB 3 KB	1883ms 232ms	Document text/html	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `df462d8bf1b24fd4666ee6780cb85b62e5f2fe390c908f4f27b81b5487ade692` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:44 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:13:54 GMT Server Apache/2 ETag "36fa-54e8e80a3f3fe-gzip" Vary Accept-Encoding,User-Agent Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 3473
GET H/1.1	200 OK	win_ie.css donkheaw.ac.th/money/love/	27 KB 4 KB	234ms 232ms	Stylesheet text/css	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/win_ie.css Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `6efa91a17f66658c7648671ea9f2a02f83b4388f88c8b12c22a87c67a716f1e2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept text/css,/;q=0.1 Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:07:20 GMT Server Apache/2 ETag "6acc-54e8e692fd937-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 3790
GET H/1.1	200 OK	scripts.js Show response donkheaw.ac.th/money/love/	7 KB 1 KB	233ms 232ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/scripts.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `c396a7605f7b41b22b81f5fac525aa29387ba4b5904d0bd7fe45aecb65ac78ee` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:06:49 GMT Server Apache/2 ETag "1df9-54e8e675744bf-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 1483
GET H/1.1	200 OK	common_misc.js Show response donkheaw.ac.th/money/love/	13 KB 3 KB	464ms 232ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_misc.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `b8a1430a9f7ed535693c3566e9d39ce740e260a9e625fc5a2d463a80898ca784` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:02:53 GMT Server Apache/2 ETag "32e9-54e8e5944ca5f-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 3293
GET H/1.1	200 OK	common_util.js Show response donkheaw.ac.th/money/love/	9 KB 2 KB	465ms 232ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_util.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `a1a713e8ba6ce247cf0cc6bbd7f6af490e25344461ad3eaa7a2901bea18e2624` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:03:03 GMT Server Apache/2 ETag "2219-54e8e59d615af-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 2337
GET H/1.1	200 OK	common_date.js Show response donkheaw.ac.th/money/love/	5 KB 1 KB	464ms 232ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_date.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `553f1edd57c1e7eeb4e450f88d52a68cd56a59c2e22599bb4c38be1a305aafe7` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:02:35 GMT Server Apache/2 ETag "1345-54e8e5832ae7f-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 1529
GET H/1.1	200 OK	common_amount.js Show response donkheaw.ac.th/money/love/	2 KB 870 B	465ms 231ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_amount.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `af1524a62640e2c229bee52cca294d6abd0e427139ab91ebd8c44d6e2a9e8131` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:02:19 GMT Server Apache/2 ETag "991-54e8e573bb3ef-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 870
GET H/1.1	200 OK	common_error.js Show response donkheaw.ac.th/money/love/	5 KB 2 KB	465ms 232ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_error.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `f4e1485013f8c025c983d1169d381c1f09edc214abfc98810f385489c32e5792` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:02:44 GMT Server Apache/2 ETag "1209-54e8e58be9eb7-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=98 Content-Length 1606
GET H/1.1	200 OK	common_button.js Show response donkheaw.ac.th/money/love/	4 KB 1 KB	469ms 235ms	Script application/javascript	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/money/love/common_button.js Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `562a545909f70091669e66ed5fcf840ad60984cd1940365f5585bd9a3aa43a28` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept / Referer http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Content-Encoding gzip Last-Modified Tue, 02 May 2017 18:02:27 GMT Server Apache/2 ETag "f16-54e8e57b3ba7f-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 1169
GET H/1.1	200 OK	olb_masthead_nonav.gif donkheaw.ac.th/money/love/	5 KB 5 KB	238ms 234ms	Image image/gif	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Show image Full URL http://donkheaw.ac.th/money/love/olb_masthead_nonav.gif Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `9b295c5c5c1322c89a950fd13dde98fa8b3109e7d95a0d64c5439e457a80cb46` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Last-Modified Tue, 02 May 2017 18:05:50 GMT Server Apache/2 ETag "137e-54e8e63cffa8f" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 4990
GET H/1.1	200 OK	clr.gif donkheaw.ac.th/money/love/	54 B 54 B	233ms 233ms	Image image/gif	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Show image Full URL http://donkheaw.ac.th/money/love/clr.gif Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `d8d16484a4f6f80d7aa020a1c646c7a09a3b7988923c6483c9efad14aa338257` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Last-Modified Tue, 02 May 2017 18:02:02 GMT Server Apache/2 ETag "36-54e8e563abeaf" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 54
GET H/1.1	200 OK	icon_lock_big.gif donkheaw.ac.th/money/love/	66 B 66 B	233ms 232ms	Image image/gif	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Show image Full URL http://donkheaw.ac.th/money/love/icon_lock_big.gif Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `a1b6d90affba68dd140e0f8debbf21b067b9a7bafdbd117f4aa34b199a542bb0` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Last-Modified Tue, 02 May 2017 18:04:11 GMT Server Apache/2 ETag "42-54e8e5deeaf17" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=97 Content-Length 66
GET H/1.1	200 OK	icon_house.gif donkheaw.ac.th/money/love/	82 B 82 B	234ms 233ms	Image image/gif	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Show image Full URL http://donkheaw.ac.th/money/love/icon_house.gif Requested by Host: donkheaw.ac.th URL: http://donkheaw.ac.th/money/message.htm Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `9e73ce06041d9f79d717b67f1c0bb6b785a465167eb4c07b1ebb18b9389959c6` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Last-Modified Tue, 02 May 2017 18:04:03 GMT Server Apache/2 ETag "52-54e8e5d72c857" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=98 Content-Length 82
GET H/1.1	404 Not Found	favicon.ico donkheaw.ac.th/	328 B 328 B	234ms 234ms	Other text/html	119.59.120.52 METRABYTE-TH 453 ...
General Check archive.org Show headers Download Go to Full URL http://donkheaw.ac.th/favicon.ico Protocol HTTP/1.1 Server 119.59.120.52 , Thailand, ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH), Reverse DNS ln21.hostingdynamo.net Software Apache/2 / Resource Hash `6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host donkheaw.ac.th Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://donkheaw.ac.th/money/message.htm Connection keep-alive Cache-Control no-cache Referer http://donkheaw.ac.th/money/message.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Response headers Date Tue, 02 May 2017 20:19:45 GMT Server Apache/2 Connection Keep-Alive Keep-Alive timeout=2, max=98 Content-Length 328 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

donkheaw.ac.th
119.59.120.52
553f1edd57c1e7eeb4e450f88d52a68cd56a59c2e22599bb4c38be1a305aafe7
562a545909f70091669e66ed5fcf840ad60984cd1940365f5585bd9a3aa43a28
6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da
6efa91a17f66658c7648671ea9f2a02f83b4388f88c8b12c22a87c67a716f1e2
9b295c5c5c1322c89a950fd13dde98fa8b3109e7d95a0d64c5439e457a80cb46
9e73ce06041d9f79d717b67f1c0bb6b785a465167eb4c07b1ebb18b9389959c6
a1a713e8ba6ce247cf0cc6bbd7f6af490e25344461ad3eaa7a2901bea18e2624
a1b6d90affba68dd140e0f8debbf21b067b9a7bafdbd117f4aa34b199a542bb0
af1524a62640e2c229bee52cca294d6abd0e427139ab91ebd8c44d6e2a9e8131
b8a1430a9f7ed535693c3566e9d39ce740e260a9e625fc5a2d463a80898ca784
c396a7605f7b41b22b81f5fac525aa29387ba4b5904d0bd7fe45aecb65ac78ee
d8d16484a4f6f80d7aa020a1c646c7a09a3b7988923c6483c9efad14aa338257
df462d8bf1b24fd4666ee6780cb85b62e5f2fe390c908f4f27b81b5487ade692
f4e1485013f8c025c983d1169d381c1f09edc214abfc98810f385489c32e5792

donkheaw.ac.th Open in urlscan Pro 119.59.120.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

14 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

24 kBTransfer

90 kBSize

0 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

donkheaw.ac.th Open in urlscan Pro
119.59.120.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

24 kB
Transfer

90 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!