office.cpd.go.th
Open in
urlscan Pro
61.19.210.203
Malicious Activity!
Public Scan
Effective URL: https://office.cpd.go.th/ciapd/templates/beez3/china/qocw8903y126cmzyfiv0jnyv.php?3Ab7721680776184d77ef12d4092f4678c079b9...
Submission: On April 06 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on December 20th 2022. Valid for: a year.
This is the only time office.cpd.go.th was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 61.19.210.203 61.19.210.203 | 9931 (CAT-AP Th...) (CAT-AP The Communication Authoity of Thailand) | |
11 | 1 |
ASN9931 (CAT-AP The Communication Authoity of Thailand, CAT, TH)
office.cpd.go.th |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
cpd.go.th
1 redirects
office.cpd.go.th |
154 KB |
11 | 1 |
Domain | Requested by | |
---|---|---|
12 | office.cpd.go.th |
1 redirects
office.cpd.go.th
|
11 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.magicwinmail.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cpd.go.th RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-12-20 - 2023-12-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://office.cpd.go.th/ciapd/templates/beez3/china/qocw8903y126cmzyfiv0jnyv.php?3Ab7721680776184d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22&email=
Frame ID: 120BC75DEAA5D22DE0C7EDC7327E700A
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Mail | 签到Page URL History Show full URLs
-
https://office.cpd.go.th/ciapd/templates/beez3/china/?email=
HTTP 302
https://office.cpd.go.th/ciapd/templates/beez3/china/qocw8903y126cmzyfiv0jnyv.php?3Ab7721680776184d77... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Mail Security
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://office.cpd.go.th/ciapd/templates/beez3/china/?email=
HTTP 302
https://office.cpd.go.th/ciapd/templates/beez3/china/qocw8903y126cmzyfiv0jnyv.php?3Ab7721680776184d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22d77ef12d4092f4678c079b95510dbf22&email= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
qocw8903y126cmzyfiv0jnyv.php
office.cpd.go.th/ciapd/templates/beez3/china/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
25l2ttqanckb91ektwzqcgjxtd.js
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6mdowyfv0k5u2o53i2za2za0k.css
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
2 KB 879 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3ck5cxcjdvota2rci97kovhztq.js
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
90 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3m71yrh4x2a2j2nkhzkrro2qcl.css
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
1 KB 685 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1pcl69g5oyhz36eyspqh37na8.js
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2qbmau5rsj0r418xxfzq45ee9j.gif
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
winmail_bg13.jpg
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
506 B 683 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
winmail_bg13_002.jpg
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
105 KB 105 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_bg.gif
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ixd481lrtotq10keebomtjfld.gif
office.cpd.go.th/ciapd/templates/beez3/china/files/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| BASE64 function| $ function| jQuery function| contact function| encryptPwd function| getvalue function| selectLanguage function| lostUserFocus function| loginCheck function| getPwd function| qrcode function| keypress function| isPlaceholder0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
office.cpd.go.th
61.19.210.203
1280727ec8fbdb680df884b919e60c5b717aa2792ac939f67e717274a3632683
226b6144cdb819eac26eadc929c7bd106af75fb21d0c1ac6ca4f6ba50f4c184d
2d1ac29380f3492e40307ae46c7d17304e74a887dfa7100fef9c240d72ab485d
3e3836e16fd5f7ca5df9ea99dd040f6e4165025428916ba9d426cfc0967ad058
5b9a8eae553e5ed4ee936dd9df9dfeffe151f15c12ed61b59f50635959838776
8469ccbe52adc70adb58c089ca488dbaf56f798d73eb0c719638fdd100bb06b3
ab20ec3ad41b39b0589fe75339d606fa661b1370689886806a3a43ed49cbe7f6
b4c3823d8ec3b9d662ac5a54fcc6521d6df8da6ae7df7b3735de00aeff922ef9
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
d38f84e87d117b21b0eda705ab25837076b1b407cf25e0d1615e6478c3f2d7d7
d7632905368de5b3dd9fdb2ac571d2b7e61d0af61829fd142e106e1f687a59e6