www.denlaschool.ac.th Open in urlscan Pro
206.189.152.81 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ssbcd.blogspot.be/?m=1
Effective URL:
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Submission: On March 29 via api (March 29th 2021, 10:25:26 pm UTC) from IE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 7 domains to perform 19 HTTP transactions. The main IP is 206.189.152.81, located in Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is www.denlaschool.ac.th.
TLS certificate: Issued by R3 on March 29th 2021. Valid for: 3 months.

This is the only time www.denlaschool.ac.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	2a00:1450:400... 2a00:1450:400d:808::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:811::2009	15169 (GOOGLE) (GOOGLE)
2 10	206.189.152.81 206.189.152.81	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
19	5

5 2a00:1450:400d:808::2001 (Ireland) 1 redirects

ASN15169 (GOOGLE, US)

ssbcd.blogspot.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssbcd.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 206.189.152.81 (Singapore) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: sg01.smilehost.net

www.denlaschool.ac.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	denlaschool.ac.th 2 redirects www.denlaschool.ac.th	407 KB
4	blogspot.com ssbcd.blogspot.com	35 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	35 KB
2	blogger.com www.blogger.com	55 KB
1	blogblog.com resources.blogblog.com	136 KB
1	blogspot.be 1 redirects ssbcd.blogspot.be	389 B
0	ip-api.com Failed ip-api.com Failed
19	7

	Domain	Requested by
10	www.denlaschool.ac.th	2 redirects www.denlaschool.ac.th
4	ssbcd.blogspot.com	ssbcd.blogspot.com
2	www.blogger.com	ssbcd.blogspot.com
2	fonts.gstatic.com	ssbcd.blogspot.com
1	resources.blogblog.com	ssbcd.blogspot.com
1	www.gstatic.com	ssbcd.blogspot.com
1	ssbcd.blogspot.be	1 redirects
0	ip-api.com Failed	www.denlaschool.ac.th
19	8

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1O1	`2021-03-11` - `2021-06-03`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-11` - `2021-06-03`	3 months	crt.sh
*.blogger.com GTS CA 1O1	`2021-03-11` - `2021-06-03`	3 months	crt.sh
denlaschool.ac.th R3	`2021-03-29` - `2021-06-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Frame ID: EB3DD4399C0722CB43F86204D849377A
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ssbcd.blogspot.be/?m=1 HTTP 302
https://ssbcd.blogspot.com/?m=1 Page URL
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/ HTTP 302
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883 HTTP 301
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/ Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

19
Requests

95 %
HTTPS

75 %
IPv6

7
Domains

8
Subdomains

5
IPs

3
Countries

668 kB
Transfer

953 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ssbcd.blogspot.be/?m=1 HTTP 302
https://ssbcd.blogspot.com/?m=1 Page URL
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/ HTTP 302
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883 HTTP 301
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://ssbcd.blogspot.be/?m=1 HTTP 302
https://ssbcd.blogspot.com/?m=1

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
ssbcd.blogspot.com/
Redirect Chain

https://ssbcd.blogspot.be/?m=1
https://ssbcd.blogspot.com/?m=1

68 KB
15 KB

272ms
271ms

Document
text/html

2a00:1450:400d:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:808::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b507e1b15e3373fbd9394a32e8fa97b2ab836e305eabb23ef4675abd017755e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: ssbcd.blogspot.com
:scheme: https
:path: /?m=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
expires: Mon, 29 Mar 2021 22:25:06 GMT
date: Mon, 29 Mar 2021 22:25:06 GMT
cache-control: private, max-age=0
last-modified: Mon, 29 Mar 2021 19:43:48 GMT
etag: W/"daa276f3a8df49ada98b9344e0e6f378147899d07fa98b9ccee049971574aa0d"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 14736
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

location: https://ssbcd.blogspot.com/?m=1
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Mon, 29 Mar 2021 22:25:06 GMT
expires: Mon, 29 Mar 2021 22:25:06 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 179
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 clipboard.min.js Show response
www.gstatic.com/external_hosted/clipboardjs/ 12 KB
4 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d3cabd4a8dbdbd2e992e238d11ec889fb3cc7751d9bc271f063a17ec8bf7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4096
x-xss-protection: 0
expires: Mon, 29 Mar 2021 22:25:06 GMT

GET
H2 200 149390559-indie_compiled.js Show response
resources.blogblog.com/blogblog/data/res/ 136 KB
136 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:811::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.blogblog.com/blogblog/data/res/149390559-indie_compiled.js

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f82c5904c7e5d41746a5fb635db74b1d666dc1253479deffa6e6fbdcb26d1486

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 03:53:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 21:21:38 GMT
server: sffe
age: 412306
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 139308
x-xss-protection: 0
expires: Thu, 01 Apr 2021 03:53:20 GMT

GET
H3-Q050 200 sprite_v1_6.css.svg
ssbcd.blogspot.com/responsive/ 7 KB
2 KB 104ms
63ms Other
image/svg+xml 2a00:1450:400d:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssbcd.blogspot.com/responsive/sprite_v1_6.css.svg

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/?m=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 19:41:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 07:07:01 GMT
server: sffe
age: 9803
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2244
x-xss-protection: 0
expires: Mon, 05 Apr 2021 19:41:43 GMT

GET
H3-Q050 404 none
ssbcd.blogspot.com/ 16 KB
16 KB 221ms
182ms Image
text/html 2a00:1450:400d:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssbcd.blogspot.com/none

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ssbcd.blogspot.com/?m=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Mar 2021 22:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14694
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ssbcd.blogspot.com
Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 22:46:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:36 GMT
server: sffe
age: 517113
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15736
x-xss-protection: 0
expires: Wed, 23 Mar 2022 22:46:33 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ssbcd.blogspot.com
Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 23 Mar 2021 15:37:32 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 542854
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15816
x-xss-protection: 0
expires: Wed, 23 Mar 2022 15:37:32 GMT

GET
H3-Q050 200 cookienotice.js Show response
ssbcd.blogspot.com/js/ 6 KB
2 KB 70ms
62ms Script
text/javascript 2a00:1450:400d:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssbcd.blogspot.com/js/cookienotice.js

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/?m=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 19:41:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 07:07:01 GMT
server: sffe
age: 9803
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2026
x-xss-protection: 0
expires: Mon, 05 Apr 2021 19:41:43 GMT

GET
H2 200 2080820689-widgets.js Show response
www.blogger.com/static/v1/widgets/ 143 KB
52 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:811::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/2080820689-widgets.js

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54101ac05b6045cf011eecd0c6ffcbbc98b84391f68af8bf4885d69f956f67f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 14:09:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 23:13:50 GMT
server: sffe
age: 375346
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53149
x-xss-protection: 0
expires: Fri, 25 Mar 2022 14:09:20 GMT

GET
H3-Q050 200 blogger_logo_round_35.png
www.blogger.com/img/ 2 KB
3 KB 35ms
21ms Image
image/png 2a00:1450:4001:811::2009
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.blogger.com/img/blogger_logo_round_35.png

Requested by

Host: ssbcd.blogspot.com
URL: https://ssbcd.blogspot.com/?m=1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

183923f8c8c3960dce8ad9722cf55a30d19b321b721741bd9e2ab6ae1f1ae72a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ssbcd.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 00:00:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 19:10:02 GMT
server: sffe
age: 426273
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2531
x-xss-protection: 0
expires: Thu, 01 Apr 2021 00:00:33 GMT

GET
H2

200

Primary Request / Show response
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Redirect Chain

https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883
https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/

5 KB
2 KB

551ms
550ms

Document
text/html

206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 97380588ea87172d869453bce89bc1dc8f5f241dbb3a15e09fb2bc114c96d153

Request headers

:method: GET
:authority: www.denlaschool.ac.th
:scheme: https
:path: /wp-content/.../Nv1.1/N_v1/Netflix883/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://ssbcd.blogspot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=n1haht20ekefrg7hrl7iqs9a71
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ssbcd.blogspot.com/?m=1

Response headers

server: nginx
date: Mon, 29 Mar 2021 22:25:09 GMT
content-type: text/html; charset=UTF-8
content-length: 2078
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip

Redirect headers

server: nginx
date: Mon, 29 Mar 2021 22:25:09 GMT
content-type: text/html; charset=iso-8859-1
content-length: 275
location: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/

GET
H2 200 style.css
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/css/ 21 KB
5 KB 737ms
736ms Stylesheet
text/css 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/css/style.css
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 2f085a84cb00b9b35b5125231a1accae74aba455992b2b21c28380345ba52c53

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
content-encoding: gzip
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
etag: W/"606253c4-5283"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 app.css
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/css/ 2 KB
913 B 743ms
743ms Stylesheet
text/css 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/css/app.css
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 5efb393cf10db7ee157dcd3109179e7619633c7e8d17c5ab3eab1ea1278f6dd1

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
content-encoding: gzip
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
etag: W/"606253c4-9e2"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 jquery.min.js Show response
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/js/ 152 KB
52 KB 540ms
539ms Script
application/javascript 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/js/jquery.min.js
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 7aa387f2db11236e0a3d6e4124c33bbf9f588dff926a1454a92ce694fc84c620

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
content-encoding: gzip
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
etag: W/"606253c4-261cf"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 validet.js Show response
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/js/ 7 KB
1 KB 743ms
743ms Script
application/javascript 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/js/validet.js
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 3668352cee7c03431751e26e34aebf496fe874ae28a8b96c4481dc129b502822

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
content-encoding: gzip
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
etag: W/"606253c4-1c52"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 bg-login-large.jpg
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/ 342 KB
342 KB 426ms
426ms Image
image/jpeg 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/bg-login-large.jpg
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 68a140f407da7acc8b00ae9eb2be5a09df4b046277a3bfe03881417a068da7e4

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
accept-ranges: bytes
etag: "606253c4-55787"
content-length: 350087
content-type: image/jpeg

GET
H2 200 FB-logo.png
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/ 1 KB
2 KB 707ms
706ms Image
image/png 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/FB-logo.png
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
accept-ranges: bytes
etag: "606253c4-5af"
content-length: 1455
content-type: image/png

GET
H2 200 glob.png
www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/ 842 B
993 B 707ms
706ms Image
image/png 206.189.152.81
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/img/glob.png
Requested by: Host: www.denlaschool.ac.th
URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.189.152.81 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg01.smilehost.net
Software: nginx /
Resource Hash: 4f8072ca4cdc4412083462c38eebc18bb5a0b919fb4bb63ec98769f0b644306e

Request headers

Referer: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 29 Mar 2021 22:25:10 GMT
last-modified: Mon, 29 Mar 2021 22:25:08 GMT
server: nginx
etag: "34a-5beb45ab68d9f"
content-type: image/png
x-accel-version: 0.01
accept-ranges: bytes
content-length: 842

GET json
ip-api.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ip-api.com
URL: http://ip-api.com/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.denlaschool.ac.th/	1969-12-31 23:59:59	Name: PHPSESSID Value: n1haht20ekefrg7hrl7iqs9a71

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.denlaschool.ac.th/wp-content/.../Nv1.1/N_v1/Netflix883/(Line 63) Message: Request failed. Returned status of error

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
ip-api.com
resources.blogblog.com
ssbcd.blogspot.be
ssbcd.blogspot.com
www.blogger.com
www.denlaschool.ac.th
www.gstatic.com
ip-api.com
206.189.152.81
2a00:1450:4001:811::2009
2a00:1450:4001:82a::2003
2a00:1450:400d:808::2001
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
183923f8c8c3960dce8ad9722cf55a30d19b321b721741bd9e2ab6ae1f1ae72a
2f085a84cb00b9b35b5125231a1accae74aba455992b2b21c28380345ba52c53
3668352cee7c03431751e26e34aebf496fe874ae28a8b96c4481dc129b502822
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
4f8072ca4cdc4412083462c38eebc18bb5a0b919fb4bb63ec98769f0b644306e
54101ac05b6045cf011eecd0c6ffcbbc98b84391f68af8bf4885d69f956f67f9
5efb393cf10db7ee157dcd3109179e7619633c7e8d17c5ab3eab1ea1278f6dd1
68a140f407da7acc8b00ae9eb2be5a09df4b046277a3bfe03881417a068da7e4
73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c
7aa387f2db11236e0a3d6e4124c33bbf9f588dff926a1454a92ce694fc84c620
97380588ea87172d869453bce89bc1dc8f5f241dbb3a15e09fb2bc114c96d153
a00d3cabd4a8dbdbd2e992e238d11ec889fb3cc7751d9bc271f063a17ec8bf7d
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b507e1b15e3373fbd9394a32e8fa97b2ab836e305eabb23ef4675abd017755e9
f82c5904c7e5d41746a5fb635db74b1d666dc1253479deffa6e6fbdcb26d1486

www.denlaschool.ac.th Open in urlscan Pro 206.189.152.81 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

95 %HTTPS

75 %IPv6

7 Domains

8 Subdomains

5 IPs

3 Countries

668 kBTransfer

953 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

www.denlaschool.ac.th Open in urlscan Pro
206.189.152.81 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

95 %
HTTPS

75 %
IPv6

7
Domains

8
Subdomains

5
IPs

3
Countries

668 kB
Transfer

953 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!