wichakan.tu.ac.th Open in urlscan Pro
2404:140:2056:0:203:131:212:196 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mutbiocor.com.ar/wp-content/uploads/2022/05/de/
Effective URL:
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/
Submission: On October 13 via manual (October 13th 2022, 10:21:39 am UTC) from DE — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 19 HTTP transactions. The main IP is 2404:140:2056:0:203:131:212:196, located in Thailand and belongs to THAMMASAT-BORDER-AS Thammasat University in thailand, TH. The main domain is wichakan.tu.ac.th.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 29th 2022. Valid for: a year.

This is the only time wichakan.tu.ac.th was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2800:6c0:2::7d 2800:6c0:2::7d	27823 (Dattatec.com) (Dattatec.com)
2 16	2404:140:2056... 2404:140:2056:0:203:131:212:196	37992 (THAMMASAT...) (THAMMASAT-BORDER-AS Thammasat University in thailand)
19	2

1 2800:6c0:2::7d (Rosario, Argentina) 1 redirects

ASN27823 (Dattatec.com, AR)

mutbiocor.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2404:140:2056:0:203:131:212:196 (Thailand) 2 redirects

ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH)

wichakan.tu.ac.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	tu.ac.th 2 redirects wichakan.tu.ac.th	577 KB
1	mutbiocor.com.ar 1 redirects mutbiocor.com.ar	124 B
19	2

	Domain	Requested by
16	wichakan.tu.ac.th	2 redirects wichakan.tu.ac.th
1	mutbiocor.com.ar	1 redirects
19	2

This site contains no links.

Subject Issuer	Validity	Valid
tu.ac.th Sectigo RSA Domain Validation Secure Server CA	`2022-08-29` - `2023-09-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/
Frame ID: 1A635D24787E85D3A8995A115EC2396B
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mutbiocor.com.ar/wp-content/uploads/2022/05/de/ HTTP 302
https://wichakan.tu.ac.th/nice/POSTBANK/ Page URL
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e HTTP 301
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/ HTTP 302
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/ Page URL

Detected technologies

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

74 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

577 kB
Transfer

573 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mutbiocor.com.ar/wp-content/uploads/2022/05/de/ HTTP 302
https://wichakan.tu.ac.th/nice/POSTBANK/ Page URL
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e HTTP 301
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/ HTTP 302
https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://mutbiocor.com.ar/wp-content/uploads/2022/05/de/ HTTP 302
https://wichakan.tu.ac.th/nice/POSTBANK/

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response wichakan.tu.ac.th/nice/POSTBANK/ Redirect Chain https://mutbiocor.com.ar/wp-content/uploads/2022/05/de/ https://wichakan.tu.ac.th/nice/POSTBANK/	728 B 933 B	2766ms 238ms	Document text/html	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `8925d667de169daeda78dc960650fd879a00627c901dfcd2411b6bd2e7983f1b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Type text/html Date Thu, 13 Oct 2022 10:30:57 GMT Server nginx Transfer-Encoding chunked X-Powered-By PleskLin Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Thu, 13 Oct 2022 10:21:30 GMT location https://wichakan.tu.ac.th/nice/POSTBANK/ server Apache x-powered-by PHP/7.3.32
GET H/1.1	200 OK	Primary Request / Show response wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/ Redirect Chain https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e? https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/? https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/?	20 KB 20 KB	461ms 460ms	Document text/html	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `b1a9851de4d0da5dda7a3e6cd0a07e79806f124235faef4e8af5695f667405e3` Request headers Referer https://wichakan.tu.ac.th/nice/POSTBANK/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Type text/html Date Thu, 13 Oct 2022 10:31:00 GMT Server nginx Transfer-Encoding chunked X-Powered-By PleskLin Redirect headers Connection keep-alive Content-Length 0 Content-Type text/html Date Thu, 13 Oct 2022 10:31:00 GMT Server nginx X-Powered-By PleskLin location login/?
GET H/1.1	200 OK	jquery.min.js Show response wichakan.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/	85 KB 85 KB	428ms 427ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/jquery.min.js Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-15283" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 86659
GET H/1.1	200 OK	ua-parser.min.js Show response wichakan.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/	17 KB 17 KB	1385ms 1383ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-4298" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 17048
GET H/1.1	200 OK	font-awesome.min.css wichakan.tu.ac.th/nice/POSTBANK/bower_components/font-awesome/css/	30 KB 31 KB	847ms 420ms	Stylesheet text/css	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-7918" X-Powered-By PleskLin Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 31000
GET H/1.1	200 OK	core_form.js Show response wichakan.tu.ac.th/nice/POSTBANK/core/form/	15 KB 15 KB	873ms 215ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/core/form/core_form.js Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `847b62572ed6998893449d7b8858d8bac034e6111ae8225922b1316f59c8fd80` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Tue, 04 May 2021 07:33:15 GMT Server nginx ETag "6090f8bb-3b3e" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 15166
GET H/1.1	200 OK	core_form.css wichakan.tu.ac.th/nice/POSTBANK/core/form/	2 KB 2 KB	646ms 217ms	Stylesheet text/css	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/core/form/core_form.css Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `f4d43829a46aca95eff47f13325a06f22c5c8c981cbe102d471508241446c581` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-639" X-Powered-By PleskLin Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1593
GET H/1.1	200 OK	core_token.js Show response wichakan.tu.ac.th/nice/POSTBANK/core/token/	11 KB 11 KB	1097ms 422ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/core/token/core_token.js Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `8f49bc9b4670e94d5ccfbe9b8279802d3b3dd3d8272bb01ba570119e795a4c93` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Tue, 04 May 2021 07:35:34 GMT Server nginx ETag "6090f946-2ca8" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 11432
GET H/1.1	200 OK	angular.min.js Show response wichakan.tu.ac.th/nice/POSTBANK/bower_components/angular/	165 KB 165 KB	1113ms 439ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/bower_components/angular/angular.min.js Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-2937c" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 168828
GET H/1.1	200 OK	css.css wichakan.tu.ac.th/nice/POSTBANK/login/form/	1 KB 1 KB	671ms 229ms	Stylesheet text/css	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/login/form/css.css Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `0017a0ec297bd5f536253c452efe2c4f687d765f8a896b0ee95a6dfffe0fb99a` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-472" X-Powered-By PleskLin Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1138
GET H/1.1	200 OK	index.css wichakan.tu.ac.th/nice/POSTBANK/login/	214 KB 215 KB	915ms 455ms	Stylesheet text/css	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/login/index.css Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `958bac3fee20e15e22ef42677505deb90d74e7214d66a20a160a03d8c10795ad` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:01 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-3596b" X-Powered-By PleskLin Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 219499
GET H/1.1	200 OK	form.js Show response wichakan.tu.ac.th/nice/POSTBANK/login/form/	4 KB 4 KB	230ms 230ms	Script text/javascript	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Full URL https://wichakan.tu.ac.th/nice/POSTBANK/login/form/form.js?v=6347e8e494daa Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `9459cfdaef9d197d1f48a2190e65dff33a3906fc7f98f6c28bcad7478c30ef47` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:02 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-f6b" X-Powered-By PleskLin Content-Type text/javascript Connection keep-alive Accept-Ranges bytes Content-Length 3947
GET H/1.1	200 OK	logo.svg wichakan.tu.ac.th/nice/POSTBANK/login/	3 KB 3 KB	222ms 221ms	Image image/svg+xml	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Show image Full URL https://wichakan.tu.ac.th/nice/POSTBANK/login/logo.svg Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:02 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-a9e" X-Powered-By PleskLin Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 2718
GET H/1.1	200 OK	logo-claim.svg wichakan.tu.ac.th/nice/POSTBANK/login/	6 KB 7 KB	243ms 242ms	Image image/svg+xml	2404:140:2056:0:203:131:212:196 THAMMASAT-BORDER-...
General Check archive.org Show headers Download Go to Show image Full URL https://wichakan.tu.ac.th/nice/POSTBANK/login/logo-claim.svg Requested by Host: wichakan.tu.ac.th URL: https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2404:140:2056:0:203:131:212:196 , Thailand, ASN37992 (THAMMASAT-BORDER-AS Thammasat University in thailand, TH), Reverse DNS Software nginx / PleskLin Resource Hash `1ad849d8a916dcde00adb1ee3d0f21c7f636a98b7b2c49f57194f245d37b2e91` Request headers accept-language de-DE,de;q=0.9 Referer https://wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Thu, 13 Oct 2022 10:31:02 GMT Last-Modified Sun, 29 Nov 2020 06:40:02 GMT Server nginx ETag "5fc34242-18ff" X-Powered-By PleskLin Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 6399
GET		iob5_login_alte_anmeldung.jpg wichakan.tu.ac.th/nice/POSTBANK/login/	0 0

GET		iob_5_login_psd2.jpg wichakan.tu.ac.th/nice/POSTBANK/login/	0 0

GET		iob_5_sicherheitshinweis.jpg wichakan.tu.ac.th/nice/POSTBANK/login/	0 0

GET		ng.js wichakan.tu.ac.th/nice/POSTBANK/login/ng/	0 0

GET		token.js wichakan.tu.ac.th/nice/POSTBANK/login/token/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: wichakan.tu.ac.th
URL: https://wichakan.tu.ac.th/nice/POSTBANK/login/iob5_login_alte_anmeldung.jpg

Domain: wichakan.tu.ac.th
URL: https://wichakan.tu.ac.th/nice/POSTBANK/login/iob_5_login_psd2.jpg

Domain: wichakan.tu.ac.th
URL: https://wichakan.tu.ac.th/nice/POSTBANK/login/iob_5_sicherheitshinweis.jpg

Domain: wichakan.tu.ac.th
URL: https://wichakan.tu.ac.th/nice/POSTBANK/login/ng/ng.js?v=6347e8e494e08

Domain: wichakan.tu.ac.th
URL: https://wichakan.tu.ac.th/nice/POSTBANK/login/token/token.js?v=6347e8e494e67

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wichakan.tu.ac.th/nice/POSTBANK/a1b2c3/03d33f02698f49992c2045d4b1033c5e	1969-12-31 23:59:59	Name: bid Value: 03d33f02698f49992c2045d4b1033c5e
			wichakan.tu.ac.th/nice/POSTBANK	1969-12-31 23:59:59	Name: real Value: OK

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mutbiocor.com.ar
wichakan.tu.ac.th
wichakan.tu.ac.th
2404:140:2056:0:203:131:212:196
2800:6c0:2::7d
0017a0ec297bd5f536253c452efe2c4f687d765f8a896b0ee95a6dfffe0fb99a
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
1ad849d8a916dcde00adb1ee3d0f21c7f636a98b7b2c49f57194f245d37b2e91
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
847b62572ed6998893449d7b8858d8bac034e6111ae8225922b1316f59c8fd80
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8925d667de169daeda78dc960650fd879a00627c901dfcd2411b6bd2e7983f1b
8f49bc9b4670e94d5ccfbe9b8279802d3b3dd3d8272bb01ba570119e795a4c93
9459cfdaef9d197d1f48a2190e65dff33a3906fc7f98f6c28bcad7478c30ef47
958bac3fee20e15e22ef42677505deb90d74e7214d66a20a160a03d8c10795ad
b1a9851de4d0da5dda7a3e6cd0a07e79806f124235faef4e8af5695f667405e3
f4d43829a46aca95eff47f13325a06f22c5c8c981cbe102d471508241446c581

wichakan.tu.ac.th Open in urlscan Pro 2404:140:2056:0:203:131:212:196 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

74 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

577 kBTransfer

573 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

Indicators

wichakan.tu.ac.th Open in urlscan Pro
2404:140:2056:0:203:131:212:196 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

74 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

577 kB
Transfer

573 kB
Size

2
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!