fic.nfi.or.th
Open in
urlscan Pro
203.130.146.110
Malicious Activity!
Public Scan
Effective URL: https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app/
Submission: On November 16 via api from BY — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on February 4th 2023. Valid for: a year.
This is the only time fic.nfi.or.th was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 8 | 203.130.146.110 203.130.146.110 | 7616 (JINET-BKK...) (JINET-BKK-AS-AP Jasmine Internet Co) | |
6 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
10 | 2606:4700::68... 2606:4700::6812:83ec | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:9b77 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::2004 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
30 | 7 |
ASN7616 (JINET-BKK-AS-AP Jasmine Internet Co, Ltd., TH)
fic.nfi.or.th |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 342 |
158 KB |
8 |
nfi.or.th
2 redirects
fic.nfi.or.th |
173 KB |
6 |
nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 5083 |
709 KB |
5 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
417 KB |
2 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
3 KB |
1 |
onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 590 |
295 B |
30 | 6 |
Domain | Requested by | |
---|---|---|
10 | cdn.cookielaw.org |
fic.nfi.or.th
cdn.cookielaw.org |
8 | fic.nfi.or.th |
2 redirects
fic.nfi.or.th
assets.nflxext.com |
6 | assets.nflxext.com |
fic.nfi.or.th
assets.nflxext.com |
4 | www.gstatic.com |
www.google.com
www.gstatic.com |
2 | www.google.com |
assets.nflxext.com
www.gstatic.com |
1 | fonts.gstatic.com |
www.google.com
|
1 | geolocation.onetrust.com |
cdn.cookielaw.org
|
30 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
policies.google.com |
help.netflix.com |
optout.aboutads.info |
www.onetrust.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
fic.nfi.or.th Sectigo RSA Organization Validation Secure Server CA |
2023-02-04 - 2024-02-04 |
a year | crt.sh |
*.1.nflxso.net DigiCert Secure Site ECC CA-1 |
2023-11-03 - 2023-12-09 |
a month | crt.sh |
cookielaw.org Cloudflare Inc ECC CA-3 |
2023-04-01 - 2024-03-31 |
a year | crt.sh |
onetrust.com Cloudflare Inc ECC CA-3 |
2023-11-13 - 2024-11-12 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app/
Frame ID: EE9E24BFBBB6E7E9E821490EC3B04E66
Requests: 25 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly9maWMubmZpLm9yLnRoOjQ0Mw..&hl=de&v=-QbJqHfGOUB8nuVRLvzFLVed&size=invisible&cb=d4955c3y6ei2
Frame ID: 146BCDE9F392DCD0A1D3F66588365ABC
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
NetflixBack ButtonFilter ButtonPage URL History Show full URLs
-
http://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app
HTTP 301
https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app HTTP 301
https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app/ Page URL
Detected technologies
OneTrust (Cookie compliance) ExpandDetected patterns
- cdn\.cookielaw\.org
- otSDKStub\.js
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: FAQ
Search URL Search Domain Scan URL
Title: Help Center
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Corporate Information
Search URL Search Domain Scan URL
Title: Cookies and Internet Advertising
Search URL Search Domain Scan URL
Title: here.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app
HTTP 301
https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app HTTP 301
https://fic.nfi.or.th/upload/NETFLIX/NETFLIX/app/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
fic.nfi.or.th/upload/NETFLIX/NETFLIX/app/ Redirect Chain
|
170 KB 170 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginControllerClient.js.686362d355434dbd3997.js
assets.nflxext.com/web/ffe/wp/components/login/ |
1 MB 295 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
fic.nfi.or.th/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-page.b4d75d715f60a9ee1887.css
assets.nflxext.com/web/ffe/wp/less/core/ |
17 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginBase.09e271325f8873705389.css
assets.nflxext.com/web/ffe/wp/less/login/ |
59 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login.f701fd76ffbab95b6def.css
assets.nflxext.com/web/ffe/wp/less/pages/login/ |
80 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
US-en-20220711-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/1ef84595-1fdb-4404-adac-15215ceeb3ae/9b7e4892-200e-4740-909b-cdd33763fe9f/ |
311 KB 312 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
fic.nfi.or.th/personalization/cl2/freeform/ |
320 B 500 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteScreen
fic.nfi.or.th/personalization/cl2/freeform/ |
320 B 500 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
87b6a5c0-0104-4e96-a291-092c11350111.json
cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/ |
6 KB 2 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ |
59 B 295 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202301.1.0/ |
395 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
enterprise.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
fic.nfi.or.th/personalization/ |
297 B 477 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en.json
cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/55af99db-f9fd-4653-abf3-199720a8670a/ |
58 KB 15 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otFlat.json
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/ |
13 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otPcTab.json
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/v2/ |
62 KB 13 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202301.1.0/assets/ |
21 KB 4 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ |
468 KB 188 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/ |
497 B 488 B |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Netflix_Logo_PMS.png
cdn.cookielaw.org/logos/dd6b162f-1a32-456a-9cfe-897231c7763c/4345ea78-053c-46d2-b11e-09adaef973dc/ |
16 KB 16 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
powered_by_logo.svg
cdn.cookielaw.org/logos/static/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/enterprise/ Frame 146B |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 146B |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 146B |
468 KB 188 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 146B |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 146B |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
fic.nfi.or.th/personalization/ |
297 B 477 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| documentPictureInPicture object| OneTrustStub function| OptanonWrapper object| netflix string| __public_path__ string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| webpackChunkshakti function| _ object| util object| Optanon object| OneTrust object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_6546322 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
fic.nfi.or.th/ | Name: PHPSESSID Value: f7p0t6q0v14imkktcinnu9v0s2 |
|
.fic.nfi.or.th/ | Name: cL Value: 1700097403335%7C170009740321247965%7C170009740374365736%7C%7C4%7Cnull |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
cdn.cookielaw.org
fic.nfi.or.th
fonts.gstatic.com
geolocation.onetrust.com
www.google.com
www.gstatic.com
203.130.146.110
2606:4700:4400::ac40:9b77
2606:4700::6812:83ec
2a00:1450:4001:81c::2003
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2004
2a00:86c0:2091::1
0819a946b01d40bc0595f31cff5d4567a357e0d6f7ea98ed425d384dd7c47b37
0c298cd85f1ad1d81325fa3e6b2f7aa421f36fcc5cc2626802edf4f781b832a7
0cda584e7c5036ad66d7d528d2209bc596a14179fa1792a559e2ae9eaa91e851
1188cd5ce1e0278c760cfe2f10a183e50adfff4da63ea66967d2a348cc6c94a8
1a4065ead26a118363a9ee57fbbf14747fbb890cb8c02806ffdba6ca1e01e6ba
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
2c104eee3180999e4fbeb864f1c9f657c2bf650d0e1cddfd1d37ff16c721b022
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
525678da1e519dac3aedbe8d0ade045f39dbfe6c4d1e942dc91546ea3ea3f984
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
61af725fda8e6a4a626edf38c9b655bd0afedfb4c90dd7de5d7a7bb523ca7420
675dd7b68acf580f893bec532f5b260b8f984b67734a9a6831334b2ff4aad384
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
983871cac9e719263fcecaa540c4e1597c8ece1805845830ec21fef0e71d9f88
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
992c42bd5f23100c660699b2d71f03874aaf19dc54ab1c40617e6726d072a1b3
9d69235daf0df021876c6a159d1b0804fe00d19bd4f17a6290d8fe1178071e1c
a9c89c2a0df62b9bd73d859ae616ffe92cb9e86e1428a1a0fc797418f3e03dd9
b08b17378443760572947cee522db6aa8ac11c3ae74a3a7ba80bf8031d4f8e15
c4ace9f2044d3762bdcc1af1bd30a4507d68c073eba3f46864cb55affd8a4299
c50d81f310847f9dd5c054871180b211c7f4a9eccbb42ee95f9574880b56ef73
dcfaae47f11e3c532e108520cdf71840e04652437a952cb08546db3559711828
ed008e83e196197a1bd7fcce22ba1774aaf55874adccd3a7702dc462ce6bb731