alloythailand.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/
Effective URL:
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php
Submission: On September 26 via api (September 26th 2022, 7:58:47 pm UTC) from ZA — Scanned from NL

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is alloythailand.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 5th 2022. Valid for: a year.

This is the only time alloythailand.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 14	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	2

14 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

alloythailand.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	alloythailand.com 1 redirects alloythailand.com	232 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5200	72 KB
14	2

	Domain	Requested by
14	alloythailand.com	1 redirects alloythailand.com
1	assets.nflxext.com	alloythailand.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-05` - `2023-06-04`	a year	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-31` - `2022-10-03`	a month	crt.sh

This page contains 2 frames:

Primary Page: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php
Frame ID: 2DF0D42EC33CCDAB2BF17F01EB54C9BA
Requests: 11 HTTP requests in this frame

Frame: https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=750e93570e389072
Frame ID: 71EC2F93267A36D7E359095B769F0A42
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ HTTP 302
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

304 kB
Transfer

678 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ HTTP 302
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ Redirect Chain https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php	10 KB 3 KB	2174ms 2173ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9306dec4eec317219a03adb7e6dbbb70b88c663590d375b3a40bc210f34c4885` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 750e93570e389072-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 26 Sep 2022 19:58:41 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L4ILjIqzRgV8asTkbNRaJuYp8NMFY1k4LCIoXE9dB9JVaYW6guvR4TRpMzvDawlzV%2B90Gvy%2B%2F0Yhog79cOvl3KRzthq4n6KNCtn3NFSaY9yy68g%2BPZ7g72FUo5%2FneASvzVbTN%2BqX19ugYPAI6CtWTA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-turbo-charged-by LiteSpeed Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 750e9338eb169072-FRA content-type text/html; charset=UTF-8 date Mon, 26 Sep 2022 19:58:39 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4JJo0%2BtgF6itszQOp3OHZ%2FsBdfD8sPqVDJI%2FxVBHx6I%2BNUTUFX3xiaeKvV6MWzPCGiWOIx%2BCSrTVobwUQqqNiWmd3W9FDod9UczuDQRRHzYjcfj9eIMq96g11peIRmRJq1%2BgWH0hfABD0OudFk%2FXGg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-turbo-charged-by LiteSpeed
GET H3	200	none.css alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/	145 KB 20 KB	54ms 53ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none.css Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:25:48 GMT server cloudflare etag W/"245ae-630278ac-2b9d8a;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xv4rhYWAvaaQ7EWVopyo%2BUZ8z4syDdxQBKChNElBERe3YWUla%2BMqUervtl4sTchWqxsBcW47yt0NEp784krIkKZlEsaeBaiuwIgC%2FT%2BT%2BULZU6BLYNwnwWFZdvnLHqNZrOyVRtyPIbkQg2gQ18yURQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649bd19193-FRA expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	none2.css alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/	163 KB 24 KB	35ms 34ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none2.css Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:25:50 GMT server cloudflare etag W/"28bf6-630278ae-2b9d8b;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w6q0zcg3RLyoTF%2B0vL1JX%2Fn538wpgVyPB9ZozvGo0KBQZHfJA%2BPJoMMDxGovJoJx%2BVpX6ZEof29S7KpZxqVqDUFW1WC%2BmjmjSk0fYKUlDuaB9aJ9QSGFwHCHNsLxCa3Bse%2Fbj7bbOEFvWQsBw4nIsQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649bd99193-FRA expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	modernizr.min.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	4 KB 2 KB	34ms 33ms	Script application/x-javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/modernizr.min.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:10 GMT server cloudflare etag W/"edf-630278c2-2b9e0c;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XLsz7FQkoDjoKHbjzFaKbgpNN3rhCW1fFB4UipAVc%2FkDy9FNs1%2B%2FvbyOwBW3wAsQ439gD4h%2FdpXZ2BoXB0PEGbW40AjGzTFlzwqM8LWE5audivEW9Qq2X%2BL8fmqWqc17pPKpG%2FwifFS0BTlGcy38GA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649bdb9193-FRA expires Fri, 30 Sep 2022 02:40:43 GMT
GET H3	200	jquery.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	85 KB 31 KB	75ms 74ms	Script application/x-javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:08 GMT server cloudflare etag W/"15339-630278c0-2b9e05;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qA%2FXlK8gHXeH1TZa7O3oKLt2fn92pqXnwttqtJl2YCldIIvf%2FF2EMwTmQyYnfBJi5rw6VX7OALec0RIOosNxIQJG6JjYc%2BfsDT7YkbnC0SW%2B2rF%2Fl6LYhl%2FKAj5bE4eh7tWdtRUdqabuYXozBZXs5w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649bdf9193-FRA expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	jquery.ccvalid.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	7 KB 3 KB	33ms 32ms	Script application/x-javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.ccvalid.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:06 GMT server cloudflare etag W/"1d12-630278be-2b9e03;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5VfHsgFJifk3%2FwAxrmL43l2USBNFKDV48pCTyvQfoA3VEkUk%2F68D7%2B2VQlfKXRef%2FIQ6Xy%2FLsRdOsa%2BGM%2FnWvXVyybqOifZ8YeOvb1cp3JcGy%2B9S4%2FsORtsB%2FRH35ZnKPoBrDXFge%2B8oNcTr2f9ybw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649be19193-FRA expires Sun, 02 Oct 2022 15:39:08 GMT
GET H3	200	jquery.mask.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	8 KB 4 KB	94ms 93ms	Script application/x-javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.mask.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:10 GMT server cloudflare etag W/"1fad-630278c2-2b9e06;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=440ipFuGrDnuEQ%2FHZCNIrJ0RCKZk0QrG9%2FAXjbq7%2B3tnM36WjPgwlVRwOSWGo3Rb4r4pr%2FNyo1tLZ8V0%2BXFuOykDE3aALbgQweL%2BTFlbTUU0bgPN91UsFCJuKV%2FbynksLo8RDdXxlC%2FJ7y%2Bc9vU1vw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93649be39193-FRA expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	bg.jpg alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	117 KB 118 KB	32ms 32ms	Image image/jpeg	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/bg.jpg Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 120105 last-modified Sun, 21 Aug 2022 18:25:54 GMT server cloudflare etag "1d529-630278b2-2b9d9b;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FPVNxO9bKFxsiB%2FUTprlz6pJ03grEJoJvX7HZGZMgJe%2Fu%2FwnOoGSDnGE5AQUmY2VGP3Ap%2FZebhpsdqk3oSkozaolVohLgdkoR3hBshy%2BM%2BZfFS5hk8t8UfTqu07mvSWOkxYQqXhzaAWz8XJH6o7HkQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 750e93653cf39193-FRA expires Sun, 02 Oct 2022 15:39:08 GMT
GET H3	200	logo.svg alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	864 B 1 KB	55ms 55ms	Image image/svg+xml	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/logo.svg Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24420 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:00 GMT server cloudflare etag W/"360-630278b8-2b9dda;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sjTMDhMLt8PVenn589whxZ2vg0F1m3eSCy3fh2q0%2BTyVIH8ygxM0Fm01LeGihzQ7N9%2B6jxrs2MX5gRS5o9ZwUciXPXD2Z8HDHVAVYgsZ5sSfONWhE8ZqHREc60W2AtxtZLPsW%2FkTM6lnMtjjgLHfmQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e93654d279193-FRA expires Wed, 28 Sep 2022 15:11:08 GMT
GET H3	200	fb.png alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	1 KB 2 KB	53ms 53ms	Image image/png	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/fb.png Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24419 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1455 last-modified Sun, 21 Aug 2022 18:25:58 GMT server cloudflare etag "5af-630278b6-2b9dc8;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QmhzgDf3B62E0nQ%2F%2FgNzkcjjp0jGISb%2B17P9dHEMzt6tzaCYqnSj4wKOwQ2IbsLFiQkHXVKgKU5wf8fLliALvEIL%2BjdS07J5ubyrG8aeGeRDNC7Ty23EkphSSd1fQQIcXkpUfGCXkH6W3BX9iHT4CQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 750e93654d309193-FRA expires Wed, 28 Sep 2022 15:11:09 GMT
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	141ms 42ms	Font font/woff	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer https://alloythailand.com/ Origin https://alloythailand.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 19:58:41 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Mon, 03 Oct 2022 19:58:42 GMT
GET H3	200	invisible.js Show response alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/cb/ Frame 71EC	42 KB 15 KB	25ms 25ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=750e93570e389072 Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6a9065afe5c7a3469877da547088c80d0d95c8894ab72df5ce3a3d6069dcf648` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary accept-encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=szaiv%2FzyGjyPXBgUd11sSTNKDLLqptPE7EPu8mNdDs4HPImCuaCVvdRl2PEafXfIsVM77D5Vi6BDcpKQWkixC%2B%2FiINa8%2BhQkDhxKJ0ezHZHRgK6re%2BdWeRpXX66ZePUlmocLgd5blGjGyM4y6pYqeA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 750e9365ae059193-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	pica.js alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 71EC	22 KB 8 KB	27ms 26ms	Other application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `930f16bc26f942d47f42f2597b5731b08f3efeac562773aacbabc21f0dcc391e` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary accept-encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0XmbwO91zpW7x2zHBlXgceCghXuXVZ39hutHxSQB0Q%2BqkdbcC0fiG9ylUhKfM5ATJ7%2BBzv7qq%2BQyhHq4dYn9BVgvkDINQRESc92UYmhntpmU%2BDovmZxGuUtBHdHcA6XRiTgiS3tH%2BtpZh3zNQdyobw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 750e9365ee779193-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	750e93570e389072 Show response alloythailand.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 71EC	2 B 662 B	47ms 47ms	XHR text/plain	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/cv/result/750e93570e389072 Requested by Host: alloythailand.com URL: https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=750e93570e389072 Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Content-Type application/json Response headers date Mon, 26 Sep 2022 19:58:41 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=syV9hexppaw00y32QTsMxyo6YxtGhKknv20ZAj18RibJl7DYosN3S2WokiqLzO3uNKmc5YpimqjWfweYZXpgea%2B7BL%2B9GxcPGEB9QR28ER9SDjTJ8vGiBflasB9gXqzHea6X%2B%2Bi7V3TLoPZpqbdmBw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 750e9367da469193-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			alloythailand.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2u5froqhpcc70nuolulp56f0ml
			.alloythailand.com/	1970-01-20 06:17:04	Name: __cf_bm Value: ABwTI0uXKTsN6Ag39Bzxh5F3dEeJsU6._jhlec7GWxw-1664222321-0-AWm6kfnz3AWFHVAiIc3ktuF7PjHfNPgCHnlsW2anRucrZ/eLZmW6USpBrsHGUP/MqCz81coaLWn3NH7k5xkcy+L27uspVXCrJAXq7QHyCwiv2o/MT2sSYrS4J7S6IPGWTQ==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alloythailand.com
assets.nflxext.com
2a00:86c0:2091::1
2a06:98c1:3121::3
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
6a9065afe5c7a3469877da547088c80d0d95c8894ab72df5ce3a3d6069dcf648
72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
9306dec4eec317219a03adb7e6dbbb70b88c663590d375b3a40bc210f34c4885
930f16bc26f942d47f42f2597b5731b08f3efeac562773aacbabc21f0dcc391e
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b
cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669

alloythailand.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

304 kBTransfer

678 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

2 Cookies

Indicators

alloythailand.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

304 kB
Transfer

678 kB
Size

2
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!