alloythailand.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse
Effective URL:
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php
Submission: On September 26 via api (September 26th 2022, 7:58:28 pm UTC) from ZA — Scanned from NL

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is alloythailand.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 5th 2022. Valid for: a year.

This is the only time alloythailand.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 15	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	2

15 2a06:98c1:3120::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

alloythailand.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	alloythailand.com 2 redirects alloythailand.com	232 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5200	72 KB
14	2

	Domain	Requested by
15	alloythailand.com	2 redirects alloythailand.com
1	assets.nflxext.com	alloythailand.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-05` - `2023-06-04`	a year	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-31` - `2022-10-03`	a month	crt.sh

This page contains 2 frames:

Primary Page: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php
Frame ID: 1A5BC08787C612B37BA51A9474330DDC
Requests: 11 HTTP requests in this frame

Frame: https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1664208000
Frame ID: 6688F910BBA99B0E8EB6A6DAFF33180D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse HTTP 301
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ HTTP 302
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

303 kB
Transfer

676 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse HTTP 301
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ HTTP 302
https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request login.php Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ Redirect Chain https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/ https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php	10 KB 3 KB	1960ms 1958ms	Document text/html	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `54cf8e3428be88aa0e243c6c3a8dad15d2ebfb677a41430c1066ed89795f13f0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 750e92debd1cbbf1-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 26 Sep 2022 19:58:21 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Uj%2BOsB8x4e%2FDjeofHpOQ9IlZr6i2y7ztis39GBeL%2FWWdRqG97r6Sw8NdDupL9X%2BRWzEmhM4BOnLwKslVKeQJ9ssPDPVoxPSeDPxBebuPT5SJutkGF7fcuqrEvKQijw4wJylt4I6Tc1IgqUWAbhvDjQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-turbo-charged-by LiteSpeed Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 750e92c20a0c9a3c-FRA content-type text/html; charset=UTF-8 date Mon, 26 Sep 2022 19:58:19 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I5HG7vIq3fxiJMXT%2Fh3zGFIaVOjgRryQIjluGtlAtsLvHvj8V1VYzUtriUcJe%2FUFdSn5412AQ7yCMlFr5TfvH3WAALtwVRWLDU3RamrSPRzD34QIaef0%2FcSsRSKcHWz13MukM8itdzhw8iAq9nJNRg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-turbo-charged-by LiteSpeed
GET H3	200	none.css alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/	145 KB 20 KB	234ms 234ms	Stylesheet text/css	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none.css Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:25:48 GMT server cloudflare etag W/"245ae-630278ac-2b9d8a;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wPndB5OXtXMTeRNLTjU1FU0pTKfjmKJOxKZP%2B6D9y8B41%2BtEIbW%2BkyR102jFjiaJiaRKwzfJAX5Uqlui%2BZDAWNJn1JN3jEvkdZyRvEieKI%2BJ0e1uFiJhO%2FNRdVUDa9fvm6KnkZ2xdavStnUnn4HJHQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92eaf85abbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	none2.css alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/	163 KB 24 KB	214ms 213ms	Stylesheet text/css	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none2.css Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:25:50 GMT server cloudflare etag W/"28bf6-630278ae-2b9d8b;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=35hKYlYxfRNLM%2FpAF%2F3qVj0kSa9QlkqBjs0APJuj1EZrDTVpPUBgNnXyeFsnVo2E5cQNCDGsc6kk5kjGcpLvCKDwq4CZJjXfgTxch7mLSIoKsQQ7dRFwrCZ%2FhoObOlP15U0ijTqiZY4zg6vOAVyQlQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92eaf85dbbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	modernizr.min.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	4 KB 2 KB	310ms 310ms	Script application/x-javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/modernizr.min.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:26:10 GMT server cloudflare etag W/"edf-630278c2-2b9e0c;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2BG2uhYSxCrXKBdOvz5g3oNNRJ%2B1ceV4sCh5yjVwpz%2BUwhM95%2BPeTiFredftUN4F9xgalAo9%2FNffW4osYXfsZDK%2BN6NWxJF4LxyhPDCCInaQ%2BBsTFcRDK0vYRsiG%2F6qZkLGq2V4uyCfRESn1%2B42A7w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92eaf85fbbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 30 Sep 2022 02:40:43 GMT
GET H3	200	jquery.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	85 KB 31 KB	255ms 254ms	Script application/x-javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:26:08 GMT server cloudflare etag W/"15339-630278c0-2b9e05;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x4LlDjhMrixHhPvhtCdB6mXN8LThdGZ2N0%2F9d1SCPXEBTVwm3H4xoePrIgpYX9U688Vz5s7EU9oBYG5YHfnlgWiQhZvIEW8EM8WIybxBVHomBXJa0uppAGrW05ZAWD3SEveaX9jhdn1m%2Be7N5KnvDg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92eaf860bbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	jquery.ccvalid.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	7 KB 2 KB	274ms 273ms	Script application/x-javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.ccvalid.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:26:06 GMT server cloudflare etag W/"1d12-630278be-2b9e03;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VD0SH%2BKHhkNZOvOCnCJSU6%2FgiMB9PDzsQt75dBtaplJXZnPI8tfgwXcLnUZioaqxNLS5Uml1V93XOfXV09EudbZdglRYOp%2BpORVk1nZjRdekxftag80FSmDQSoTt9sOh1bu5S7NF%2FmfUld0c69UBXg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92eaf862bbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Sun, 02 Oct 2022 15:39:08 GMT
GET H3	200	jquery.mask.js Show response alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/	8 KB 4 KB	33ms 33ms	Script application/x-javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/js/jquery.mask.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:21 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10887 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 21 Aug 2022 18:26:10 GMT server cloudflare etag W/"1fad-630278c2-2b9e06;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KTAqzLfMaiVHpAA3FKA8faqP%2BszLI4swZifvWHgtBSsXKq8da2txwr2n0lLz5gHAeQfX7CZFrzB8kSra5f34Fwht0%2FHnVUkhscgtJujTByPvmeWpUalURyS3%2BFIxUan9g%2Bx5alcFzFoa279fPFdSJg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 750e92eaf863bbf1-FRA expires Tue, 27 Sep 2022 11:54:08 GMT
GET H3	200	bg.jpg alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	117 KB 118 KB	214ms 214ms	Image image/jpeg	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/bg.jpg Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 120105 last-modified Sun, 21 Aug 2022 18:25:54 GMT server cloudflare etag "1d529-630278b2-2b9d9b;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HAAFO1kSuKfTD%2BtLuElDRRPSH%2F8I%2BY712q9ZpZoulySYtWqgjcOf36lT6ItS%2FLmK%2Bdbkk%2BPXbTpn3tCLift05SVensUCnJn9fQ%2Fgb7Y4jUyZSkChDjSsqDvXGkmDEZHvR7Lnk3BQiJxcIWecCwisIg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 750e92ecbc68bbf1-FRA expires Sun, 02 Oct 2022 15:39:08 GMT
GET H3	200	logo.svg alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	864 B 1 KB	210ms 210ms	Image image/svg+xml	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/logo.svg Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Aug 2022 18:26:00 GMT server cloudflare etag W/"360-630278b8-2b9dda;gz" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oUvwezR8nHh%2BXQWLF96HIJ8msyqfq3jqdBn5tzM%2BDFrrdagQyLserBe5n%2BaXip0dMRluv7ZV9D2DAtwnzcLRrP8386D%2ByHdtv9VMbJyjNJyHqMDSKMtaB73rvQh7yjsCXo4erc%2BPfs6FoBhFXgqATQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-turbo-charged-by LiteSpeed cf-ray 750e92ecfcecbbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Wed, 28 Sep 2022 15:11:08 GMT
GET H3	200	fb.png alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/	1 KB 2 KB	293ms 293ms	Image image/png	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/img/fb.png Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers accept-language nl-NL,nl;q=0.9 Referer https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1455 last-modified Sun, 21 Aug 2022 18:25:58 GMT server cloudflare etag "5af-630278b6-2b9dc8;;;" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cCQMGg4XUokwq%2FO8l0RqGHuTioRBdOLmfQRNJ3xWisXLUdSoy%2BlKGvFJhSwgcfRlf11eeG469H6k3MmM4C3WKeBEnhM%2FrJ%2FuelqAbUmht2pd8ZnhEnj%2B61siOyZLQtBraKZkx3Y9OmaXUwd%2BtGAFkw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 750e92ed0d11bbf1-FRA expires Wed, 28 Sep 2022 15:11:09 GMT
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	149ms 50ms	Font font/woff	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/files/css/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer https://alloythailand.com/ Origin https://alloythailand.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 19:58:22 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Mon, 03 Oct 2022 19:58:23 GMT
GET H3	200	invisible.js Show response alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 6688	38 KB 14 KB	31ms 31ms	Script application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1664208000 Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `951f21c3f641d37694487daf56b01ff66715a356f33dfc4477247c63c5e2ea10` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary accept-encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PbBFFMJ7efVfu1IWd%2BpGqTMkGifP4aGX08Ix8ncvoEGtO3fRNDry8vJp23EeSEHqgWZSpAdC6TE%2FN%2F1TBjm3eGP7oElNqD0uDLnSSsP2cEurGjg89iVIDRA20LFspkUMxggRvngXnke8GbZjShNdqg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 750e92ed5dd5bbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	pica.js alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 6688	24 KB 8 KB	29ms 29ms	Other application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: alloythailand.com URL: https://alloythailand.com/wp-content/languages/plugins/seds/acces/abadi/netse/login.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56db10cb82cd98915e1dc0dbfa9db301040e5d4ed06093a5611336bceab4ba2a` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary accept-encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDauCruX%2FBSpIbzs1wvFM092EYbQOIHpjAvuTkm1Urwc3yGPLJPXpOYRCyOSaOc556mqHOUYdzGpk%2BkAcyZPwLYh60LD3C%2BIrJvPIMxJDq9ZjAvAI%2BH2ucTIJKigRAAnaTgPL4W691QR6uohV5xmKg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff cf-ray 750e92ed9e73bbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	750e92debd1cbbf1 Show response alloythailand.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 6688	2 B 670 B	47ms 46ms	XHR text/plain	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alloythailand.com/cdn-cgi/challenge-platform/h/g/cv/result/750e92debd1cbbf1 Requested by Host: alloythailand.com URL: https://alloythailand.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1664208000 Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Content-Type application/json Response headers date Mon, 26 Sep 2022 19:58:22 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ciubcjGzZo7Rfl%2FY4nddR%2FJAjOThUMzqwRe5J3wIS9oqaYSk9CJ0CHsAWCwB9WmeBhJJ9Qef%2Ffpm%2BnauC%2BSmRA6vaDbm%2BMYqkbR7Txod%2FiMunEJGSLB4Nt9dIulnQ%2B2lSm6knaDZWRxrs%2Fo0PKdCwQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 750e92f19eefbbf1-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			alloythailand.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: fphuqjgeooku8qs6ifmmsph4ej
			.alloythailand.com/	1970-01-20 06:17:04	Name: __cf_bm Value: dprkPuibxR950PBn.EG7ifkIiw45NFA7RNwHwgKqkOE-1664222302-0-AY59HNVg4rYKTryps37+t5MiOSV1WwRcbHogbclD/sxcR4n/g1sPXjC5o2w4YH7GJ0YZ/E7XmHkBuFtIgQs1oUuNxU7Qt0vVTMuZmu96vUbSijOTR+7wl/8PRREwc3HzKQ==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alloythailand.com
assets.nflxext.com
2a00:86c0:2091::1
2a06:98c1:3120::3
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
54cf8e3428be88aa0e243c6c3a8dad15d2ebfb677a41430c1066ed89795f13f0
56db10cb82cd98915e1dc0dbfa9db301040e5d4ed06093a5611336bceab4ba2a
72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
951f21c3f641d37694487daf56b01ff66715a356f33dfc4477247c63c5e2ea10
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b
cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669

alloythailand.com Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

303 kBTransfer

676 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

2 Cookies

Indicators

alloythailand.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

303 kB
Transfer

676 kB
Size

2
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!