Report - hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

Report Overview

Submitted URL
hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/
IP
203.131.212.196
ASN
#37992 Thammasat University in thailand
Submitted
2022-11-18 18:35:48
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	682 B	1.6 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.9 kB	34.160.144.191
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606 B	127 B	54.186.209.73
i.imgur.com	5110	2012-05-21T10:09:36Z	2023-03-10T12:17:21Z	381 B	11 kB	151.101.84.193
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	1.4 kB	3.5 kB	23.36.76.226
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
hosting-l.tu.ac.th	unknown	2017-06-29T16:03:53Z	2023-03-08T13:54:42Z	5.9 kB	1.2 MB	203.131.212.196
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3.2 kB	51 kB	34.120.237.76
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-10T05:10:00Z	782 B	2.4 kB	34.102.187.140

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-18	medium	hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/	Malware
2022-11-18	medium	hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	hosting-l.tu.ac.th/nice/POSTBANK/core/token/core_token.js	11 kB	2023-03-07	2023-03-11
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/core/token/core_token.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2023-03-11 14:10:14 Times Seen1 Hash 9079c1cbc61e0f27ebd2cabd737f667a cc3abb2f5ebedd01b1e2f3c2ac1ecbbdad3e06c9 8f49bc9b4670e94d5ccfbe9b8279802d3b3dd3d8272bb01ba570119e795a4c93 Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js	17 kB	2023-03-08	2023-03-11
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 14:49:20 Last Seen2023-03-11 14:10:14 Times Seen1 Hash 5b9f53d4a619c76b5ef4192fb8a62408 73019103630d4fb9754ffe03fc647317750bff45 bfbfe91111d4b9f4046ead448a1067c8de50b91dc7104eb517f45e36dc72854d Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.js	15 kB	2023-03-07	2023-03-11
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2023-03-11 14:10:14 Times Seen1 Hash e87c87ce80479c2497a3c8e9e5bf333d 9a86d204b583a9404606cbe4eed06582da36c804 847b62572ed6998893449d7b8858d8bac034e6111ae8225922b1316f59c8fd80 Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/jquery.min.js	87 kB	2023-03-07	2024-04-25
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/jquery.min.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-25 06:11:30 Times Seen62258 Hash c9f5aeeca3ad37bf2aa006139b935f0a 1055018c28ab41087ef9ccefe411606893dabea2 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/bower_components/angular/angular.min.js	169 kB	2023-03-07	2024-04-17
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/bower_components/angular/angular.min.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-17 21:52:49 Times Seen427 Hash 4c619ef91e3fa3f1d4813db2b2eb738d c5f77156c6f5397be71914eb80d8f998ea1279e7 35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27 Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js	17 kB	2023-03-07	2024-04-19
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-19 23:46:08 Times Seen666 Hash e0ae48c8ebbe57edeacb5b02f16d0df9 0c5a29a88add39486162e0c16f23e2e06fc7842e 0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896 Loading...

	hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/	19 kB	2023-03-08	2023-03-11
Pretty URL hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/ IP 203.131.212.196 ASN #37992 Thammasat University in thailand Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 14:49:20 Last Seen2023-03-11 14:10:14 Times Seen1 Hash 9639f9f36bd58efe2b1342f9b2770ded f5b45833318ea36fb2859e9e90f23d9ede9572ab 5d4fd6d24da0ae984dc56e984e403a301d136d55a4f416ff63cbd5c20912d801 Loading...

HTTP Transactions (33)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
30c30d01178fc74ac5266ee64c3ee85b
c0c2af8a864c00aa85a8775d55f85ab107150a3b
c15644f69fbfeb99074c7e9711dfc9452ee164fa78eb981b6bae4fb7e3585f2a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C15644F69FBFEB99074C7E9711DFC9452EE164FA78EB981B6BAE4FB7E3585F2A"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6541
Expires: Fri, 18 Nov 2022 20:24:38 GMT
Date: Fri, 18 Nov 2022 18:35:37 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
67f53a639d57dd6237b5be86fe4f6c1b
287f09532dc331228d09c20b75f4160e91e9800a
41913a8af366685c42af59e9d8e02fccedbe68a3313d2d9fe353deb0c1019075

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6280
Cache-Control: max-age=150010
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 18:35:37 GMT
Etag: "63775eeb-1d7"
Expires: Sun, 20 Nov 2022 12:15:47 GMT
Last-Modified: Fri, 18 Nov 2022 10:31:07 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3a38b6dd8a4cc335c026aebf2ed348b6
8a386e0ccb0ca4dc502746c45b2ebc3aa3f83cf8
8b4040a645cec1841a00a22765eb3a74978559daf15c54bd4b41b6b48aab7f95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B4040A645CEC1841A00A22765EB3A74978559DAF15C54BD4B41B6B48AAB7F95"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12045
Expires: Fri, 18 Nov 2022 21:56:22 GMT
Date: Fri, 18 Nov 2022 18:35:37 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 18 Nov 2022 17:45:03 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3034
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: r3QeubazE6mMolo6Iu4NTX62axS3JlgkMkhb7USBNqb4zsNQ/vxcWXU/BO28xqcmV5bXnf6V388B/dXU/JBFWA==
x-amz-request-id: V6ZEH97DSP8BRWV7
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 18 Nov 2022 17:53:00 GMT
age: 2557
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 18 Nov 2022 18:35:37 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

203.131.212.196

200 OK

21 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (18851)
Size
21 kB (20658 bytes)
Hash
56e912de9a32dc36fecd078d07746ccd
096be4e625a36c04239113499d47061620897880
8ff2c45a59297c1f3b1da357013e03f77f781448bdaad808cb396420c7b5d087

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/ HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PleskLin
Content-Length: 20658

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 18 Nov 2022 17:44:49 GMT
cache-control: public,max-age=3600
age: 3049
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
fe40cc6ea871d80382b6082111393fbe
281f75d0a35dc8ef908bb0500e57abd86bd5388e
6d15422cdf7a6d72d06497188f27af893682314e82ac8a189a0ee2d798cb62d7

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6040
Cache-Control: max-age=144718
Content-Type: application/ocsp-response
Date: Fri, 18 Nov 2022 18:35:38 GMT
Etag: "63774b30-1d7"
Expires: Sun, 20 Nov 2022 10:47:36 GMT
Last-Modified: Fri, 18 Nov 2022 09:06:56 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

hosting-l.tu.ac.th/nice/POSTBANK/login/form/css.css

203.131.212.196

200 OK

1.1 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/login/form/css.css
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text
Size
1.1 kB (1138 bytes)
Hash
e4be75e19fc47e22f3116499931e32ec
edfc13bd5ceeec02c3591bec57baaf5f09efdead
0017a0ec297bd5f536253c452efe2c4f687d765f8a896b0ee95a6dfffe0fb99a

HTTP Headers

GET /nice/POSTBANK/login/form/css.css HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/css
Content-Length: 1138
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-472"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.css

203.131.212.196

200 OK

1.6 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.css
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text
Size
1.6 kB (1593 bytes)
Hash
7cb237f1013431487a1d30885f903402
4050f25fed5ec008f106b868d4b053ac21cece37
f4d43829a46aca95eff47f13325a06f22c5c8c981cbe102d471508241446c581

HTTP Headers

GET /nice/POSTBANK/core/form/core_form.css HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/css
Content-Length: 1593
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-639"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/core/token/core_token.js

203.131.212.196

200 OK

11 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/core/token/core_token.js
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text
Size
11 kB (11432 bytes)
Hash
9079c1cbc61e0f27ebd2cabd737f667a
cc3abb2f5ebedd01b1e2f3c2ac1ecbbdad3e06c9
8f49bc9b4670e94d5ccfbe9b8279802d3b3dd3d8272bb01ba570119e795a4c93

HTTP Headers

GET /nice/POSTBANK/core/token/core_token.js HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/javascript
Content-Length: 11432
Last-Modified: Tue, 04 May 2021 07:35:34 GMT
Connection: keep-alive
ETag: "6090f946-2ca8"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js

203.131.212.196

200 OK

17 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
Unicode text, UTF-8 text, with very long lines (16817)
Size
17 kB (17048 bytes)
Hash
e0ae48c8ebbe57edeacb5b02f16d0df9
0c5a29a88add39486162e0c16f23e2e06fc7842e
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896

HTTP Headers

GET /nice/POSTBANK/bower_components/ua-parser-js/dist/ua-parser.min.js HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/javascript
Content-Length: 17048
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-4298"
X-Powered-By: PleskLin
Accept-Ranges: bytes

push.services.mozilla.com/

54.186.209.73

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.186.209.73:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: XYcwrBM4jQDABe4Krze3Wg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: hbjKHik35u9Lqz724Ppm/sng1xs=

hosting-l.tu.ac.th/nice/POSTBANK/bower_components/font-awesome/css/font-awesome.min.css

203.131.212.196

200 OK

31 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/bower_components/font-awesome/css/font-awesome.min.css
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text, with very long lines (30837)
Size
31 kB (31000 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /nice/POSTBANK/bower_components/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/css
Content-Length: 31000
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-7918"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.js

203.131.212.196

200 OK

15 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/core/form/core_form.js
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text
Size
15 kB (15166 bytes)
Hash
e87c87ce80479c2497a3c8e9e5bf333d
9a86d204b583a9404606cbe4eed06582da36c804
847b62572ed6998893449d7b8858d8bac034e6111ae8225922b1316f59c8fd80

HTTP Headers

GET /nice/POSTBANK/core/form/core_form.js HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/javascript
Content-Length: 15166
Last-Modified: Tue, 04 May 2021 07:33:15 GMT
Connection: keep-alive
ETag: "6090f8bb-3b3e"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/jquery.min.js

203.131.212.196

200 OK

87 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/bower_components/jquery/dist/jquery.min.js
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text, with very long lines (32058)
Size
87 kB (86659 bytes)
Hash
c9f5aeeca3ad37bf2aa006139b935f0a
1055018c28ab41087ef9ccefe411606893dabea2
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

HTTP Headers

GET /nice/POSTBANK/bower_components/jquery/dist/jquery.min.js HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/javascript
Content-Length: 86659
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-15283"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/bower_components/angular/angular.min.js

203.131.212.196

200 OK

169 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/bower_components/angular/angular.min.js
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
ASCII text, with very long lines (552)
Size
169 kB (168828 bytes)
Hash
4c619ef91e3fa3f1d4813db2b2eb738d
c5f77156c6f5397be71914eb80d8f998ea1279e7
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27

HTTP Headers

GET /nice/POSTBANK/bower_components/angular/angular.min.js HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:44 GMT
Content-Type: text/javascript
Content-Length: 168828
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-2937c"
X-Powered-By: PleskLin
Accept-Ranges: bytes

i.imgur.com/Uy8gvIY.png

151.101.84.193

200 OK

10 kB

URL HTTP/2
i.imgur.com/Uy8gvIY.png
IP
151.101.84.193:0
ASN
#54113 FASTLY

File type
PNG image data, 252 x 252, 8-bit/color RGBA, non-interlaced\012- data
Size
10 kB (10405 bytes)
Hash
5f76fbe1b610b29814a616cc2fe16b14
977220f8d466a311609d1d9836e2a8d1f61fd456
9a0d00c665d412af313e93ebf65fed473a5a0fa79190c1cf739c22c88a8a8a43

HTTP Headers

GET /Uy8gvIY.png HTTP/1.1
Host: i.imgur.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
last-modified: Fri, 20 Sep 2019 06:48:44 GMT
etag: "5f76fbe1b610b29814a616cc2fe16b14"
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
date: Fri, 18 Nov 2022 18:35:39 GMT
age: 2778625
x-served-by: cache-iad-kcgs7200035-IAD, cache-bma1644-BMA
x-cache: HIT, HIT
x-cache-hits: 53, 1
x-timer: S1668796539.481791,VS0,VE6
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
x-content-type-options: nosniff
content-length: 10405
X-Firefox-Spdy: h2

hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

203.131.212.196

200 OK

21 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (18851)
Size
21 kB (20658 bytes)
Hash
56e912de9a32dc36fecd078d07746ccd
096be4e625a36c04239113499d47061620897880
8ff2c45a59297c1f3b1da357013e03f77f781448bdaad808cb396420c7b5d087

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/ HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:45 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PleskLin
Content-Length: 20658

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4798
Expires: Fri, 18 Nov 2022 19:55:37 GMT
Date: Fri, 18 Nov 2022 18:35:39 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4798
Expires: Fri, 18 Nov 2022 19:55:37 GMT
Date: Fri, 18 Nov 2022 18:35:39 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feb1ea6fe-f968-42eb-9bb6-5965ae4e6ce6.jpeg

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feb1ea6fe-f968-42eb-9bb6-5965ae4e6ce6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (7045 bytes)
Hash
e5fb6d72b647aabea33ab4017f4a0847
ed93ac946111340a254b92f8ce27e8be93ae87e8
0782ed4ffaea8f9487461d5a9b0c241d30dfe057676753b24e180d0a94efad99

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feb1ea6fe-f968-42eb-9bb6-5965ae4e6ce6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7045
x-amzn-requestid: e8dace8b-0cc8-4ea0-b47a-e42a66576f72
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-K3EuCIAMFsmQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376aa45-71c191e462be52006858817b;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:40:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: S0Sq8vuP-MbcuYVx_WFXTkmrY966mBTY1Qpowx_E_to1tDk1b8R-Bw==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:52:11 GMT
age: 74608
etag: "ed93ac946111340a254b92f8ce27e8be93ae87e8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6344 bytes)
Hash
a9d32fa3866dd741de610a61a93ad893
4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e
4492338de536cfae6fb42fd37170c60f4fbc281a2a924efe6d2b5af352cd102c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6344
x-amzn-requestid: cac35b04-be3b-4ae1-bb5e-8cedcd7a7db4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: btqOVFCXIAMFcOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63755728-45c28fa333b748520be29b57;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 21:33:28 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: RQqPegf6sdVW0qmrGnUo6EORLuT7BRikwhtF08LAxWNCpLGwGZnG8Q==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 b48dedcc55e63f14261aa92cf2d61522.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:34:03 GMT
age: 75696
etag: "4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e567bc1-d4b1-4dd2-b17e-3595ad1753e5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10281 bytes)
Hash
35da1192dcadc6e329a9e60c16904301
90a146aef85765630a5e09e46a0a8682e204bec1
816d1387a3a91a82f0bdaa2b703b45aa30be206d30d4dd1e8ac5deca13de57ad

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e567bc1-d4b1-4dd2-b17e-3595ad1753e5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10281
x-amzn-requestid: 11dffc4e-71d7-4195-8890-62c8a2092728
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-77EWaIAMF3WA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab7f-3c0dc7e43023af827ac26958;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:45:35 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Xbau-BXu_W5Hu8QaCg3tvwfYMb_8L8F_muNp4gVukeNTmiDW4BAXhA==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:24:03 GMT
age: 72696
etag: "90a146aef85765630a5e09e46a0a8682e204bec1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.8 kB (3759 bytes)
Hash
5d0b6106f00f9fd8b89c2d484a559a1a
399ac393209dcdac7d2188d7aa8d95f04570ef7c
5d8151c9eb558f4a2b8bd2952c6845606ddb0c27e36f6e49aca7e60908cd9fe4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1e93b023-2729-4761-a4ea-05612c0917fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3759
x-amzn-requestid: 8c91ac59-89dc-4218-b69f-0cebb29f301b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bw-wJHgxoAMF-hQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376ab33-4dac305614a92bc52c038222;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 21:44:19 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Mb2-PTjNmt06Wd5jOjQ5WoLY-0NgI80CKPXtwgzBt4n5km8Pu_WN0Q==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 22:08:54 GMT
age: 73605
etag: "399ac393209dcdac7d2188d7aa8d95f04570ef7c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11667 bytes)
Hash
032386e5c9dffff1ba1ee5e8a322d438
dd4fd6c803a9b333bace9a541c6bd183d0c56bb9
0e9f559a0aa7e114c5810a27ba243c0da7b44dc0bf7aec2b7ab32b8f0e2b536c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11667
x-amzn-requestid: 4778d1bd-28c3-4665-89da-046e356087f0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjyD1HE-oAMF0QQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637163b1-53c7330c5fd36d3c4d9e6aed;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:37:53 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: CHi9V7-WaWmG6Y0249CZJnhe_RjvleaGFVXoOnJ62cjrcXoLLKwzgw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 07:20:30 GMT
age: 40509
etag: "dd4fd6c803a9b333bace9a541c6bd183d0c56bb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0dd26f9e-1666-47e7-91b0-4b371ede5e61.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.0 kB (5955 bytes)
Hash
30ad43f65949e7e22e73292e3d684f3d
9404b0071027ac7ec0055a9edfbd607e3a8ae501
b97961cbd2245f9927c1c0406451449d28cca24c98c534cace78321ac62eeeb2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0dd26f9e-1666-47e7-91b0-4b371ede5e61.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5955
x-amzn-requestid: fe915fbe-b1dc-4fbd-8a10-1cb46e08f56c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: btqPjHloIAMFidw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63755730-16deb73f48305b0139b1d9bd;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 21:33:36 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: z5S-G5i9-jfmyOFjA9XYxOt97mvYwjuTMsPv01Hw_N0fbOO2mvQz3A==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 174acb08636ac7d9e9a778bbf1bcbc52.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 21:39:42 GMT
age: 75357
etag: "9404b0071027ac7ec0055a9edfbd607e3a8ae501"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

hosting-l.tu.ac.th/nice/POSTBANK/login/index.css

203.131.212.196

200 OK

220 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/login/index.css
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
Unicode text, UTF-8 text, with very long lines (703)
Size
220 kB (219499 bytes)
Hash
7e69fb5622b40bde0bd88843c7ebf39b
e976236d07e77b9c383cfae2e68627fb2e3f43bf
958bac3fee20e15e22ef42677505deb90d74e7214d66a20a160a03d8c10795ad

HTTP Headers

GET /nice/POSTBANK/login/index.css HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:46 GMT
Content-Type: text/css
Content-Length: 219499
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-3596b"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/login/frutigerltw02-65bold.woff2

203.131.212.196

200 OK

42 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/login/frutigerltw02-65bold.woff2
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
Web Open Font Format (Version 2), TrueType, length 42008, version 1.0\012- data
Size
42 kB (42008 bytes)
Hash
66a825d0bc3b78c378dadbfa19b8ac02
7fb3f4f2d17526585b8440a42eca6d98dbc6ccf6
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d

HTTP Headers

GET /nice/POSTBANK/login/frutigerltw02-65bold.woff2 HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/login/index.css

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:47 GMT
Content-Type: text/plain
Content-Length: 42008
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-a418"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/login/frutigerltw02-55roman.woff2

203.131.212.196

200 OK

49 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/login/frutigerltw02-55roman.woff2
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
Web Open Font Format (Version 2), TrueType, length 49372, version 1.0\012- data
Size
49 kB (49372 bytes)
Hash
f75edc57b3c912b99387c7921e3dfddb
937d62e23c5e4090c6e3cf37536c0df3725c14bb
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c

HTTP Headers

GET /nice/POSTBANK/login/frutigerltw02-55roman.woff2 HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/login/index.css

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:47 GMT
Content-Type: text/plain
Content-Length: 49372
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
Connection: keep-alive
ETag: "5fc34242-c0dc"
X-Powered-By: PleskLin
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/login/favicon-16x16.png

203.131.212.196

200 OK

763 B

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/login/favicon-16x16.png
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
PNG image data, 16 x 16, 8-bit colormap, non-interlaced\012- data
Size
763 B (763 bytes)
Hash
7928dcbd4ef94be62d92d6218e8b917d
93768c3b84bc447a0f4b3449f93e386001106431
705e422f4c2ca8ff8521e6ca5bedf071785a13505c4cfe90693f539cead2b1f7

HTTP Headers

GET /nice/POSTBANK/login/favicon-16x16.png HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:47 GMT
Content-Type: image/png
Content-Length: 763
Connection: keep-alive
X-Accel-Version: 0.01
X-Powered-By: PleskLin
Last-Modified: Sun, 29 Nov 2020 06:40:02 GMT
ETag: "10411da-2fb-5b53929c39480"
Accept-Ranges: bytes

hosting-l.tu.ac.th/nice/POSTBANK/newloader.gif

203.131.212.196

200 OK

557 kB

URL HTTP/1.1
hosting-l.tu.ac.th/nice/POSTBANK/newloader.gif
IP
203.131.212.196:0
ASN
#37992 Thammasat University in thailand

File type
GIF image data, version 89a, 480 x 480\012- data
Size
557 kB (557122 bytes)
Hash
ef8d4e6b20b0cf0d68713fb2f6069042
d62bb4b1a169c88879de3bd2f5c4292b6259a952
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630

HTTP Headers

GET /nice/POSTBANK/newloader.gif HTTP/1.1
Host: hosting-l.tu.ac.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://hosting-l.tu.ac.th/nice/POSTBANK/a1b2c3/9c90353991efac4c6d9c85bb505529ae/login/

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 18 Nov 2022 18:45:45 GMT
Content-Type: image/gif
Content-Length: 557122
Last-Modified: Sun, 15 Sep 2019 22:51:54 GMT
Connection: keep-alive
ETag: "5d7ec08a-88042"
X-Powered-By: PleskLin
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (33)

URL HTTP/1.1

IP

ASN

File type

Size