Report - nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

Report Overview

Submitted URL
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/
IP
118.174.3.51
ASN
#131293 TOT Public Company Limited
Submitted
2022-11-24 06:39:42
Access
Website Title
Final URL
Tags
None
urlquery detections
Phishing - Chronopost
Phishing - Chronopost

Detections

urlquery
9
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
kit-free.fontawesome.com	22974	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	412 B	859 B	172.67.168.25
nites.ayutthaya2.go.th	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.9 kB	91 kB	118.174.3.51
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	316 B	32 kB	142.250.74.170
ocsp.sca1b.amazontrust.com	1015	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	350 B	1.0 kB	54.230.245.39
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	43 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	4.4 kB	23.36.76.226
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	3.9 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191
cdnjs.cloudflare.com	235	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	746 B	38 kB	104.17.24.14
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.187.71.185
stackpath.bootstrapcdn.com	2467	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	455 B	33 kB	104.18.11.207
s3-us-west-2.amazonaws.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	406 B	177 kB	3.5.82.157

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-11-23	medium	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/	Chronopost International

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-24	medium	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/	Phishing
2022-11-24	medium	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js	3.7 kB	2023-03-07	2024-01-21
Pretty URL nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js IP 118.174.3.51 ASN #131293 TOT Public Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:25:48 Last Seen2024-01-21 04:17:54 Times Seen115 Hash 00ca6d4788cc2627074ca89ee2a0941d d44f64faa887a6d08405b73acc360c5a818bdbe4 1cbfd3959406f3f878e6f64133e4d7baece38558bbbcee1a11a0a2d8ee1b8352 Loading...

	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/	185 B	2023-03-07	2024-02-26
Pretty URL nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/ IP 118.174.3.51 ASN #131293 TOT Public Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:36 Last Seen2024-02-26 20:12:06 Times Seen33 Hash abc584713f9d21c4094071d977cb3e90 83b1a36b4a8bd30cd84d3655d00c25af4e772857 bc6efc0f40ecfe8f7236e88f59323904b137fd5bc65153ea2e2f82ed9acd0a9b Loading...

	s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js	176 kB	2023-03-07	2024-04-15
Pretty URL s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js IP 3.5.82.157 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:11 Last Seen2024-04-15 06:23:30 Times Seen777 Hash f0b02d9f2d3c6679556e63935ac23320 384bb74cdb2840da6eaa9400242faf4a2fac3daa f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b Loading...

	nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/	370 B	2023-03-07	2023-03-14
Pretty URL nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/ IP 118.174.3.51 ASN #131293 TOT Public Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:36 Last Seen2023-03-14 00:49:33 Times Seen1 Hash 45c3bde5800d3df1005f61a852a5d22a 6af9ff81657b9d8bde209a24c1deb6f67b7b21d8 f5a8ce90ca53454a9a604e7c8619bd42d978e5df57719187811d14e487db096f Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js	87 kB	2023-03-07	2024-04-23
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-23 08:23:23 Times Seen263350 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	88 kB	2023-03-07	2024-04-23
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-23 09:03:55 Times Seen95298 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

HTTP Transactions (37)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dfb72f04bd7a4410640c0543bb4bd402
7c63b7e220b337b6a4f39864e11d6aa9e26c38ac
b7f7a4d355ed3b847a5e28f16030d5cbc715d47326aea20f292cd76dcaf59794

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B7F7A4D355ED3B847A5E28F16030D5CBC715D47326AEA20F292CD76DCAF59794"
Last-Modified: Mon, 21 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18794
Expires: Thu, 24 Nov 2022 11:52:45 GMT
Date: Thu, 24 Nov 2022 06:39:31 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
770d09773b5f304acf141fd66a4862b4
5ddc46ab75de26c858a9a6f6d1beaaec9bb181f5
c7bcc6928fa1c0bb225ce8a2f6badd6cb1bd6ea002fb808ed34e8dafbd7b3b26

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2483
Cache-Control: max-age=102788
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:31 GMT
Etag: "637df674-1d7"
Expires: Fri, 25 Nov 2022 11:12:39 GMT
Last-Modified: Wed, 23 Nov 2022 10:31:16 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 24 Nov 2022 06:18:57 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1234
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
054ff0d1a0a43f7cb1d78dbd34e27f99
3caf54f3de1d6a8c6f6454083f8b8e7dec77db54
fcdcef8306ae31f20c366489e1f88aa40b08f154d25d45f4055c4f8cdef47634

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FCDCEF8306AE31F20C366489E1F88AA40B08F154D25D45F4055C4F8CDEF47634"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3338
Expires: Thu, 24 Nov 2022 07:35:09 GMT
Date: Thu, 24 Nov 2022 06:39:31 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: x/4zp+FEv3c0tFke0o5k2i3VvpdPlIya9TZ1JJBrDPNgXtt/lAo1KmzOveUmNNqXihhMYPgpNI2A87fQi4unFw==
x-amz-request-id: 9F3THMQQJVRR5X7Y
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 24 Nov 2022 05:40:17 GMT
age: 3554
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 24 Nov 2022 06:39:31 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 24 Nov 2022 06:08:53 GMT
cache-control: public,max-age=3600
age: 1838
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
eb52164d651f5f45416e873aec29eb04
405b29bb7e7cd4367cf82988f8603e53db65f139
ed885e05db822ff30fe951e10b6d4f21e574d053939afca792992a1549a15301

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3410
Cache-Control: max-age=98652
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:31 GMT
Etag: "637de2ad-1d7"
Expires: Fri, 25 Nov 2022 10:03:43 GMT
Last-Modified: Wed, 23 Nov 2022 09:06:53 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

118.174.3.51

200 OK

7.9 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
7.9 kB (7917 bytes)
Hash
31a57f6da4fb4f6fc95e06008a83c558
5e6e7d978b6b193bace94866fafe2ee67d26caf2
84d40c16374c157dc62b47d7006ea528866bdbac072f176c021e39c65f829b7a

Detections

Analyzer	Verdict	Alert
openphish	Chronopost International
fortinet	Phishing

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/ HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Server: Microsoft-IIS/10.0
X-Powered-By: PHP/7.0.30
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 7917

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
8decaadbcb0c69a906c8bf71e6b3c3a4
f44a711439756490b4555f8e370068dfb8678b03
5b9187a2745a33f4a3d2f0f748b62b581536578a12f252712d848dfc5028827a

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3959
Cache-Control: max-age=91676
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:31 GMT
Etag: "637dc548-118"
Expires: Fri, 25 Nov 2022 08:07:27 GMT
Last-Modified: Wed, 23 Nov 2022 07:01:28 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 280

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

104.17.24.14

200 OK

30 kB

URL HTTP/1.1
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (32030)
Size
30 kB (30244 bytes)
Hash
04ba0252a9f264db106d4eaab8df4ccb
cf52d9b3df7839c5c64fbf33aafeced74b3db750
397852429e768ffbd12a78ce4b94f14e3ab4afabf84acb07c0bb5b7798e6e0b2

HTTP Headers

GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/

HTTP/1.1 200 OK
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 30244
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5eb03ec4-152b5"
Last-Modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
CF-Cache-Status: HIT
Age: 70145
Expires: Tue, 14 Nov 2023 06:39:31 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2FZ9BNn1t5sxi%2F5HLbX4%2B4HPRhez0mNTnOYAa6nEQgAOZLoi771qHLWt8rs68qAmTMjIyzlpif07RNMk4dlepwI9L0XNFt7c4M0hnFkEaOihOpsnt7KWxXKaloi7JB0XC898OPbc"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76f025e0eb8e0b3d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.24.14

200 OK

5.6 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
109d1ed85cd01f9cdab73a4cac5bf80d
d6c6498ad46de2d8e2008a8ff68e364ae7f16b32
8b3a74fe462f5b3c0635995fd721a60eb640e237680b0b532b96711f2823e8bc

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 24 Nov 2022 06:39:31 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 117280
expires: Tue, 14 Nov 2023 06:39:31 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uWRRx3l5MlwTI6DuSayBKGNjaBlkRrRGSHd4JIQxJBgy0tSG2qkbTKoY79zpsAKeiLkDN04RVtx89T%2FokalWB5PaF9fnH6my0LxDuBrKkcQteu6miauBfl9hQWzAyxZBB3bRW0jL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76f025e0fe5e0b06-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
594ee225becbf13bbb08d20aee5be3b6
686f66228d3583003469d3dd499111b86a95b985
bfb46e537fb80231c886d3bcb0c7daa76a1fb2aa5e7e5e1600ef271e6cb210f6

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6118
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:31 GMT
Last-Modified: Thu, 24 Nov 2022 04:57:33 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 279

ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

142.250.74.170

200 OK

31 kB

URL HTTP/1.1
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
142.250.74.170:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65451)
Size
31 kB (30774 bytes)
Hash
81182f4b684635f6bdcbdd907ee66f25
a1f2f151df72ede41397c8131bd47a3ce85575b3
be40946c98d9a78a3c7c9ad097d379ab12549a195bd7a4766919a1d3fd987396

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 30774
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 22 Nov 2022 09:56:56 GMT
Expires: Wed, 22 Nov 2023 09:56:56 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Age: 160955
Last-Modified: Mon, 13 May 2019 14:37:17 GMT
Content-Type: text/javascript; charset=UTF-8

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
8decaadbcb0c69a906c8bf71e6b3c3a4
f44a711439756490b4555f8e370068dfb8678b03
5b9187a2745a33f4a3d2f0f748b62b581536578a12f252712d848dfc5028827a

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3960
Cache-Control: max-age=91676
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:32 GMT
Etag: "637dc548-118"
Expires: Fri, 25 Nov 2022 08:07:28 GMT
Last-Modified: Wed, 23 Nov 2022 07:01:28 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
594ee225becbf13bbb08d20aee5be3b6
686f66228d3583003469d3dd499111b86a95b985
bfb46e537fb80231c886d3bcb0c7daa76a1fb2aa5e7e5e1600ef271e6cb210f6

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6119
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 24 Nov 2022 06:39:32 GMT
Last-Modified: Thu, 24 Nov 2022 04:57:33 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 279

push.services.mozilla.com/

54.187.71.185

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.187.71.185:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: BupWExVeniwEa4mwT8Uh3A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 0fV0m9aJBN7l5kq3h1E1uxeeILM=

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/style.css

118.174.3.51

200 OK

2.8 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/style.css
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
ASCII text, with CRLF line terminators
Size
2.8 kB (2762 bytes)
Hash
43147d198061a3cc9d1cdb09697ca912
b5e4a5153781487e15aececaa4dd9465338519cd
ad0e79376d3a17afcef8306e5025d805a9e252eb31d2c56fa510cfe5851e8d42

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/style.css HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: text/css
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "626eb423acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 2762

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js

118.174.3.51

200 OK

3.7 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
ASCII text, with CRLF line terminators
Size
3.7 kB (3718 bytes)
Hash
00ca6d4788cc2627074ca89ee2a0941d
d44f64faa887a6d08405b73acc360c5a818bdbe4
1cbfd3959406f3f878e6f64133e4d7baece38558bbbcee1a11a0a2d8ee1b8352

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/chronopost_if.js HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: application/javascript
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "626eb423acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 3718

ocsp.sca1b.amazontrust.com/

54.230.245.39

200 OK

471 B

URL HTTP/1.1
ocsp.sca1b.amazontrust.com/
IP
54.230.245.39:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
3d4d2030c51392799b52bfe5e9e6e573
e0ddad082f280562e02188fbd8db7402ae5f28d6
e3ae19f2cd8dfa140f3e396676e2a27f8fa3bb21c86150530dc4d4ee380f3927

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=134797
Date: Thu, 24 Nov 2022 06:39:32 GMT
Etag: "637e6b06-1d7"
Expires: Fri, 25 Nov 2022 20:06:09 GMT
Last-Modified: Wed, 23 Nov 2022 18:48:38 GMT
Server: ECS (bsa/EB24)
X-Cache: Miss from cloudfront
Via: 1.1 6259d2cd8a5947ad41a420527bbed7a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 8SURzbwct6pHEcgFnS5ktBivOkVE4yWcAbLNud6qEAK0UNvO644WuA==
Age: 4651

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/Capture.png

118.174.3.51

200 OK

1.9 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/Capture.png
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
PNG image data, 194 x 34, 8-bit/color RGBA, non-interlaced\012- data
Size
1.9 kB (1948 bytes)
Hash
e42b8fc7b9b5f270f844353a5945fef5
72e19086fcdb5d15bd1501f999532c460846132f
b5bd9e64eea624aa2343f918af01f093ec4f2df1ca74b77eb1e10eecd596b336

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/Capture.png HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "5047ad23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 1948

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo.png

118.174.3.51

200 OK

17 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo.png
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
PNG image data, 339 x 77, 8-bit/color RGBA, non-interlaced\012- data
Size
17 kB (16564 bytes)
Hash
c33a8f71f937b74aa1c92c074bc57e30
8cedfc20a2e9b83a7478a2f88ee90e226faa5a4b
a1d4dc7ed12cbd39ab6e8d1f572312c75c1051047a0c5b40b78721c6f6f4f934

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo.png HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "71abaf23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 16564

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_tours_03712200_113425863.jpg

118.174.3.51

200 OK

14 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_tours_03712200_113425863.jpg
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3\012- data
Size
14 kB (14094 bytes)
Hash
df1086e658818d5b7ac4d7e8af7ed2c6
621741b6c59d7703ea055f3598d6b03a86829140
2309a3b42db8684ed57dce9e29ed418477acb7740b979a15004f3e1f28b5e5ca

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_tours_03712200_113425863.jpg HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "5047ad23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 14094

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo_small.png

118.174.3.51

200 OK

6.7 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo_small.png
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
PNG image data, 170 x 39, 8-bit/color RGBA, non-interlaced\012- data
Size
6.7 kB (6690 bytes)
Hash
83844a55b0719c2c568323edcc3aa72f
904ae759c546c8055bc558670db715c03d5d5e3b
277b3d7509e18a5853b95de911547f1453ad45c201bee91ccdc814d8441ddf11

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/chronopost_logo_small.png HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "5047ad23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 6690

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/dpd-logo.png

118.174.3.51

200 OK

3.3 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/dpd-logo.png
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
PNG image data, 128 x 33, 8-bit/color RGB, non-interlaced\012- data
Size
3.3 kB (3305 bytes)
Hash
f34de078547c6cb96064a9b2ea61c251
267eec3f02fd2f6ec8ce0218f812ad1c8f517aee
bc5fa15b90d078322fac07419dbce0372e156a38d69c6b3abc38bf29ad476b32

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/dpd-logo.png HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "5047ad23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:31 GMT
Content-Length: 3305

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b75c00c21f5854618bc06d14b8d83c40
ae14f585ae9682e6c2fad146c12c00ee4d83e8f3
a8e7585e49b01a64520051f8d38f499c8cb82645e3d146e6ca34378eac684e69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8E7585E49B01A64520051F8D38F499C8CB82645E3D146E6CA34378EAC684E69"
Last-Modified: Wed, 23 Nov 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5370
Expires: Thu, 24 Nov 2022 08:09:03 GMT
Date: Thu, 24 Nov 2022 06:39:33 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b75c00c21f5854618bc06d14b8d83c40
ae14f585ae9682e6c2fad146c12c00ee4d83e8f3
a8e7585e49b01a64520051f8d38f499c8cb82645e3d146e6ca34378eac684e69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8E7585E49B01A64520051F8D38F499C8CB82645E3D146E6CA34378EAC684E69"
Last-Modified: Wed, 23 Nov 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5370
Expires: Thu, 24 Nov 2022 08:09:03 GMT
Date: Thu, 24 Nov 2022 06:39:33 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b75c00c21f5854618bc06d14b8d83c40
ae14f585ae9682e6c2fad146c12c00ee4d83e8f3
a8e7585e49b01a64520051f8d38f499c8cb82645e3d146e6ca34378eac684e69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8E7585E49B01A64520051F8D38F499C8CB82645E3D146E6CA34378EAC684E69"
Last-Modified: Wed, 23 Nov 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5370
Expires: Thu, 24 Nov 2022 08:09:03 GMT
Date: Thu, 24 Nov 2022 06:39:33 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F433fbaf5-7c54-485b-af70-542e1e788832.webp

34.120.237.76

200 OK

5.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F433fbaf5-7c54-485b-af70-542e1e788832.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.1 kB (5070 bytes)
Hash
0856fdb55f19f03a1bec38b3d6e0ac77
89accd230fba95fe0049678070817b36ead015fa
17c6e6f9bb8f4261fff2dc2a43ed994986418761624b8afead768e89927594f2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F433fbaf5-7c54-485b-af70-542e1e788832.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5070
x-amzn-requestid: d86d95ad-9b78-4047-82e7-04e83a97e330
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEwViF1GIAMF_PQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9423-10809ba1634776171cf79cb8;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:44:03 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rrs7G6Wto6iY0rT6KsKwKAOPJjehXqD0jHZrR_eaiqpepQILFr7Dtw==
via: 1.1 0dc4feb22bb4657ce2bb95fd05ec7122.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:49:07 GMT
age: 31826
etag: "89accd230fba95fe0049678070817b36ead015fa"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe021fc4e-f76c-4fe9-9470-b59452c93459.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11401 bytes)
Hash
eb94ecb5881a7e49d964e4287d11e7a4
4b131a189db1b615e2519a28cad83d78297ab67f
f3693e29eb7b72361093434142e3f18969c1a0b02350fab430fa29c7c127bd1a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe021fc4e-f76c-4fe9-9470-b59452c93459.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11401
x-amzn-requestid: 3bc374eb-7d70-4b95-94a7-2ad06cae4726
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCtHcmoAMFxgw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-333793987245ff9e741b9aed;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: K4A6bdVv0gauO3YWTEPWMS6fhuB9CZ6o5dUL-O6G5-NzqOGQRzQLUw==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:49:04 GMT
age: 31829
etag: "4b131a189db1b615e2519a28cad83d78297ab67f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (7993 bytes)
Hash
92c78302bcce1568eb6a5563100b932c
43d1dec7fc06879988c9c3cadd800cc8145df988
0dda9914306c8e3a7ea75eade8e762652d93907dd6c5a8cc81707d6d8098b60a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7993
x-amzn-requestid: 9f0ff853-4819-47cd-959d-658401ea5748
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCsG5mIAMFqAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-1c48b9223684f2942f8dd42d;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YJuHCuUgkLuFFiQUlrPWgv9grHznufMTU08hi4ZMpQTBmou6BGWrhQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:47:52 GMT
age: 31901
etag: "43d1dec7fc06879988c9c3cadd800cc8145df988"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0a474c96-6cd7-4e42-a54a-02217768182e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8089 bytes)
Hash
c8f6118fc03f31862ff68fef8a2b9a7f
318c5d7acd0d36c816b09fcf1b7dc4bfb5ec7e73
cdd4d44f05cc524d7f2b1d6d792ecd8a9a933e52ecb7685a7d7ea786a510ef39

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0a474c96-6cd7-4e42-a54a-02217768182e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8089
x-amzn-requestid: f3c55266-9b03-4b7f-b076-fdf56704318e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b0QQyECioAMFzdQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6377fa6b-3e10cef6117a10a4115cfce7;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 21:34:35 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ngJvyUydpRDSiYy9kfeh8JmydmR_K8mjfZtGLgT0qeE2JaABbDMSaQ==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 22:06:51 GMT
age: 30762
etag: "318c5d7acd0d36c816b09fcf1b7dc4bfb5ec7e73"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

104.18.11.207

200 OK

32 kB

URL HTTP/2
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
IP
104.18.11.207:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65324)
Size
32 kB (32313 bytes)
Hash
aa784e9584db565289e324252ae305f7
fc615eacd8bd7ec2c615420ab6900d3df5f297de
4cce87c253b9accbf342b4931235654d44eedd5a74176510c3630528caf9a481

HTTP Headers

GET /bootstrap/4.5.0/css/bootstrap.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://nites.ayutthaya2.go.th
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 24 Nov 2022 06:39:32 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"3afe15e976734d9daac26310110c4594"
last-modified: Mon, 25 Jan 2021 22:04:10 GMT
cdn-cachedat: 08/20/2022 02:33:27
cdn-proxyver: 1.02
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 865
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 6173ab56293ef7c557e653270c5fd017
cdn-cache: HIT
cf-cache-status: HIT
age: 44836
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 76f025e0fe3eb4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a9a0208-d5ae-4e15-bd4d-c5c19edf354e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.5 kB (5545 bytes)
Hash
1404c6b865808ea73ca5b2062fefecc0
c66fd3a955cd81ab93474fb1aabc4c19d5775bcc
0a92ca52eff8baa4ba43bdb29008c59bcd37c55e78ac657de25819e980ea8e96

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a9a0208-d5ae-4e15-bd4d-c5c19edf354e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5545
x-amzn-requestid: 215b9f9b-4941-4c13-a1d4-6fdc5b453fad
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCtEkIIAMF3gg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-27081b9e0dc1de6522299e4e;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: SFO53-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Xr183esurgfu-4jjQtCS5s_np_CtltrPx48zpq-NMwZbcGnAwTxtkg==
via: 1.1 68914922a694954838e87fc9b0aa10fe.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:51:07 GMT
age: 31706
etag: "c66fd3a955cd81ab93474fb1aabc4c19d5775bcc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js

3.5.82.157

200 OK

176 kB

URL HTTP/1.1
s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js
IP
3.5.82.157:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (544)
Size
176 kB (176433 bytes)
Hash
f0b02d9f2d3c6679556e63935ac23320
384bb74cdb2840da6eaa9400242faf4a2fac3daa
f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /s.cdpn.io/3/jquery.inputmask.bundle.js HTTP/1.1
Host: s3-us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
x-amz-id-2: CEQVzVUD2R65YtfNdMVrUOnmIrrCGG86nvew+mY4Ute9johvCs3x9k7FVpfPgYTUAq9bn3XM0EmuGNjIdHNcxQ==
x-amz-request-id: 96E34AP582P9JP0B
Date: Thu, 24 Nov 2022 06:39:33 GMT
Last-Modified: Wed, 30 Nov 2016 13:28:36 GMT
ETag: "f0b02d9f2d3c6679556e63935ac23320"
Cache-Control: public
Expires: Mon, 30 Nov 2026 13:28:34 GMT
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Content-Length: 176433

nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/favicon.ico

118.174.3.51

200 OK

32 kB

URL HTTP/1.1
nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/favicon.ico
IP
118.174.3.51:0
ASN
#131293 TOT Public Company Limited

File type
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
32 kB (32038 bytes)
Hash
dcab71ebc93152daf929fb28339ed0fe
ffe045a4c0bf1f17083bb3458146bd9017cb5781
9fe9ceea600ac587b9df4e87ac5099ae40f7957965743bc500231b466557e041

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Chronopost

HTTP Headers

GET /wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/sourceApp/img/favicon.ico HTTP/1.1
Host: nites.ayutthaya2.go.th
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/wp-content/plugins/snyqxhe/admin/info/bibaztgkmv4914/

HTTP/1.1 200 OK
Content-Type: image/x-icon
Last-Modified: Sat, 19 Nov 2022 00:16:15 GMT
Accept-Ranges: bytes
ETag: "5047ad23acfbd81:0"
Server: Microsoft-IIS/10.0
Date: Thu, 24 Nov 2022 06:39:33 GMT
Content-Length: 32038

kit-free.fontawesome.com/releases/latest/css/free.min.css

172.67.168.25

200 OK

0 B

URL HTTP/2
kit-free.fontawesome.com/releases/latest/css/free.min.css
IP
172.67.168.25:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /releases/latest/css/free.min.css HTTP/1.1
Host: kit-free.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nites.ayutthaya2.go.th/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 24 Nov 2022 06:39:32 GMT
content-type: text/css
x-amz-id-2: s2yMRyt+U/nLn04N6rKe5bLd62DsKbmsISYShP2dumLGYoqtIniyH8QyusLTeEtTplywJoyAHN8=
x-amz-request-id: ATBRRF5PWVTQ0WNK
last-modified: Wed, 04 Aug 2021 21:22:50 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=1800
cf-cache-status: HIT
age: 382
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lmF4W6DGwWKLLISxaIWsRhCulIav8GJFaEL5sSCsHNOFiNO1Xhykj7RL87MzI6A8uJDhn6Q1eIaZpE3Fu4wXud22PRlZm3LKGoPGYvjygDYsR%2BJI4aN9J%2FS74WgPDS%2FRZSjydigePQFRDNc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 76f025e118c2b529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (37)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size