Report - qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html

Report Overview

Visited public
2023-11-16 03:24:49
Tags
URL
qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html
Finishing URL
qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html
IP / ASN
203.158.140.13
#135129 Rajamangala University of Technology Tawan-okBangpra Campus
Title
Navy Federal Credit Union - Our Members are the Mission®

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-15 19:10:55	429 B	3.6 kB	162.19.58.160
qa.rmutto.ac.th	unknown	2005-08-19	2016-03-14 19:07:02	2023-11-15 14:13:12	509 B	522 kB	203.158.140.13
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-15 19:56:03	398 B	226 B	195.80.159.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-16 03:24:33	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 03:24:33	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-16 03:24:33	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)
2023-11-16 03:24:36	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-15	medium	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (12)

	URL	From	Size	First Seen	Last Seen
	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	2.1 kB	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:03 Last Seen2025-05-06 15:15 Times Seen178 Hash f614f20afbf576b484daff8f1cd754e9 1638b3a4fd33b596e4f2c0b34fb4dfda7ea5b419 b706e7f259717a7f26145ad3877f817c14b281f2fb6698998dd967cfe45304ef Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.4 kB	2023-05-17	2024-08-21
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-17 03:17 Last Seen2024-08-21 09:00 Times Seen4 Hash 14e36c4118c91d0d7f693095dc089d3f 26108b6b20042083343e29cb12832e7051b58d78 ea43d7e2dbfaa94be690f5a7ceecde208733b1ea5c929fd19c801708647c4b84 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.9 kB	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:38 Last Seen2025-05-06 15:15 Times Seen96 Hash b81269e186b77f5500eb8316b8dab69f f8c2b54bac0660aa442c2b0c971a811735c09b86 079f71d93dc83f160ca03e1b816f9d1b24981f768a81723a98de8ff2d3055139 Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.2 kB	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:39 Last Seen2025-05-06 15:15 Times Seen97 Hash 38c257a23df6f583d7ac1032fbbe19de 9ae3937559866937033f958304b1407c994d5e2e d26c40c76b8666080a64f559f8a0e873a8d7df2f6e23ae54049e1bcb7f054be4 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.3 kB	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:39 Last Seen2025-05-06 15:15 Times Seen96 Hash e8fda04bd98519987fdd1e09767e291a 0939e467e42e83c1bb4176f203a7eaea46401737 47b3fdf6adffeda47b604f6282672c5bf80be9960ab7df0542f6971d0925ada7 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	398 B	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:03 Last Seen2025-05-06 15:15 Times Seen177 Hash 50a892b9a1594bbdffb3091e0c4c290a f764e97d3742b9ae4be7471d4c89998f83425f3f d1615b4612803995f82464f714e82ba84a7471fb6607b68080401140ceda4eb2 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.4 kB	2023-03-07	2025-05-06
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:38 Last Seen2025-05-06 15:15 Times Seen95 Hash 448be6cccb8dc545fc78717ce80435dd 8a147e342d2f643c196d601534238f6deb999c6d 06e3026569bde580035ebe870c64b5efefb1643d5d3e1cb7ce8ba36839e5adeb Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	1.1 kB	2023-03-09	2024-08-21
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-09 13:51 Last Seen2024-08-21 09:00 Times Seen4 Hash 5525e9a9322454ddb0d2f71e0710377c fe302b4353efcd14cba5c0abce1edbe96735e969 47973f32abbd63be36c08ae0f748ff5b8b66a4140a687427419ccb5cd23b6578 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	15 B	2023-03-07	2025-05-07
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-05-07 16:02 Times Seen319 Hash a6334981a8bbe29aa5c1dc2edd2640b2 4c0fb8f501dfb048b93102fccc8976cd1ce14f34 5dedb26ee87d110b89e97198b67b2a79dc14359cfda2d56ff91af5f460b6a4a0 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	65 B	2023-03-07	2025-05-07
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-05-07 16:02 Times Seen316 Hash 2bd60c5b14d66a418d7acfdb28bbbdce d2281051c147d3ba68c9cdf1048cf1d49408aa39 7ebe893f5ae6a45f490e5b51841c7ba938425832b0326aad21a13106b52d8675 Loading...

	qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html	ScriptElement	0 B	0001-01-01	2025-05-09
Pretty URL qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html IP 203.158.140.13 ASN #135129 Rajamangala University of Technology Tawan-okBangpra Campus Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-05-09 10:30 Times Seen4635334 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (3)

URL IP Response Size

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.160

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.160:443
ASN
#16276 OVH SAS

Requested by
https://qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://qa.rmutto.ac.th/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 16 Nov 2023 03:24:33 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html

203.158.140.13

200 OK

522 kB

URL User Request GET HTTP/1.1
qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html
IP
203.158.140.13:443
ASN
#135129 Rajamangala University of Technology Tawan-okBangpra Campus

Certificate
IssuerGlobalSign nv-sa
Subject*.rmutto.ac.th
Fingerprint40:6F:0C:AD:D1:B4:0F:D7:F6:2B:FA:37:A0:04:62:38:6A:07:BA:44
ValidityThu, 27 Jul 2023 07:54:31 GMT - Tue, 27 Aug 2024 07:54:30 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (13069), with CRLF line terminators
Size
522 kB (521616 bytes)
Hash
c7b2e72224c62ed45064c6c17c966af3
c376120c03143319723a8a571ae7a3c503a68d41
9ed975755ec57f0d8b0739f5d3dc5e7015ac1beff1cfbd6c6068f4688eafca24

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /wp-content/uploads/2023/01/n.fcu.html HTTP/1.1
Host: qa.rmutto.ac.th
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 16 Nov 2023 03:24:31 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Wed, 15 Nov 2023 12:31:03 GMT
ETag: "e84cf-60a3013954bf0-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://qa.rmutto.ac.th/wp-content/uploads/2023/01/n.fcu.html
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://qa.rmutto.ac.th/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 16 Nov 2023 03:24:34 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by