Domain > atdi.in.th

This indicator is referenced in AlienVault OTX pulse ""

Files that talk to atdi.in.th

MD5	A/V
fbe778f67cfc732e38d6a5d8f46597f7	[JS.Trojan-Downloader.Nemucod.oa] [JS/Nemucod.CA1] [JS.Downloader] [JS/TrojanDownloader.Nemucod.BJQ] [Trojan.Script.Heuristic-js.iacgm] [Js.Trojan.Raas.Auto] [JS/Nemucod.CA1] [JS/Dldr.Locky.73602] [Js.Troj.Js!c] [JS/Nemucod.BJJ!tr] [Win32/Trojan.c2e]

Whois

Property	Value
Name	kwanmesa Klangchanee (ขวัญเมษา กลางชนีย์)
Address	1199, 6th floor, Phaholyothin, Samsanenai, Phayathai, Bangkok
Zip Code	10400
Country	TH
NameServer	NS50.4GBHOST.COM
Created	2009-10-30 00:00:00
Changed	2016-10-30 00:00:00
Expires	2017-10-29 00:00:00
Registrar	T.H.NIC Co., Ltd.

DNS Resolutions

Date	IP Address
2025-06-26	172.67.128.106 (ClassC)
2025-07-29	104.21.1.248 (ClassC)

HTTP/1.1 200 OKDate: Mon, 24 Jun 2024 00:52:27 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: keep-aliveSet-Cookie: sLKNYvxDXjJ2mr1x%2AT9; expiresTue, 25-Jun-2024 00:52:

!DOCTYPE html>html langen-US>head> script typetext/javascript>if(!gform){document.addEventListener(gform_main_scripts_loaded,function(){gform.scriptsLoaded!0}),window.addEventListener(DOMContentLoaded,function(){gform.domLoaded!0});var gform{domLoaded:!1,scriptsLoaded:!1,initializeOnLoaded:function(o){gform.domLoaded&&gform.scriptsLoaded?o():!gform.domLoaded&&gform.scriptsLoaded?window.addEventListener(DOMContentLoaded,o):document.addEventListener(gform_main_scripts_loaded,o)},hooks:{action:{},filter:{}},addAction:function(o,n,r,t){gform.addHook(action,o,n,r,t)},addFilter:function(o,n,r,t){gform.addHook(filter,o,n,r,t)},doAction:function(o){gform.doHook(action,o,arguments)},applyFilters:function(o){return gform.doHook(filter,o,arguments)},removeAction:function(o,n){gform.removeHook(action,o,n)},removeFilter:function(o,n,r){gform.removeHook(filter,o,n,r)},addHook:function(o,n,r,t,i){nullgform.hookson&&(gform.hookson);var egform.hookson;nulli&&(in+_+e.length),nullt&&(t10),gform.hookson.push({tag:i,callable:r,priority:t})},doHook:function(o,n,r){if(rArray.prototype.slice.call(r,1),null!gform.hookson){var t,igform.hookson;i.sort(function(o,n){return o.priority-n.priority});for(var e0;ei.length;e++)function!typeof(tie.callable)&&(twindowt),actiono?t.apply(null,r):r0t.apply(null,r)}if(filtero)return r0},removeHook:function(o,n,r,t){if(null!gform.hookson)for(var igform.hookson,ei.length-1;0e;e--)null!t&&t!ie.tag||null!r&&r!ie.priority||i.splice(e,1)}}}/script>					meta charsetUTF-8/>		link relprofile hrefhttps://gmpg.org/xfn/11/>							meta nameviewport contentwidthdevice-width,initial-scale1,user-scalableyes>		title>ATDI – The No.1 English and Airline Training Institute/title>style typetext/css>body #gform_wrapper_1 .gform_footer .gform_button {border-style: solid;color:#ffffff;background-color:#b4cc5a;width:280px;border-width:1px;border-color:#afafaf;border-style:solid;border-radius:4px;-web-border-radius:4px;-moz-border-radius:4px;padding-left:9px;padding-right:9px;padding-top:9px;padding-bottom:9px;}body #gfor

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > atdi.in.th

Is this malicious?

Reports

Files that talk to atdi.in.th

Whois

DNS Resolutions

Port 80

Port 443