Immigration Hacked?

[NoDisplayName]

Just logged onto the immigration website to make a booking for annual extension.

https://www.immigration.go.th/?page_id=19956

 

The website links to outlook to make the reservations.

https://outlook.office365.com/book/[email protected]/

 

Made my two bookings and got two confirmation emails.  One of them included "Warning - Unverified sender" with this return email     NakhonratchasimaImmigrationOffice-at-imm4division.onmicrosoft.com

 

Everything looks fine, but the download file opens a windows outlook calendar application.  There is no PDF of the appointment to print off.

 

And the website link in the email http://www.nakhonratchasima-imm.com/  redirects to TH69.com web slots.

 

The "reschedule" link in the confirmation email opens the same outlook booking site above.

 

 

Edited August 28 by cdnvic
Removed email as per rules.

[NoDisplayName]

This is the redirect page.

 

 

Web address in the email is http:// without an "s"

Adding the "s" does not affect the redirect.

 

 

Edited August 28 by NoDisplayName

[NoDisplayName]

But then Korat immigration uses a go.th address.

 

www.nakhonratchasima-imm.go.th

kkkkk

[Sydebolle]

It is absolutely amazing, how incompetent, ignorant and self-serving those websites of all those immigration offices are. 

Immigration countrywide should operate on the same set of rules and regulations. Who needs the immigration? Most likely the potential visitor is non-Thai and in most cases those non-Thais cannot read Thai. Many pages of the various immigration offices are in Thai only. 

Make ONE website with all the rules, regulations and ideas; put a directory of all the forms to download and a map of Thailand with all the provinces shown; captions of the province name in English. Clicking onto a province it gives you the immigration office(s) responsible for the area with opening times, exact location (Google Map and GPS coordinates) and phone number(s) where someone answering does speak English. 

Cannot be THAT difficult, if you ask me ......... 

[tomazbodner]

well... surprised?

 

 

 

[Caldera]

Probably just yet another Thai police officer having a sideline online gambling business, nothing to see here. 

[KhunBENQ]

15 hours ago, NoDisplayName said:

But then Korat immigration uses a go.th address.

 

www.nakhonratchasima-imm.go.th

kkkkk

And that opens correctly.

https://nakhonratchasima-imm.go.th/index_e.php

 

 

[NoDisplayName]

9 minutes ago, KhunBENQ said:

And that opens correctly.

https://nakhonratchasima-imm.go.th/index_e.php

 

 

 

Yes, it does.  But the point here is that this is not a random phishing email expedition coming from a "hacked" email list. 

 

These casino slots gambling website redirects have been placed into emails originating from the immigration computer system, directly from within the system as it's operating, using your data.

[johng]

Immigration Hacked?

 

Probably  and not for the first time.

[bradiston]

17 hours ago, NoDisplayName said:

Just logged onto the immigration website to make a booking for annual extension.

https://www.immigration.go.th/?page_id=19956

 

The website links to outlook to make the reservations.

https://outlook.office365.com/book/[email protected]/

 

Made my two bookings and got two confirmation emails.  One of them included "Warning - Unverified sender" with this return email     NakhonratchasimaImmigrationOffice-at-imm4division.onmicrosoft.com

 

Everything looks fine, but the download file opens a windows outlook calendar application.  There is no PDF of the appointment to print off.

 

And the website link in the email http://www.nakhonratchasima-imm.com/  redirects to TH69.com web slots.

 

The "reschedule" link in the confirmation email opens the same outlook booking site above.

 

 

As soon as I saw it linked to a 3rd party website I'd have baled. Especially as it's MS.

[BrandonJT]

My best guess would be that someone screwed up the link and forgot to use .go.th instead of .com 
Some entrepreneur noticed, bought that url and added the redirect.

[NoDisplayName]

5 hours ago, BrandonJT said:

My best guess would be that someone screwed up the link and forgot to use .go.th instead of .com 
Some entrepreneur noticed, bought that url and added the redirect.

 

You think? 

AND nobody noticed over the past several years? 

[Pouatchee]

21 hours ago, Caldera said:

Probably just yet another Thai police officer having a sideline online gambling business, nothing to see here. 

 

careful... you might just hurt the feelings of those here who think big joke is squeaky clean

[Dan O]

On 8/28/2024 at 11:46 PM, NoDisplayName said:

But then Korat immigration uses a go.th address.

 

www.nakhonratchasima-imm.go.th

kkkkk

all the imm websites should have the same address format ending      .go.th    They should not end in  .com format

 

[Caldera]

4 hours ago, Pouatchee said:

careful... you might just hurt the feelings of those here who think big joke is squeaky clean

 

Those muppets still exist?

[BrandonJT]

23 hours ago, NoDisplayName said:

 

You think? 

AND nobody noticed over the past several years? 

What several years? The appointment system was just updated recently.  The e-mail the op received was from that new appointment system.

[riclag]

On 8/29/2024 at 3:22 PM, johng said:

Immigration Hacked?

 

Probably  and not for the first time.

Which leads to an all inclusive problem *.

1.Immigration hacked( according to the OP.

2. Health information hacked

a google search of ,Bangkok Agencies hunt for hacker ,brings up a BP POST.
 

*Sharing our identity and our countries  social security numbers and addresses in my case from the USA, with other agencies here.

 

It is a concern. No guarantees our 

info will be safe guarded! What recourse do retirees and married to Thai’s ,have if are information is hacked and sold off to devious

actors on the dark web? 

Edited August 31 by riclag

[marin]

9 minutes ago, riclag said:

It is a concern. No guarantees our 

info will be safe guarded! What recourse do retirees and married to Thai’s ,have if are information is hacked and sold off to devious

actors on the dark web? 

The word is they are going after Trump supporters.  

[NoDisplayName]

44 minutes ago, BrandonJT said:

What several years? The appointment system was just updated recently.  The e-mail the op received was from that new appointment system.

 

You're saying an update of the system included changing the website address that was already in the pre-existing confirmation email text from go.th to .com?

 

I suppose anything is possible, considering some person(s) inside immigration provide email lists to visa agent(s).

[Rimmer]

Flame leading to bickering has been removed also replies

@mdr224

[BrandonJT]

10 hours ago, NoDisplayName said:

 

You're saying an update of the system included changing the website address that was already in the pre-existing confirmation email text from go.th to .com?

 

I suppose anything is possible, considering some person(s) inside immigration provide email lists to visa agent(s).

The URL was registered on July 23rd, 2024.  It's registered in Hong Kong.  That's shortly after the new appointment system was being implemented.

 

Just seems like someone put the wrong url.  They would probably fix it if they were informed and then it would link back to the correct immigration website, but rather than inform them it's being debated on a foreigner forum.

 

[NoDisplayName]

19 minutes ago, BrandonJT said:

The URL was registered on July 23rd, 2024.  It's registered in Hong Kong.  That's shortly after the new appointment system was being implemented.

 

Just seems like someone put the wrong url.  They would probably fix it if they were informed and then it would link back to the correct immigration website, but rather than inform them it's being debated on a foreigner forum.

 

 

So you're saying immigration themselves set up a fake website address in Hong Kong for their confirmation emails to link to?  That's crazy.

 

I sent them an email.

 

Anyone else using the online reservation system?  Maybe check the confirmation emails and see if this shows up anywhere other than Korat?

[BrandonJT]

3 hours ago, NoDisplayName said:

 

So you're saying immigration themselves set up a fake website address in Hong Kong for their confirmation emails to link to?  That's crazy.

 

I sent them an email.

 

Anyone else using the online reservation system?  Maybe check the confirmation emails and see if this shows up anywhere other than Korat?

I'm saying that someone at immigration mistakenly entered .com for a url when setting up a new system, if it was even someone at immigration that set it up rather than some contractor.  Then someone noticed the mistake and purchased the url to make a re-router to an online casino. Happens all the time when people notice that an incorrect url was entered somewhere.