turfking.in Open in urlscan Pro
148.72.88.25 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://turfking.in/Wellsfargo/verify.html
Submission: On July 23 via automatic, source openphish (July 23rd 2019, 3:05:17 am UTC)

Summary HTTP 25 Redirects Links 50 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 25 HTTP transactions. The main IP is 148.72.88.25, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is turfking.in.

This is the only time turfking.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking) CapitalOne (Financial)

Domain & IP information

	IP Address	AS Autonomous System
11	148.72.88.25 148.72.88.25	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
6	3.121.16.187 3.121.16.187	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	66.170.124.63 66.170.124.63	30121 (24-7-AS-I...) (24-7-AS-IDC-001 - 24/7 Customer)
1 2	164.115.22.170 164.115.22.170	9835 (GITS-TH-A...) (GITS-TH-AS-AP Government Information Technology Services)
25	5

11 148.72.88.25 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-148-72-88-25.ip.secureserver.net

turfking.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.121.16.187 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-121-16-187.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.170.124.63 (United States)

ASN30121 (24-7-AS-IDC-001 - 24/7 Customer, Inc., US)

capitalone.app.pub.247-inc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 164.115.22.170 (Thailand) 1 redirects

ASN9835 (GITS-TH-AS-AP Government Information Technology Services, TH)

www.tqa.or.th	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	turfking.in turfking.in	103 KB
6	ensighten.com nexus.ensighten.com	3 KB
2	tqa.or.th 1 redirects www.tqa.or.th	978 B
2	247-inc.net capitalone.app.pub.247-inc.net	688 B
25	4

	Domain	Requested by
11	turfking.in	turfking.in
6	nexus.ensighten.com	turfking.in
2	www.tqa.or.th	1 redirects turfking.in
2	capitalone.app.pub.247-inc.net	turfking.in
25	4

This site contains links to these domains. Also see Links.

Domain
www.capitalone.com
www.capitalone.ca
fr.capitalone.ca
www.capitaloneinvesting.com
www.capitalone.co.uk
phx.corporate-ir.net
press.capitalone.com
www.capitalonecareers.com
campus.capitalone.com
twitter.com
www.facebook.com
www.youtube.com
www.linkedin.com
www.instagram.com
www.fdic.gov
servicing.capitalone.com
frservicing.capitalone.com

Subject Issuer	Validity	Valid
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2018-10-17` - `2020-01-05`	a year	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.app.pub.247-inc.net Trustwave Organization Validation SHA256 CA, Level 1	`2018-09-12` - `2020-09-21`	2 years	crt.sh
www.tqa.or.th GeoTrust RSA CA 2018	`2019-01-14` - `2021-01-13`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://turfking.in/Wellsfargo/verify.html
Frame ID: C705AD55B6089A434E4BD58DAC410840
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Page Statistics

25
Requests

28 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

107 kB
Transfer

293 kB
Size

0
Cookies

50 Outgoing links

These are links going to different origins than the main page.

URL: https://www.capitalone.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.capitalone.ca/?LANG=FRE
Title:

Search URL Search Domain Scan URL

URL: https://fr.capitalone.ca/?LANG=FRE
Title:

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/credit-cards/
Title: Personal Credit Cards

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/credit-cards/business/
Title: Business Credit Cards

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/bank/
Title: Personal Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/small-business-bank/
Title: Small Business Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/commercial/
Title: Commercial Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/home-loans/
Title: Home Loans

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/home-equity/
Title: Home Equity Lines

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/auto-financing/
Title: Auto Loans

Search URL Search Domain Scan URL

URL: https://www.capitaloneinvesting.com/main/why-choose-us.aspx
Title: Investing

Search URL Search Domain Scan URL

URL: http://www.capitalone.ca/
Title: Canada

Search URL Search Domain Scan URL

URL: http://www.capitalone.co.uk/
Title: UK

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/
Title: About Capital One

Search URL Search Domain Scan URL

URL: http://phx.corporate-ir.net/phoenix.zhtml?c=70667&p=irol-irhome
Title: Investors

Search URL Search Domain Scan URL

URL: http://press.capitalone.com/phoenix.zhtml?c=251626&p=irol-overview
Title: Press

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/investingforgood/
Title: Investing for Good

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/financial-education/
Title: Financial Education

Search URL Search Domain Scan URL

URL: http://www.capitalonecareers.com/company-overview
Title: Company Overview

Search URL Search Domain Scan URL

URL: http://www.capitalonecareers.com/how-to-apply
Title: How to Apply

Search URL Search Domain Scan URL

URL: http://www.capitalonecareers.com/benefits/overview
Title: Benefits

Search URL Search Domain Scan URL

URL: http://www.capitalonecareers.com/interview-prep
Title: Interview Process

Search URL Search Domain Scan URL

URL: https://campus.capitalone.com/
Title: Campus Careers

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/military/
Title: Servicemembers Civil Relief Act

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/media/doc/corporate/foreign-bank-account-certification-Capital-One.pdf
Title: Patriot Act Cert

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/subpoena-policy/
Title: Subpoena Policy

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/ing-trademark-disclaimer/
Title: ING Trademark Disclaimer

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/disclosures/
Title: Additional Disclosures

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/contact/
Title: CONTACT US

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/identity-protection/privacy/
Title: PRIVACY

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/identity-protection/commitment/
Title: SECURITY

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/terms-conditions/
Title: TERMS & CONDITIONS

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/accessibility-commitment/
Title: ACCESSIBILITY

Search URL Search Domain Scan URL

URL: https://twitter.com/capitalone
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/capitalone
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/CapitalOne
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/capital-one
Title: Linked In

Search URL Search Domain Scan URL

URL: https://www.instagram.com/capitalone/
Title: Instagram

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/
Title: Capital One

Search URL Search Domain Scan URL

URL: http://www.fdic.gov/
Title: MEMBER FDIC

Search URL Search Domain Scan URL

URL: https://www.capitalone.ca/
Title: HOME

Search URL Search Domain Scan URL

URL: http://www.capitalone.ca/contact-us
Title: CONTACT US

Search URL Search Domain Scan URL

URL: http://www.capitalone.ca/about/privacy
Title: PRIVACY

Search URL Search Domain Scan URL

URL: http://www.capitalone.ca/about/security/
Title: SECURITY

Search URL Search Domain Scan URL

URL: https://servicing.capitalone.com/C1/SelfService/TermsAndConditions.aspx?CountryCode=CA&Linkid=EOS_Z_Z_Z_FOOT_F1_01_G_TANDC
Title: TERMS & CONDITIONS

Search URL Search Domain Scan URL

URL: http://fr.capitalone.ca/communiquez-avec-nous/18f/?LANG=FRE
Title: CONTACT US

Search URL Search Domain Scan URL

URL: http://fr.capitalone.ca/%C3%A0-propos/confidentialit%C3%A9/mwn4/
Title: PRIVACY

Search URL Search Domain Scan URL

URL: http://fr.capitalone.ca/%C3%A0-propos/s%C3%A9curit%C3%A9/kva1/
Title: SECURITY

Search URL Search Domain Scan URL

URL: https://frservicing.capitalone.com/C1/SelfService/TermsAndConditions.aspx?CountryCode=CA&Linkid=EOS_Z_Z_Z_FOOT_F1_01_G_TANDC
Title: TERMS & CONDITIONS

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

http://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png HTTP 301
https://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png

25 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request verify.html Show response turfking.in/Wellsfargo/	32 KB 6 KB	484ms 242ms	Document text/html	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `2b12950f07233f88c69ca706a7fa712124a17daf9aab0f8789cffaa4ff7a61e3` Request headers Host turfking.in Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Sun, 24 Feb 2019 18:54:30 GMT ETag "b80301-7e71-582a85a9e6580-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 6034 Keep-Alive timeout=5 Content-Type text/html
GET H/1.1	200 OK	00d5954f6057db2b8dcf573d6eef877f.js Show response nexus.ensighten.com/capitalone/prod/code/	24 B 371 B	24ms 7ms	Script application/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/capitalone/prod/code/00d5954f6057db2b8dcf573d6eef877f.js?conditionId0=409901 Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Thu, 05 Apr 2012 12:15:43 GMT Server nginx ETag "4f7d8cef-18" Content-Type application/javascript; charset=utf-8 Cache-Control no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 24 Expires Tue, 23 Jul 2019 03:03:38 GMT
GET H/1.1	200 OK	4f8b70f3e95bc01f9ffda09cb0d6502a.js Show response nexus.ensighten.com/capitalone/prod/code/	24 B 371 B	31ms 7ms	Script application/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/capitalone/prod/code/4f8b70f3e95bc01f9ffda09cb0d6502a.js?conditionId0=409901 Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Thu, 05 Apr 2012 12:15:43 GMT Server nginx ETag "4f7d8cef-18" Content-Type application/javascript; charset=utf-8 Cache-Control no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 24 Expires Tue, 23 Jul 2019 03:03:38 GMT
GET H/1.1	200 OK	fd45940c349b9da2ade95958a13065ab.js Show response nexus.ensighten.com/capitalone/prod/code/	24 B 371 B	31ms 7ms	Script application/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/capitalone/prod/code/fd45940c349b9da2ade95958a13065ab.js?conditionId0=421879 Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Thu, 05 Apr 2012 12:15:43 GMT Server nginx ETag "4f7d8cef-18" Content-Type application/javascript; charset=utf-8 Cache-Control no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 24 Expires Tue, 23 Jul 2019 03:04:42 GMT
GET H/1.1	200 OK	6249943aae9a2bebd2cb58676a802351.js Show response nexus.ensighten.com/capitalone/prod/code/	24 B 371 B	39ms 7ms	Script application/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/capitalone/prod/code/6249943aae9a2bebd2cb58676a802351.js?conditionId0=467588 Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Thu, 05 Apr 2012 12:15:43 GMT Server nginx ETag "4f7d8cef-18" Content-Type application/javascript; charset=utf-8 Cache-Control no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 24 Expires Tue, 23 Jul 2019 03:04:42 GMT
GET H/1.1	200 OK	serverComponent.php Show response nexus.ensighten.com/capitalone/	596 B 833 B	50ms 18ms	Script text/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/capitalone/serverComponent.php?clientID=581&PageID=https%3A%2F%2Fverified.capitalone.com%2Fenroll%2F%23%2Fpii%3ForiginatorId%3DSIC Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `ebda4d88cb3918024c7eb15599dd4c805148152ebe6aa276e4fcb20693f4182d` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Cache-Control no-cache, no-store Expires Tue, 23 Jul 2019 03:04:42 GMT Server nginx Connection keep-alive Content-Length 596 Content-Type text/javascript
GET H/1.1	200 OK	247px.js Show response turfking.in/Wellsfargo/	17 KB 17 KB	484ms 243ms	Script application/javascript	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/247px.js Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `cd686bfce3f3ea0c049c454a91010b9e7e82dc3a3922413b5ac9a385277c0f29` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:00 GMT Server Apache ETag "b802d1-42eb-57b54c1a77600-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5 Content-Length 17154
GET H/1.1	200 OK	chat.js Show response turfking.in/Wellsfargo/	1 KB 885 B	481ms 241ms	Script application/javascript	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/chat.js Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `695fea16e4c86e9284514347d4b0a24f592605c394a4247f0b3d3c909f5c14e2` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:02 GMT Server Apache ETag "b802d8-5af-57b54c1c5fa80-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5 Content-Length 516
GET H/1.1	200 OK	247tag.js Show response turfking.in/Wellsfargo/	6 KB 2 KB	496ms 251ms	Script application/javascript	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/247tag.js Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `a28c24b7cfc12222f6b5cfb0f80c2f09b4c7a7161c68897f55650b8fc4a811d6` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:00 GMT Server Apache ETag "b802d2-197d-57b54c1a77600-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5 Content-Length 1456
GET H/1.1	200 OK	app.min.css turfking.in/Wellsfargo/	116 KB 23 KB	247ms 245ms	Stylesheet text/css	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/app.min.css Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `34dbf36a69e01a9ba208389bbe17295b28036ce5583d5926fe879319f713e5a7` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:00 GMT Server Apache ETag "b802d3-1ce5a-57b54c1a77600-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 22885
GET H/1.1	200 OK	Bootstrap.js Show response turfking.in/Wellsfargo/	81 KB 26 KB	488ms 248ms	Script application/javascript	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/Bootstrap.js Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `f27ec3d34b269ad2c3d0459f4b8fc56562ddcd761184e4dbe8a47cd4508e7dec` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:00 GMT Server Apache ETag "b802d5-143db-57b54c1a77600-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5 Content-Length 25764
GET H/1.1	200 OK	browserFingerPrintv1.min.js Show response turfking.in/Wellsfargo/	18 KB 6 KB	486ms 246ms	Script application/javascript	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://turfking.in/Wellsfargo/browserFingerPrintv1.min.js Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `dbe4e25808260752a6005d6e9906f907ffbec2b14ea5c91cbafaf389b5bb9562` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Content-Encoding gzip Last-Modified Fri, 23 Nov 2018 13:14:00 GMT Server Apache ETag "b802d6-494e-57b54c1a77600-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5 Content-Length 5854
GET H/1.1	200 OK	spacer.gif turfking.in/Wellsfargo/	807 B 1 KB	241ms 241ms	Image image/gif	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://turfking.in/Wellsfargo/spacer.gif Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `ff489aad06b35701434af93561e529da4316811981798e0c3277fbbe62df5ef9` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Fri, 23 Nov 2018 13:14:02 GMT Server Apache ETag "b802ff-327-57b54c1c5fa80" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 807
GET H/1.1	200 OK	cpxt.js Show response capitalone.app.pub.247-inc.net/psp/capitalone-v1-001/default/	0 344 B	633ms 160ms	Script application/javascript	66.170.124.63 24/7 Customer
General Check archive.org Show headers Download Go to Full URL https://capitalone.app.pub.247-inc.net/psp/capitalone-v1-001/default/cpxt.js?id=1493923527605-230990&type=Not%20loading%20again%20as%20sn_iframe%20already%20present%20in%20page(url%20:%20https://verified.capitalone.com/enroll/ Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.170.124.63 , United States, ASN30121 (24-7-AS-IDC-001 - 24/7 Customer, Inc., US), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:02:46 GMT Last-Modified Wed, 09 Apr 2014 10:00:45 GMT Server Apache ETag "0-4f6992c916d40" Content-Type application/javascript Cache-Control max-age=0 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 0 Expires Tue, 23 Jul 2019 03:02:46 GMT
GET H/1.1	200 OK	logo.png turfking.in/Wellsfargo/images/	2 KB 3 KB	320ms 320ms	Image image/png	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://turfking.in/Wellsfargo/images/logo.png Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `593011e4c5e2416a84cc50d01760a22c0667cd65fdbb8924b69417fa9206c628` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Mon, 21 Jan 2019 09:31:06 GMT Server Apache ETag "b802e3-988-57ff485238a80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 2440
GET H/1.1	200 OK	capitalone-logo.png turfking.in/Wellsfargo/	10 KB 10 KB	321ms 321ms	Image image/png	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://turfking.in/Wellsfargo/capitalone-logo.png Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `40a453371997e68b39589697d915e2fc3cc34cd5912cd687a9f9fd2590de7e79` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Fri, 23 Nov 2018 13:14:02 GMT Server Apache ETag "b802d7-2669-57b54c1c5fa80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 9833
GET H/1.1	404 Not Found	sign-in-icon.png www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/ Redirect Chain http://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png https://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png	0 509 B	2509ms 1978ms	Image text/html	164.115.22.170 GITS-TH-AS-AP Gov...
General Check archive.org Show headers Download Go to Show image Full URL https://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.115.22.170 , Thailand, ASN9835 (GITS-TH-AS-AP Government Information Technology Services, TH), Reverse DNS Software nginx / PHP/5.5.9-1ubuntu4.21 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-TEC-API-VERSION v1 Date Tue, 23 Jul 2019 03:04:51 GMT X-TEC-API-ORIGIN https://www.tqa.or.th X-TEC-API-ROOT https://www.tqa.or.th/wp-json/tribe/events/v1/ Server nginx X-Powered-By PHP/5.5.9-1ubuntu4.21 Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection keep-alive Link <https://www.tqa.or.th/wp-json/>; rel="https://api.w.org/" Content-Length 0 Keep-Alive timeout=60 Expires Wed, 11 Jan 1984 05:00:00 GMT Redirect headers Date Tue, 23 Jul 2019 03:04:49 GMT Server nginx X-Powered-By PHP/5.5.9-1ubuntu4.21 Content-Type text/html; charset=UTF-8 Location https://www.tqa.or.th/wp-content/plugins/LayerSlider/templates/js/CapOne/www/page/verification/online/1/assets/images/sign-in-icon.png Cache-Control no-cache, must-revalidate, max-age=0 Connection keep-alive Keep-Alive timeout=60 Content-Length 0 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	setup-icon.png turfking.in/Wellsfargo/	9 KB 9 KB	319ms 319ms	Image image/png	148.72.88.25 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://turfking.in/Wellsfargo/setup-icon.png Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/verify.html Protocol HTTP/1.1 Security , , Server 148.72.88.25 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-148-72-88-25.ip.secureserver.net Software Apache / Resource Hash `0b6cd6b3376e9faeaf2740ddb9d0bc234a9faf144e31504044ff19ff5e2b63e9` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Fri, 23 Nov 2018 13:14:02 GMT Server Apache ETag "b802fe-22b6-57b54c1c5fa80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 8886
GET H/1.1	200 OK	cpxt.js Show response capitalone.app.pub.247-inc.net/psp/capitalone-v1-001/default/	0 344 B	334ms 168ms	Script application/javascript	66.170.124.63 24/7 Customer
General Check archive.org Show headers Download Go to Full URL http://capitalone.app.pub.247-inc.net/psp/capitalone-v1-001/default/cpxt.js?msg=%22DOMAIN_CONFIG_NOT_FOUND%22&pageUrl=http%3A%2F%2Fturfking.in%2FWellsfargo%2Fverify.html Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/247tag.js Protocol HTTP/1.1 Security , , Server 66.170.124.63 , United States, ASN30121 (24-7-AS-IDC-001 - 24/7 Customer, Inc., US), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Last-Modified Wed, 09 Apr 2014 10:00:45 GMT Server Apache ETag "0-4f6992c916d40" Content-Type application/javascript Cache-Control max-age=0 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 0 Expires Tue, 23 Jul 2019 03:04:43 GMT
GET		global-icons.png turfking.in/Wellsfargo/assets/images/footer/images/icon/	0 0

GET		footer-logos.png turfking.in/Wellsfargo/assets/images/footer/images/icon/	0 0

GET		ProximaNovaRegular.woff2 turfking.in/Wellsfargo/assets/fonts/	0 0

GET		ProximaNovaRegular.woff turfking.in/Wellsfargo/assets/fonts/	0 0

GET		ProximaNovaSemiBold.woff turfking.in/Wellsfargo/assets/fonts/	0 0

GET H/1.1	200 OK	serverComponent.php Show response nexus.ensighten.com/capitalone/	281 B 518 B	18ms 11ms	Script text/javascript	3.121.16.187 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://nexus.ensighten.com/capitalone/serverComponent.php?clientID=581&PageID=http%3A%2F%2Fturfking.in%2FWellsfargo%2Fverify.html Requested by Host: turfking.in URL: http://turfking.in/Wellsfargo/Bootstrap.js Protocol HTTP/1.1 Security , , Server 3.121.16.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-3-121-16-187.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `e1e5bb995a70dd66fef93aaa91410690c2b5c03ae553daf6159f68896b331e17` Request headers Referer http://turfking.in/Wellsfargo/verify.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 23 Jul 2019 03:04:43 GMT Cache-Control no-cache, no-store Server nginx Connection keep-alive Content-Type text/javascript Content-Length 281 Expires Tue, 23 Jul 2019 03:04:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: turfking.in
URL: http://turfking.in/Wellsfargo/assets/images/footer/images/icon/global-icons.png

Domain: turfking.in
URL: http://turfking.in/Wellsfargo/assets/images/footer/images/icon/footer-logos.png?v=0.1

Domain: turfking.in
URL: http://turfking.in/Wellsfargo/assets/fonts/ProximaNovaRegular.woff2

Domain: turfking.in
URL: http://turfking.in/Wellsfargo/assets/fonts/ProximaNovaRegular.woff

Domain: turfking.in
URL: http://turfking.in/Wellsfargo/assets/fonts/ProximaNovaSemiBold.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking) CapitalOne (Financial)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capitalone.app.pub.247-inc.net
nexus.ensighten.com
turfking.in
www.tqa.or.th
turfking.in
148.72.88.25
164.115.22.170
3.121.16.187
66.170.124.63
0b6cd6b3376e9faeaf2740ddb9d0bc234a9faf144e31504044ff19ff5e2b63e9
1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8
2b12950f07233f88c69ca706a7fa712124a17daf9aab0f8789cffaa4ff7a61e3
34dbf36a69e01a9ba208389bbe17295b28036ce5583d5926fe879319f713e5a7
40a453371997e68b39589697d915e2fc3cc34cd5912cd687a9f9fd2590de7e79
593011e4c5e2416a84cc50d01760a22c0667cd65fdbb8924b69417fa9206c628
695fea16e4c86e9284514347d4b0a24f592605c394a4247f0b3d3c909f5c14e2
a28c24b7cfc12222f6b5cfb0f80c2f09b4c7a7161c68897f55650b8fc4a811d6
cd686bfce3f3ea0c049c454a91010b9e7e82dc3a3922413b5ac9a385277c0f29
dbe4e25808260752a6005d6e9906f907ffbec2b14ea5c91cbafaf389b5bb9562
e1e5bb995a70dd66fef93aaa91410690c2b5c03ae553daf6159f68896b331e17
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebda4d88cb3918024c7eb15599dd4c805148152ebe6aa276e4fcb20693f4182d
f27ec3d34b269ad2c3d0459f4b8fc56562ddcd761184e4dbe8a47cd4508e7dec
ff489aad06b35701434af93561e529da4316811981798e0c3277fbbe62df5ef9

turfking.in Open in urlscan Pro 148.72.88.25 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

25 Requests

28 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

107 kBTransfer

293 kBSize

0 Cookies

50 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Indicators

turfking.in Open in urlscan Pro
148.72.88.25 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

28 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

107 kB
Transfer

293 kB
Size

0
Cookies

25 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!