goldenelephanthostel.com Open in urlscan Pro
66.147.240.181 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Submission: On October 28 via automatic, source openphish (October 28th 2017, 12:20:13 pm UTC)

Summary HTTP 12 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 66.147.240.181, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is goldenelephanthostel.com.

This is the only time goldenelephanthostel.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	66.147.240.181 66.147.240.181	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
7	104.108.68.65 104.108.68.65	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	159.45.170.145 159.45.170.145	10837 (WELLSFARG...) (WELLSFARGO-10837 - Wells Fargo & Company)
12	3

1 66.147.240.181 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: host381.hostmonster.com

goldenelephanthostel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.108.68.65 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-68-65.deploy.static.akamaitechnologies.com

www01.wellsfargomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 159.45.170.145 (San Francisco, United States)

ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US)

www.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	wellsfargomedia.com www01.wellsfargomedia.com	49 KB
4	wellsfargo.com www.wellsfargo.com	68 KB
1	goldenelephanthostel.com goldenelephanthostel.com	4 KB
12	3

	Domain	Requested by
7	www01.wellsfargomedia.com	goldenelephanthostel.com
4	www.wellsfargo.com	goldenelephanthostel.com
1	goldenelephanthostel.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.wellsfargo.com
online.wellsfargo.com
www.wellsfargoblogs.com

Subject Issuer	Validity	Valid
www01.wellsfargomedia.com GeoTrust SSL CA - G3	`2016-09-27` - `2017-12-27`	a year	crt.sh
www.wellsfargo.com Symantec Class 3 Secure Server CA - G4	`2017-01-31` - `2019-02-01`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Frame ID: 17060.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

FrontPage (Editors) Expand

Overall confidence: 100%
Detected patterns

meta generator /Microsoft FrontPage(?:\s((?:Express )?[\d.]+))?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

121 kB
Transfer

333 kB
Size

0
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wellsfargo.com/#skip
Title: Skip to content

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/help/
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/locator/
Title: ATMs/Locations

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/spanish/
Title: Espa?l

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/biz/
Title: Small Business

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/com/
Title: Commercial

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/financial-education/
Title: Financial Education

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/
Title: About Wells Fargo

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/channel/helpText?key=fieldhelp_EnrollmentTaxIdentificationNumber
Title: Help

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/channel/helpText?key=fieldhelp_AccountAtmCard
Title: Help

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/das/channel/helpText?key=fieldhelp_EnrollEMailAddress
Title: Why do we need to know this?

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy_security/
Title: PRIVACY, Security & Legal

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/privacy-security/fraud/report/
Title: Report Fraud

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/about/diversity/
Title: Diversity & Accessibility

Search URL Search Domain Scan URL

URL: https://online.wellsfargo.com/common/html/wibdisc.html
Title: Online Access Agreement

Search URL Search Domain Scan URL

URL: http://www.wellsfargoblogs.com/
Title: Blogs & Social Media

Search URL Search Domain Scan URL

URL: https://www.wellsfargo.com/savings_cds/fdic
Title: Learn More

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request identity.php Show response
goldenelephanthostel.com/includes/wellsfargo/ 12 KB
4 KB 2339ms
1968ms Document
text/html 66.147.240.181
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Protocol: HTTP/1.1
Server: 66.147.240.181 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: host381.hostmonster.com
Software: nginx/1.12.1 /
Resource Hash: 8784635b44663acc6868117191a30671f40c051bfd0db9bdbe2a994243882f52

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: goldenelephanthostel.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Content-Encoding: gzip
Server: nginx/1.12.1
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
X-Acc-Exp: 600
Connection: keep-alive
Content-Length: 4000
X-Proxy-Cache: BYPASS goldenelephanthostel.com

GET
H/1.1 200
OK homepage.css
www01.wellsfargomedia.com/css/home/ 63 KB
16 KB 64ms
6ms Stylesheet
text/css 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www01.wellsfargomedia.com/css/home/homepage.css

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

565263d801f4fd62e36c1808df02ba171fc66b25e10392a53bc7f2f996436097

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Content-Encoding: gzip
Last-Modified: Sat, 07 Oct 2017 04:35:00 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
ETag: W/"fce9-59d85974"
Vary: accept-encoding
Content-Type: text/css;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Content-Length: 16137
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK wf-logo.gif
www01.wellsfargomedia.com/assets/images/global/ 4 KB
4 KB 63ms
6ms Image
image/gif 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/global/wf-logo.gif

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

Resource Hash

edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Sun, 16 Nov 2014 00:36:50 GMT
ETag: "e86-5467f1a2"
X-frame-options: SAMEORIGIN
Content-Type: image/gif
Cache-Control: max-age=1800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3718
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK stagecoach.jpg
www01.wellsfargomedia.com/assets/images/global/ 5 KB
5 KB 23ms
23ms Image
image/jpeg 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/global/stagecoach.jpg

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

1f55cd70e90f5dcc98ed0b5555f10259828e3084d36d0567b15b35e5bd523823

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Tue, 21 Oct 2014 00:23:03 GMT
Server: KONICHIWA/2.0
ETag: "131a-5445a767"
X-frame-options: SAMEORIGIN
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4890
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK icon-equal-housing.gif
www01.wellsfargomedia.com/assets/images/global/ 776 B
776 B 9ms
9ms Image
image/gif 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/global/icon-equal-housing.gif

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

397bf475ca4b12d3595efbfebb09b9dff2529df4c3a55e5a3bbe7fab0a5cefe7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Fri, 24 May 2013 20:07:56 GMT
Server: KONICHIWA/2.0
ETag: "308-519fc89c"
X-frame-options: SAMEORIGIN
Content-Type: image/gif;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 776
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK Cookie set user-prefs.js Show response
www.wellsfargo.com/javascript/ 12 KB
5 KB 788ms
172ms Script
application/x-javascript 159.45.170.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wellsfargo.com/javascript/user-prefs.js

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.170.145 San Francisco, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

dc9402ae4b104a52590d04c1904e8b9a2e21bbb5f30a52f7659ee7ef36463964

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wellsfargo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:02 GMT
Content-encoding: gzip
Last-modified: Sat, 07 Oct 2017 04:35:00 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
Etag: W/"308c-59d85974"
Vary: accept-encoding
Content-type: application/x-javascript;charset=UTF-8
Expires: Sat, 28 Oct 2017 12:50:02 GMT
Cache-control: max-age=1800
Transfer-encoding: chunked
Set-Cookie: ISD_WWWAF_COOKIE=!1FZaY1bY/fV7vfE3qEdzUooI7UIKem4624b8a8dXJANKOxoWKgArHAkyObZaHn5yCiQ8xeYHVbJIKQ==; path=/ ISD_WWWAF_COOKIE=!1FZaY1bY/fV7vfE3qEdzUooI7UIKem4624b8a8dXJANKOxoWKgArHAkyObZaHn5yCiQ8xeYHVbJIKQ==; path=/; domain=; HttpOnly; Secure
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.1 200
OK Cookie set jquery.js Show response
www.wellsfargo.com/js/frameworks/jq/ 96 KB
33 KB 738ms
178ms Script
application/x-javascript 159.45.170.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wellsfargo.com/js/frameworks/jq/jquery.js

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.170.145 San Francisco, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

64f941b34d5f011e147a837d1f30eb3f89c51c16dc0f459523c74f631f0e7049

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wellsfargo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:02 GMT
Content-encoding: gzip
Last-modified: Sat, 07 Oct 2017 04:35:02 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
Etag: W/"1816f-59d85976"
Vary: accept-encoding
Content-type: application/x-javascript;charset=UTF-8
Expires: Sat, 28 Oct 2017 12:50:02 GMT
Cache-control: max-age=1800
Transfer-encoding: chunked
Set-Cookie: ISD_WWWAF_COOKIE=!FwSzk3q4i0Ikdvo3qEdzUooI7UIKepR7C3CRdgrSCljMobylAS/IXq42l8FqNL4txeHGNsAdIYGAoA==; path=/ ISD_WWWAF_COOKIE=!FwSzk3q4i0Ikdvo3qEdzUooI7UIKepR7C3CRdgrSCljMobylAS/IXq42l8FqNL4txeHGNsAdIYGAoA==; path=/; domain=; HttpOnly; Secure
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.1 200
OK Cookie set home.js Show response
www.wellsfargo.com/js/global/ 113 KB
29 KB 741ms
179ms Script
application/x-javascript 159.45.170.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wellsfargo.com/js/global/home.js

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.170.145 San Francisco, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

b30deb3f273dd440fc027a81c5a0ead33ca5a3c801380d7498c0e0d1139bcee3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wellsfargo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:02 GMT
Content-encoding: gzip
Last-modified: Sat, 07 Oct 2017 04:35:02 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
Etag: W/"1c5c9-59d85976"
Vary: accept-encoding
Content-type: application/x-javascript;charset=UTF-8
Expires: Sat, 28 Oct 2017 12:50:02 GMT
Cache-control: max-age=1800
Transfer-encoding: chunked
Set-Cookie: ISD_WWWAF_COOKIE=!8YSyHb7XFcJvl49jC1Jz/B35oHNpRNEHN0s5eG96zNcP2ME5/gAB/z/9PbgEYT/NdiXQPDb/1WFPcA==; path=/ ISD_WWWAF_COOKIE=!8YSyHb7XFcJvl49jC1Jz/B35oHNpRNEHN0s5eG96zNcP2ME5/gAB/z/9PbgEYT/NdiXQPDb/1WFPcA==; path=/; domain=; HttpOnly; Secure
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.1 200
OK Cookie set tas.js Show response
www.wellsfargo.com/js/global/ 3 KB
1 KB 732ms
171ms Script
application/x-javascript 159.45.170.145
Wells Fargo & Com...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wellsfargo.com/js/global/tas.js

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

159.45.170.145 San Francisco, United States, ASN10837 (WELLSFARGO-10837 - Wells Fargo & Company, US),

Reverse DNS

Software

KONICHIWA/2.0 /

Resource Hash

84bbaa858fe566665f3d4b5c97431c4e56d8a023fc72615a27d0171614851886

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wellsfargo.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://goldenelephanthostel.com/includes/wellsfargo/identity.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:02 GMT
Content-encoding: gzip
Last-modified: Sat, 07 Oct 2017 04:35:02 GMT
Server: KONICHIWA/2.0
X-frame-options: SAMEORIGIN
Etag: W/"a9b-59d85976"
Vary: accept-encoding
Content-type: application/x-javascript;charset=UTF-8
Expires: Sat, 28 Oct 2017 12:50:02 GMT
Cache-control: max-age=1800
Transfer-encoding: chunked
Set-Cookie: ISD_WWWAF_COOKIE=!GvW+LEuuGhPzK+U3qEdzUooI7UIKekSZ1UrwwXA6Q4isT4iCqjyxB1Tv5Cz/GWhFE9XYcnnKzP9a3Q==; path=/ ISD_WWWAF_COOKIE=!GvW+LEuuGhPzK+U3qEdzUooI7UIKekSZ1UrwwXA6Q4isT4iCqjyxB1Tv5Cz/GWhFE9XYcnnKzP9a3Q==; path=/; domain=; HttpOnly; Secure
X-xss-protection: 1; mode=block
X-ua-compatible: IE=edge

GET
H/1.1 200
OK sprite-homepage.png
www01.wellsfargomedia.com/assets/images/css/ 22 KB
22 KB 30ms
24ms Image
image/png 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/css/sprite-homepage.png

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

297662a85dae4b1360d8a87cf7cfa04bf36608c0d290c2ece76fdd35da059b0a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Mon, 08 Feb 2016 23:43:19 GMT
Server: KONICHIWA/2.0
ETag: "5660-56b92817"
X-frame-options: SAMEORIGIN
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22112
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK btn-icon-search.png
www01.wellsfargomedia.com/assets/images/css/template/ 1 KB
1 KB 17ms
7ms Image
image/png 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/css/template/btn-icon-search.png

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

da38fd7d6d2e1425dc8fecba13e64cd220d4f34d7c7d3ae76f9916d3b489b5d2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Sun, 14 Sep 2014 00:00:35 GMT
Server: KONICHIWA/2.0
ETag: "50f-5414daa3"
X-frame-options: SAMEORIGIN
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1295
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

GET
H/1.1 200
OK bg-footer.png
www01.wellsfargomedia.com/assets/images/css/template/ 1 KB
1 KB 23ms
11ms Image
image/png 104.108.68.65
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www01.wellsfargomedia.com/assets/images/css/template/bg-footer.png

Requested by

Host: goldenelephanthostel.com
URL: http://goldenelephanthostel.com/includes/wellsfargo/identity.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.65 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-108-68-65.deploy.static.akamaitechnologies.com

Software

KONICHIWA/2.0 /

Resource Hash

1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www01.wellsfargomedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www01.wellsfargomedia.com/css/home/homepage.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 28 Oct 2017 12:20:01 GMT
Last-Modified: Fri, 24 May 2013 20:02:32 GMT
Server: KONICHIWA/2.0
ETag: "583-519fc758"
X-frame-options: SAMEORIGIN
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=1800
X-ua-compatible: IE=edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1411
X-xss-protection: 1; mode=block
Expires: Sat, 28 Oct 2017 12:50:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

goldenelephanthostel.com
www.wellsfargo.com
www01.wellsfargomedia.com
104.108.68.65
159.45.170.145
66.147.240.181
1ed889a15705bc76729d29d715c64f3d7f35de2ea519e1d2704924cf40d9e30d
1f55cd70e90f5dcc98ed0b5555f10259828e3084d36d0567b15b35e5bd523823
297662a85dae4b1360d8a87cf7cfa04bf36608c0d290c2ece76fdd35da059b0a
397bf475ca4b12d3595efbfebb09b9dff2529df4c3a55e5a3bbe7fab0a5cefe7
565263d801f4fd62e36c1808df02ba171fc66b25e10392a53bc7f2f996436097
64f941b34d5f011e147a837d1f30eb3f89c51c16dc0f459523c74f631f0e7049
84bbaa858fe566665f3d4b5c97431c4e56d8a023fc72615a27d0171614851886
8784635b44663acc6868117191a30671f40c051bfd0db9bdbe2a994243882f52
b30deb3f273dd440fc027a81c5a0ead33ca5a3c801380d7498c0e0d1139bcee3
da38fd7d6d2e1425dc8fecba13e64cd220d4f34d7c7d3ae76f9916d3b489b5d2
dc9402ae4b104a52590d04c1904e8b9a2e21bbb5f30a52f7659ee7ef36463964
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db

goldenelephanthostel.com Open in urlscan Pro 66.147.240.181 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

121 kBTransfer

333 kBSize

0 Cookies

20 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

goldenelephanthostel.com Open in urlscan Pro
66.147.240.181 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

121 kB
Transfer

333 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!