excelhhotelgroup.com

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 5 HTTP transactions. The main IP is 132.148.209.240, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is excelhhotelgroup.com.

This is the only time excelhhotelgroup.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online) Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	132.148.209.240 132.148.209.240	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2a2::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.67.139.157 23.67.139.157	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.132.193 151.101.132.193	54113 (FASTLY) (FASTLY - Fastly)
1	45.40.130.22 45.40.130.22	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
5	5

2 132.148.209.240 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-132-148-209-240.ip.secureserver.net

excelhhotelgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2a2::1c24 (European Union)

ASN20940 (AKAMAI-ASN1, US)

c1-excel-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.67.139.157 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-139-157.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.132.193 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.40.130.22 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net

img.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	excelhhotelgroup.com 1 redirects excelhhotelgroup.com	3 KB
1	secureserver.net img.secureserver.net	591 B
1	imgur.com i.imgur.com	129 KB
1	wsimg.com img1.wsimg.com	5 KB
1	office.net c1-excel-15.cdn.office.net	3 KB
5	5

	Domain	Requested by
2	excelhhotelgroup.com	1 redirects
1	img.secureserver.net
1	i.imgur.com	excelhhotelgroup.com
1	img1.wsimg.com	excelhhotelgroup.com
1	c1-excel-15.cdn.office.net	excelhhotelgroup.com
5	5

This site contains no links.

Subject Issuer	Validity	Valid
*.cdn.office.net Microsoft IT TLS CA 5	`2017-11-13` - `2019-11-13`	2 years	crt.sh
*.wsimg.com Starfield Secure Certificate Authority - G2	`2015-11-13` - `2018-11-13`	3 years	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2017-11-15` - `2019-01-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: A8266B3C800B05625EAEAE88FB93A1C8
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://excelhhotelgroup.com/etc/v4/?email=bjjackson@sandiego.gov HTTP 302
http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

60 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

140 kB
Transfer

151 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://excelhhotelgroup.com/etc/v4/?email=bjjackson@sandiego.gov HTTP 302
http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request pb0yal4ky7v26a647we6fxxq.php Show response
excelhhotelgroup.com/etc/v4/
Redirect Chain

http://excelhhotelgroup.com/etc/v4/?email=bjjackson@sandiego.gov
http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bj...

8 KB
2 KB

157ms
156ms

Document
text/html

132.148.209.240
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 132.148.209.240 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-132-148-209-240.ip.secureserver.net
Software: Apache / PHP/7.2.5
Resource Hash: b7f0639181cd408d613457e3afdfd36f32e25c00ba6a712f1f7fe59b7415e6ec

Request headers

Host: excelhhotelgroup.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=11442f46f263b4146cc053caa76f7385
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: A8266B3C800B05625EAEAE88FB93A1C8

Response headers

Date: Fri, 07 Sep 2018 17:29:14 GMT
Server: Apache
X-Powered-By: PHP/7.2.5
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2176
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 07 Sep 2018 17:29:13 GMT
Server: Apache
X-Powered-By: PHP/7.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=11442f46f263b4146cc053caa76f7385; path=/
Location: pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=3941852678&fid=1&fav=1
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK EwaForm.png
c1-excel-15.cdn.office.net/x/s/161082635028__layouts/Resources/1033/ 3 KB
3 KB 7ms
6ms Image
image/png 2a02:26f0:6c00:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-excel-15.cdn.office.net/x/s/161082635028__layouts/Resources/1033/EwaForm.png

Requested by

Host: excelhhotelgroup.com
URL: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2a2::1c24 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

77fc2387bcbb51481e55222829aa9e69668c5f3bc1e1a85cc62b9096265146b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
ETag: W/"7fc8f29dad3ed41:0"
X-OfficeCluster: NL2
X-CCR: true
X-OfficeVersion: 16.0.10825.35026
X-OfficeFE: 73e833795401
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
Content-Length: 2673
Cache-Control: public,max-age=31536000
Last-Modified: Tue, 28 Aug 2018 09:00:50 GMT
X-OFFICEFD: c9c26f94c5a8
X-MSEdge-Ref: Ref A: 43C34319E03D4A68BE6E00E1FA2C2EF4 Ref B: AMS04EDGE0712 Ref C: 2018-08-28T09:00:50Z
X-UserSessionId: 4c01f61f-8385-4bb4-a3f1-4bcb491948b0
Date: Fri, 07 Sep 2018 17:29:14 GMT
Content-Type: image/png
Access-Control-Allow-Origin: *
X-CorrelationId: 4c01f61f-8385-4bb4-a3f1-4bcb491948b0
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
S 200 tcc_l.combined.1.0.6.min.js Show response
img1.wsimg.com/tcc/ 12 KB
5 KB 21ms
7ms Script
application/x-javascript 23.67.139.157
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js
Requested by: Host: excelhhotelgroup.com
URL: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.67.139.157 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-67-139-157.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350

Request headers

Referer: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 07 Sep 2018 17:29:14 GMT
content-encoding: gzip
last-modified: Fri, 31 Mar 2017 16:26:41 GMT
status: 200
etag: "52ef5c943baad21:0"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 4564
expires: Sat, 07 Sep 2019 17:29:14 GMT

GET
S 200 V4pHsJS.png
i.imgur.com/ 129 KB
129 KB 57ms
56ms Image
image/png 151.101.132.193
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.imgur.com/V4pHsJS.png
Requested by: Host: excelhhotelgroup.com
URL: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.132.193 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cat factory 1.0 /
Resource Hash: 92c3b3bb8ea44aadb4c78638c86e5852faa80ea1dadb38436c2b25757c6db098

Request headers

Referer: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 07 Sep 2018 17:29:14 GMT
age: 233781
x-cache: HIT, HIT
status: 200
content-length: 131887
x-served-by: cache-iad2137-IAD, cache-mad9433-MAD
last-modified: Wed, 05 Sep 2018 00:32:52 GMT
server: cat factory 1.0
x-timer: S1536341354.460771,VS0,VE1
etag: "364d61f9336651cd37bcb47aac0b3e72"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H/1.1 200
OK event
img.secureserver.net/t/1/tl/ 43 B
591 B 332ms
164ms Image
image/gif 45.40.130.22
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.secureserver.net/t/1/tl/event?cts=1536341354705&tce=1536341354250&tcs=1536341354250&tdc=1536341354504&tdclee=1536341354479&tdcles=1536341354479&tdi=1536341354479&tdl=1536341354418&tdle=1536341354250&tdls=1536341354250&tfs=1536341354250&tns=1536341353441&trqs=1536341354258&tre=1536341354417&trps=1536341354415&tles=1536341354504&tlee=1536341354504&ht=perf&dh=excelhhotelgroup.com&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&vci=774934766&cv=1.0.6&z=1087326966&vg=1ff7eb6b-4707-4cb9-ab9c-026fee854f6f&vtg=1ff7eb6b-4707-4cb9-ab9c-026fee854f6f&ap=cpbh&trfd=%7B%22cts%22%3A1536341354474%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpbh%22%2C%22server%22%3A%22p3plvcpnl100297%22%7D&dp=%2Fetc%2Fv4%2Fpb0yal4ky7v26a647we6fxxq.php
Protocol: HTTP/1.1
Server: 45.40.130.22 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-45-40-130-22.ip.secureserver.net
Software: Microsoft-IIS/8.5 / ARR/2.5, ASP.NET
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: http://excelhhotelgroup.com/etc/v4/pb0yal4ky7v26a647we6fxxq.php?rand=13InboxLightaspxn.1774256418&fid.4.3941852678&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.3941852678&fid.1&fav.1&email=bjjackson@sandiego.gov&emailID=bjjackson&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 07 Sep 2018 17:29:14 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ARR/2.5, ASP.NET
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Access-Control-Allow-Origin: http://excelhhotelgroup.com, *
Cache-Control: 0
Content-Type: image/gif
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 43

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Excel / PDF download (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c1-excel-15.cdn.office.net
excelhhotelgroup.com
i.imgur.com
img.secureserver.net
img1.wsimg.com
132.148.209.240
151.101.132.193
23.67.139.157
2a02:26f0:6c00:2a2::1c24
45.40.130.22
77fc2387bcbb51481e55222829aa9e69668c5f3bc1e1a85cc62b9096265146b2
92c3b3bb8ea44aadb4c78638c86e5852faa80ea1dadb38436c2b25757c6db098
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
b7f0639181cd408d613457e3afdfd36f32e25c00ba6a712f1f7fe59b7415e6ec

excelhhotelgroup.com Open in urlscan Pro 132.148.209.240 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

140 kBTransfer

151 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

excelhhotelgroup.com Open in urlscan Pro
132.148.209.240 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

140 kB
Transfer

151 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!