covid.holdintegrity.com

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 7 HTTP transactions. The main IP is 2607:5300:201:3100::579f, located in Canada and belongs to OVH, FR. The main domain is covid.holdintegrity.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 30th 2020. Valid for: 3 months.

This is the only time covid.holdintegrity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2607:5300:201... 2607:5300:201:3100::579f	16276 (OVH) (OVH)
1	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
7	5

2 2607:5300:201:3100::579f (Canada)

ASN16276 (OVH, FR)

covid.holdintegrity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	google-analytics.com www.google-analytics.com	18 KB
2	holdintegrity.com covid.holdintegrity.com	14 KB
1	googletagmanager.com www.googletagmanager.com	29 KB
1	fontawesome.com use.fontawesome.com	401 KB
1	jsdelivr.net cdn.jsdelivr.net	23 KB
7	5

	Domain	Requested by
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	covid.holdintegrity.com	covid.holdintegrity.com
1	www.googletagmanager.com	covid.holdintegrity.com
1	use.fontawesome.com	covid.holdintegrity.com
1	cdn.jsdelivr.net	covid.holdintegrity.com
7	5

This site contains links to these domains. Also see Links.

Domain
holdsecurity.com
holdintegrity.com
www.linkedin.com
twitter.com

Subject Issuer	Validity	Valid
covid.holdintegrity.com Let's Encrypt Authority X3	`2020-03-30` - `2020-06-28`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-06` - `2020-10-09`	6 months	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://covid.holdintegrity.com/download/
Frame ID: 35C7BAA0BBA738EB1989D26317078585
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bulma (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bulma(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

7
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

485 kB
Transfer

1339 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://holdsecurity.com/
Title: Hold Security

Search URL Search Domain Scan URL

URL: https://holdintegrity.com/
Title: Hold Integrity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/hold-security-llc/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/holdsecurity
Title: Twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
covid.holdintegrity.com/download/ 54 KB
4 KB 378ms
127ms Document
text/html 2607:5300:201:3100::579f
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://covid.holdintegrity.com/download/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:5300:201:3100::579f , Canada, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx/1.17.9 / PHP/7.4.4
Resource Hash: 5fd70c58985392c95290debab0bce6b642bf770d32757bd756c393e4b4330e62

Request headers

:method: GET
:authority: covid.holdintegrity.com
:scheme: https
:path: /download/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
server: nginx/1.17.9
date: Tue, 07 Apr 2020 16:50:48 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.4
content-encoding: gzip

GET
H2 200 bulma.min.css
cdn.jsdelivr.net/npm/bulma@0.8.0/css/ 190 KB
23 KB 35ms
20ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bulma@0.8.0/css/bulma.min.css

Requested by

Host: covid.holdintegrity.com
URL: https://covid.holdintegrity.com/download/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fd339cab543a859656bb9e510b0da6192295df1560f2b50b6257e4da1fa1752

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://covid.holdintegrity.com/download/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Tue, 07 Apr 2020 16:50:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 13859370
cf-ray: 58053ff2ac0a97b4-FRA
x-cache: MISS, HIT
status: 200
vary: Accept-Encoding
x-served-by: cache-ams21021-AMS, cache-fra19131-FRA
server: cloudflare
etag: W/"2f774-10JBKg2z6p+FXctVCwFYCtuTna4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *

GET
H2 200 all.js Show response
use.fontawesome.com/releases/v5.3.1/js/ 963 KB
401 KB 161ms
9ms Script
application/javascript 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.3.1/js/all.js
Requested by: Host: covid.holdintegrity.com
URL: https://covid.holdintegrity.com/download/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8cb270b4d9485a93b31df98113fda8723ffc067fa7bfa90cedd47b76f7b10be1

Request headers

Referer: https://covid.holdintegrity.com/download/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 07 Apr 2020 16:50:49 GMT
content-encoding: gzip
last-modified: Tue, 28 Aug 2018 18:00:39 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"d0482db440697a659af4980d2e841891"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 holdintegrity-logo.png
covid.holdintegrity.com/images/ 10 KB
10 KB 101ms
101ms Image
image/png 2607:5300:201:3100::579f
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://covid.holdintegrity.com/images/holdintegrity-logo.png
Requested by: Host: covid.holdintegrity.com
URL: https://covid.holdintegrity.com/download/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:5300:201:3100::579f , Canada, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx/1.17.9 /
Resource Hash: a2fbdd992fd951a200aa8e2be933ab9dbe855fdae9f9d6e2443ffa626430e9d5

Request headers

Referer: https://covid.holdintegrity.com/download/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 07 Apr 2020 16:50:49 GMT
last-modified: Mon, 30 Mar 2020 14:00:31 GMT
server: nginx/1.17.9
etag: "5e81fb7f-2844"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 10308

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 78 KB
29 KB 41ms
41ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-113412746-3

Requested by

Host: covid.holdintegrity.com
URL: https://covid.holdintegrity.com/download/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

30a93f687b9cb73cfc781d1fac161fc98ddf339f1c239d56994433f6b53d7955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://covid.holdintegrity.com/download/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 07 Apr 2020 16:50:49 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 29580
x-xss-protection: 0
last-modified: Tue, 07 Apr 2020 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Apr 2020 16:50:49 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-113412746-3

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://covid.holdintegrity.com/download/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 1037
date: Tue, 07 Apr 2020 16:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Tue, 07 Apr 2020 18:33:32 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
128 B 15ms
14ms XHR
text/plain 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j81&a=897156454&t=pageview&_s=1&dl=https%3A%2F%2Fcovid.holdintegrity.com%2Fdownload%2F&ul=en-us&de=UTF-8&dt=Hold%20Integrity%20%E2%80%93%20Stop%20COVID-19%20Cyber%20Fraud&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAcABAAAAAC~&jid=1278729099&gjid=85601529&cid=883837390.1586278250&tid=UA-113412746-3&_gid=854490915.1586278250&_r=1&gtm=2ou3p1&z=269061537

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://covid.holdintegrity.com/download/
Origin: https://covid.holdintegrity.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Apr 2020 16:50:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://covid.holdintegrity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.holdintegrity.com/	1970-01-19 08:39:24	Name: _gid Value: GA1.2.854490915.1586278250
.holdintegrity.com/	1970-01-19 08:37:58	Name: _gat_gtag_UA_113412746_3 Value: 1
.holdintegrity.com/	1970-01-20 02:09:10	Name: _ga Value: GA1.2.883837390.1586278250

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
covid.holdintegrity.com
use.fontawesome.com
www.google-analytics.com
www.googletagmanager.com
23.111.9.35
2606:4700::6810:5514
2607:5300:201:3100::579f
2a00:1450:4001:81c::200e
2a00:1450:4001:81d::2008
0fd339cab543a859656bb9e510b0da6192295df1560f2b50b6257e4da1fa1752
30a93f687b9cb73cfc781d1fac161fc98ddf339f1c239d56994433f6b53d7955
5fd70c58985392c95290debab0bce6b642bf770d32757bd756c393e4b4330e62
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8cb270b4d9485a93b31df98113fda8723ffc067fa7bfa90cedd47b76f7b10be1
a2fbdd992fd951a200aa8e2be933ab9dbe855fdae9f9d6e2443ffa626430e9d5
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

covid.holdintegrity.com Open in urlscan Pro 2607:5300:201:3100::579f Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

485 kBTransfer

1339 kBSize

3 Cookies

4 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

3 Cookies

Indicators

covid.holdintegrity.com Open in urlscan Pro
2607:5300:201:3100::579f Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

485 kB
Transfer

1339 kB
Size

3
Cookies

7 HTTP transactions
0 data transactions