tekshield.cloudcover.it Open in urlscan Pro
216.32.56.110 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Submission: On September 07 via api (September 7th 2020, 4:30:01 pm UTC) from US

Summary HTTP 16 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 216.32.56.110, located in United States and belongs to CENTURYLINK-LEGACY-SAVVIS, US. The main domain is tekshield.cloudcover.it.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 31st 2020. Valid for: a year.

This is the only time tekshield.cloudcover.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 12	216.32.56.110 216.32.56.110		3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS)
2	23.111.9.35 23.111.9.35		33438 (HIGHWINDS2) (HIGHWINDS2)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b		20446 (HIGHWINDS3) (HIGHWINDS3)
2	2a00:1450:400... 2a00:1450:4001:801::200e		15169 (GOOGLE) (GOOGLE)
16	4

12 216.32.56.110 (United States) 1 redirects

ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)

tekshield.cloudcover.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	cloudcover.it 1 redirects tekshield.cloudcover.it	128 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	fontawesome.com use.fontawesome.com	70 KB
1	jquery.com code.jquery.com	30 KB
16	4

	Domain	Requested by
12	tekshield.cloudcover.it	1 redirects tekshield.cloudcover.it
2	www.google-analytics.com	tekshield.cloudcover.it www.google-analytics.com
2	use.fontawesome.com	tekshield.cloudcover.it use.fontawesome.com
1	code.jquery.com	tekshield.cloudcover.it
16	4

This site contains no links.

Subject Issuer	Validity	Valid
*.cloudcover.it Sectigo RSA Domain Validation Secure Server CA	`2020-08-31` - `2021-08-31`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Frame ID: F8AB6EB309ACB68DCA7B80BA54D1607E
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

246 kB
Transfer

767 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://tekshield.cloudcover.it/Scripts/jquery.unobtrusive-ajax.min.js HTTP 301
https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login Show response
tekshield.cloudcover.it/ 3 KB
2 KB 669ms
253ms Document
text/html 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b12e7a9a697a6f1b17083d15e39e06cc895a0e00266db78ef01f2a49f14e0022

Request headers

:method: GET
:authority: tekshield.cloudcover.it
:scheme: https
:path: /login?url=%2Fcontracts%3Fproperty%3Dexpire
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: private
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=21vxiijy5ite31pefacc1onw; path=/; HttpOnly; SameSite=Lax
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 07 Sep 2020 16:29:44 GMT
content-length: 1570

GET
H2 200 font-face.css
tekshield.cloudcover.it/content/ 14 KB
2 KB 306ms
305ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/font-face.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c1e802cf65b8a472ab80da196f8df1065fbbd08e988782e25055489bf0cc5917

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "b735ccff90d51:0"
last-modified: Thu, 31 Oct 2019 17:22:45 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 1650

GET
H2 200 all.css
use.fontawesome.com/releases/v5.1.0/css/ 45 KB
11 KB 137ms
45ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
last-modified: Wed, 20 Jun 2018 20:19:16 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"826c57385f3d35cfed5478ba7b1f5c03"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 bootstrap.min.css
tekshield.cloudcover.it/vendor/bootstrap-4.1/ 137 KB
31 KB 488ms
486ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/vendor/bootstrap-4.1/bootstrap.min.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1212f28ff9fe4b7829e31633b30c67bbb1209ecd1a7bb915f96b6e0eedaf02a4

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "9d953deff90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:38 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 32089

GET
H2 200 theme.css
tekshield.cloudcover.it/content/ 245 KB
44 KB 521ms
520ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/theme.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 56a8ee156f734e7201bfb7ef2a4933e0c58f19bf4b2458ca2ff79347032ad4f6

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "73328bef5d6cd61:0"
last-modified: Fri, 07 Aug 2020 01:56:16 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 45181

GET
H2 200 site.css
tekshield.cloudcover.it/content/ 12 KB
5 KB 317ms
316ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/site.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c9999cae2fe6729f5edf6c0fae0f1094da6f7edf33452ac3c35fae2f24fa7c0b

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "b5154c621e78d61:0"
last-modified: Sat, 22 Aug 2020 00:51:34 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 4673

GET
H2 200 jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 271ms
8ms Script
application/javascript 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
last-modified: Sat, 20 Jan 2018 17:26:44 GMT
server: nginx
status: 200
etag: W/"5a637bd4-1538f"
vary: Accept-Encoding
x-hw: 1599496184.dop208.fr8.t,1599496184.cds220.fr8.hc,1599496184.cds057.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30288

GET
H2 200 108.png
tekshield.cloudcover.it/images/logos/ 2 KB
2 KB 205ms
203ms Image
image/png 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tekshield.cloudcover.it/images/logos/108.png
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2b96a03478161ecbcf30fd5eab645c762b54dea5e0592b004d704ddb054ed4cf

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
last-modified: Thu, 31 Oct 2019 17:23:05 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "59107fdbf90d51:0"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 1935

GET
H2 200 bootstrap.min.js Show response
tekshield.cloudcover.it/vendor/bootstrap-4.1/ 49 KB
19 KB 249ms
249ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/vendor/bootstrap-4.1/bootstrap.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 44a7e1e6e7f4f6ad49f162ce33dfd72f05d3162e150415b7ac9cefba8d51acc1

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "d8cbb4eff90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:39 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 19209

GET
H2

200

jquery.unobtrusive-ajax.min.js Show response
tekshield.cloudcover.it/scripts/
Redirect Chain

https://tekshield.cloudcover.it/Scripts/jquery.unobtrusive-ajax.min.js
https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js

4 KB
2 KB

197ms
197ms

Script
application/javascript

216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:45 GMT
content-encoding: gzip
etag: "8037b4e5f90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 1620

Redirect headers

status: 301
date: Mon, 07 Sep 2020 16:29:44 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 193
location: https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js
content-type: text/html; charset=UTF-8

GET
H2 200 main.js Show response
tekshield.cloudcover.it/scripts/ 41 KB
7 KB 250ms
248ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/main.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: bb5696c276b0b67c92180c41f76bf73fae34f64afe3e0c12c21afe7aa48d7806

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "f93ccae7f90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 7549

GET
H2 200 custom.js Show response
tekshield.cloudcover.it/scripts/ 19 KB
6 KB 229ms
227ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/custom.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 19d6cacd145624a7ebcbfaa721786f442b0a11dfbc09aeff527e080b75742f5b

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
content-encoding: gzip
etag: "b95ebcf05d6cd61:0"
last-modified: Fri, 07 Aug 2020 01:56:18 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 6298

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Aug 2020 20:46:40 GMT
server: Golfe2
age: 4445
date: Mon, 07 Sep 2020 15:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18323
expires: Mon, 07 Sep 2020 17:15:40 GMT

GET
H2 200 poppins-v5-latin-regular.woff2
tekshield.cloudcover.it/fonts/poppins/ 8 KB
8 KB 204ms
204ms Font
application/font-woff2 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/fonts/poppins/poppins-v5-latin-regular.woff2
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/content/font-face.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 44bae3586c48283835d9e8155b181de3f59c660b72e3a2b3f2ccb1c0ee618487

Request headers

Origin: https://tekshield.cloudcover.it
Referer: https://tekshield.cloudcover.it/content/font-face.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:44 GMT
last-modified: Fri, 15 Mar 2019 16:13:58 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "956993184adbd41:0"
content-type: application/font-woff2
status: 200
accept-ranges: bytes
content-length: 7904

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.1.0/webfonts/ 58 KB
59 KB 150ms
45ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

Request headers

Origin: https://tekshield.cloudcover.it
Referer: https://use.fontawesome.com/releases/v5.1.0/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:29:45 GMT
last-modified: Wed, 20 Jun 2018 20:19:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: "18d2347ab2a9f40ca2247cdb03303d84"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 59572

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
69 B 13ms
13ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j85&a=874309609&t=pageview&_s=1&dl=https%3A%2F%2Ftekshield.cloudcover.it%2Flogin%3Furl%3D%252Fcontracts%253Fproperty%253Dexpire&ul=en-us&de=UTF-8&dt=Login&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=715373770&gjid=2048134344&cid=900427870.1599496185&tid=UA-54206512-2&_gid=1976097793.1599496185&_r=1&z=1535870401

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Sep 2020 16:29:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://tekshield.cloudcover.it
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| bootstrap object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| UpdateUrl function| contractTypeTrigger function| getFormattedDate function| autocomplete

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cloudcover.it/	1970-01-19 12:18:16	Name: _gat Value: 1
			.cloudcover.it/	1970-01-19 12:19:42	Name: _gid Value: GA1.2.1976097793.1599496185
			.cloudcover.it/	1970-01-20 05:49:28	Name: _ga Value: GA1.2.900427870.1599496185
			tekshield.cloudcover.it/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 21vxiijy5ite31pefacc1onw

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
tekshield.cloudcover.it
use.fontawesome.com
www.google-analytics.com
2001:4de0:ac19::1:b:1b
216.32.56.110
23.111.9.35
2a00:1450:4001:801::200e
1212f28ff9fe4b7829e31633b30c67bbb1209ecd1a7bb915f96b6e0eedaf02a4
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
19d6cacd145624a7ebcbfaa721786f442b0a11dfbc09aeff527e080b75742f5b
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
2b96a03478161ecbcf30fd5eab645c762b54dea5e0592b004d704ddb054ed4cf
44a7e1e6e7f4f6ad49f162ce33dfd72f05d3162e150415b7ac9cefba8d51acc1
44bae3586c48283835d9e8155b181de3f59c660b72e3a2b3f2ccb1c0ee618487
56a8ee156f734e7201bfb7ef2a4933e0c58f19bf4b2458ca2ff79347032ad4f6
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
b12e7a9a697a6f1b17083d15e39e06cc895a0e00266db78ef01f2a49f14e0022
bb5696c276b0b67c92180c41f76bf73fae34f64afe3e0c12c21afe7aa48d7806
c1e802cf65b8a472ab80da196f8df1065fbbd08e988782e25055489bf0cc5917
c9999cae2fe6729f5edf6c0fae0f1094da6f7edf33452ac3c35fae2f24fa7c0b
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550