urlscan.io logo urlscan.io
SecurityTrails logo

l4op.com Open in urlscan Pro
154.16.116.164  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://storage.googleapis.com/uiowa/iowa.htm
Effective URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Submission: On March 15 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 6 domains to perform 30 HTTP transactions. The main IP is 154.16.116.164, located in Petah Tiqwa, Israel and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is l4op.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 8th 2019. Valid for: 3 months.
This is the only time l4op.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Universities (Education) University of Iowa (Education)

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
8 154.16.116.164 36352 (AS-COLOCR...)
2 209.197.3.7 20446 (HIGHWINDS3)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 34.242.34.56 16509 (AMAZON-02)
30 8
1    2a00:1450:4001:81b::2010 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
storage.googleapis.com
8    154.16.116.164 (Petah Tiqwa, Israel)

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: server.donedserver.com
l4op.com
2    209.197.3.7 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x007.map2.ssl.hwcdn.net
e2b8u3v8.map2.ssl.hwcdn.net
2    2a00:1450:4001:808::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ssl.google-analytics.com
1    2a00:1450:4001:818::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2a00:1450:4001:816::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    34.242.34.56 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-242-34-56.eu-west-1.compute.amazonaws.com
endpoint1.collection.eu.sumologic.com
Domain Requested by
8 l4op.com storage.googleapis.com
l4op.com
2 ssl.google-analytics.com l4op.com
2 e2b8u3v8.map2.ssl.hwcdn.net l4op.com
1 endpoint1.collection.eu.sumologic.com
1 www.google-analytics.com e2b8u3v8.map2.ssl.hwcdn.net
1 ajax.googleapis.com l4op.com
1 storage.googleapis.com
0 cipmepknanmbbaneimacddfemfbfgpgo Failed l4op.com
30 8

This site contains links to these domains. Also see Links.

Domain
apps.its.uiowa.edu
myui.uiowa.edu
Subject Issuer Validity Valid
*.storage.googleapis.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
l4op.com
cPanel, Inc. Certification Authority		 2019-01-08 -
2019-04-08		 3 months crt.sh
*.map2.ssl.hwcdn.net
COMODO RSA Domain Validation Secure Server CA		 2018-04-10 -
2020-04-09		 2 years crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
endpoint1.collection.eu.sumologic.com
GeoTrust RSA CA 2018		 2018-02-23 -
2020-02-23		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Frame ID: 7F1579BB1092138F043C967C2673086C
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://storage.googleapis.com/uiowa/iowa.htm Page URL
  2. https://l4op.com/Iowa/ict/college/uiowa/HawkID.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

30
Requests

53 %
HTTPS

57 %
IPv6

6
Domains

8
Subdomains

8
IPs

3
Countries

231 kB
Transfer

500 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://storage.googleapis.com/uiowa/iowa.htm Page URL
  2. https://l4op.com/Iowa/ict/college/uiowa/HawkID.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
iowa.htm
storage.googleapis.com/uiowa/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/uiowa/iowa.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81b::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
b78dde8e5dda52580849a148be01fe076415bff9dd832f7f4060c166ff5c9880

Request headers

:method
GET
:authority
storage.googleapis.com
:scheme
https
:path
/uiowa/iowa.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
x-guploader-uploadid
AEnB2UrtC35Txsr8E2P4mjttbKxEZ1KwEyH3pshjFmiZD8FJsi_a1r-llftgXtrdX_EXzYPCMI4Bq-B8K6Ewo8R_85sqYcD9hQ
expires
Fri, 15 Mar 2019 13:10:45 GMT
date
Fri, 15 Mar 2019 12:10:45 GMT
cache-control
public, max-age=3600
last-modified
Thu, 14 Mar 2019 14:58:58 GMT
etag
"fe2907171523fbab4d835326783e4ba0"
x-goog-generation
1552575538676495
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1282
content-type
text/html
x-goog-hash
crc32c=wIykKw== md5=/ikHFxUj+6tNg1MmeD5LoA==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
content-length
1282
server
UploadServer
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
Primary Request HawkID.php
l4op.com/Iowa/ict/college/uiowa/ 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/uiowa/iowa.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache / PHP/5.6.19
Resource Hash
e73ec758c4da39298816c8e87058029d84beb14bd29d502d4f72af110f869bd7

Request headers

Host
l4op.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://storage.googleapis.com/uiowa/iowa.htm
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://storage.googleapis.com/uiowa/iowa.htm

Response headers

Date
Fri, 15 Mar 2019 12:10:46 GMT
Server
Apache
X-Powered-By
PHP/5.6.19
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
4762
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
bootstrap.min.css
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		97 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/bootstrap.min.css
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
simple-login.css
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/simple-login.css
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1004
ga.js.download
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		45 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/ga.js.download
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
24484
fb9e66ea-4707-4278-8469-574fc4263123.js.download
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		35 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
aa99efb299ea82cf5f741a65d1949694a2a6353c7ebc7a8a54b52857061a56f0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
22380
jquery.min.js.download
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		84 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/jquery.min.js.download
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
jz6rmF.js.download
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		35 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/jz6rmF.js.download
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
476981d3a31a5348ff22f410c2c65ef9960c2cff9f9fa64f5749d05aa4e597b4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
20152
uiowa-dome.png
l4op.com/Iowa/ict/college/uiowa/HawkID_files/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/uiowa-dome.png
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.16.116.164 Petah Tiqwa, Israel, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
server.donedserver.com
Software
Apache /
Resource Hash
5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
l4op.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Last-Modified
Wed, 28 Feb 2018 19:46:04 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
18909
web-search-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
video-search-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
google-images-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
google-translate-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
wikipedia-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
btn_settings.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 		0
0
facebook-share-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
twitter-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
pinterest-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
google-plus-center-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
linkedin-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 		0
0
fb9e66ea-4707-4278-8469-574fc4263123.js
e2b8u3v8.map2.ssl.hwcdn.net/s/ 		42 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://e2b8u3v8.map2.ssl.hwcdn.net/s/fb9e66ea-4707-4278-8469-574fc4263123.js?cb=19408
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.7 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x007.map2.ssl.hwcdn.net
Software
/
Resource Hash
ac9c69a40ac981f62b2560e98899dfc8d72e17370b8c106d8160c28449ce5c77

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
X-HW
1552651847.dop007.pa1.t,1552651847.cds033.pa1.shn,1552651847.dop007.pa1.t,1552651847.cds010.pa1.c
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=11000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
18305
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:808::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
3256
date
Fri, 15 Mar 2019 11:16:31 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17168
expires
Fri, 15 Mar 2019 13:16:31 GMT
dropToShareHint.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 		0
0
dropToSearchHint.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 		0
0
btn_settings.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 		0
0
openxtag.js
ajax.googleapis.com/ajax/libs/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/openxtag.js
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:818::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
24e59526b5fc9816d6e16a670bf9603b1c01ecff1b432926cc3cd72eefaf502c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Origin
https://l4op.com

Response headers

date
Fri, 15 Mar 2019 12:10:47 GMT
x-content-type-options
nosniff
server
sffe
status
404
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
1582
x-xss-protection
1; mode=block
__utm.gif
ssl.google-analytics.com/r/ 		35 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.1&utms=1&utmn=766682764&utmhn=l4op.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=HawkID%20Login%20for%20myUI&utmhid=1134264857&utmr=https%3A%2F%2Fstorage.googleapis.com%2Fuiowa%2Fiowa.htm&utmp=%2FIowa%2Fict%2Fcollege%2Fuiowa%2FHawkID.php&utmht=1552651847663&utmac=UA-21427431-1&utmcc=__utma%3D46528762.263456262.1552651848.1552651848.1552651848.1%3B%2B__utmz%3D46528762.1552651848.1.1.utmcsr%3Dstorage.googleapis.com%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2Fuiowa%2Fiowa.htm%3B&utmjid=672529366&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:808::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 15 Mar 2019 12:10:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: e2b8u3v8.map2.ssl.hwcdn.net
URL: https://e2b8u3v8.map2.ssl.hwcdn.net/s/fb9e66ea-4707-4278-8469-574fc4263123.js?cb=19408
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
1433
date
Fri, 15 Mar 2019 11:46:54 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Fri, 15 Mar 2019 13:46:54 GMT
jz6rmF.js
e2b8u3v8.map2.ssl.hwcdn.net/k/709010/12c/ 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://e2b8u3v8.map2.ssl.hwcdn.net/k/709010/12c/jz6rmF.js
Requested by
Host: l4op.com
URL: https://l4op.com/Iowa/ict/college/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.7 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x007.map2.ssl.hwcdn.net
Software
/
Resource Hash
97f454e8dd422e2597ec098c1dfd5f13fc9fa19fa7467110e6ca66e34a56b0b1

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 15 Mar 2019 12:10:47 GMT
Content-Encoding
gzip
X-HW
1552651847.dop007.pa1.t,1552651847.cds033.pa1.shn,1552651847.dop007.pa1.t,1552651847.cds025.pa1.c
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=333300
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
13720
ZaVnC4dhaV0dlwzUH4jwlBZmEbcWT-Rv_I4f8ZlE1agy8jZERoSdRvOXpbR9IeET7FInCWksvaYD6lVk3BzasqePUqzTUkY5C2lG7FT7Stj0dpKUzaIKhQ==
endpoint1.collection.eu.sumologic.com/receiver/v1/http/ 		0
782 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://endpoint1.collection.eu.sumologic.com/receiver/v1/http/ZaVnC4dhaV0dlwzUH4jwlBZmEbcWT-Rv_I4f8ZlE1agy8jZERoSdRvOXpbR9IeET7FInCWksvaYD6lVk3BzasqePUqzTUkY5C2lG7FT7Stj0dpKUzaIKhQ==?!~1167~5~v~~~~~NG~mac~gc~0~~709010~97~1~~~~34~~~~
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.34.56 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-242-34-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://l4op.com/Iowa/ict/college/uiowa/HawkID.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/web-search-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/video-search-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-images-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-translate-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/wikipedia-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/btn_settings.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/facebook-share-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/twitter-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/pinterest-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-plus-center-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/linkedin-content.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToShareHint.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToSearchHint.png
Domain
cipmepknanmbbaneimacddfemfbfgpgo
URL
chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/btn_settings.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Universities (Education) University of Iowa (Education)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| amplS object| _gaq number| f81wPVTO object| QXRt undefined| focusControl object| _gat object| gaGlobal object| S0s37 object| b6s87 object| W4I1 function| $ function| jQuery string| GoogleAnalyticsObject function| ga function| beFg object| google_tag_data object| gaplugins

7 Cookies

Domain/Path Name / Value
.l4op.com/ Name: _gid
Value: GA1.2.7964969.1552651848
.l4op.com/ Name: __utmb
Value: 46528762.1.10.1552651848
.l4op.com/ Name: _ga
Value: GA1.2.263456262.1552651848
.l4op.com/ Name: __utmt
Value: 1
.l4op.com/ Name: __utmz
Value: 46528762.1552651848.1.1.utmcsr=storage.googleapis.com|utmccn=(referral)|utmcmd=referral|utmcct=/uiowa/iowa.htm
.l4op.com/ Name: __utmc
Value: 46528762
.l4op.com/ Name: __utma
Value: 46528762.263456262.1552651848.1552651848.1552651848.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cipmepknanmbbaneimacddfemfbfgpgo
e2b8u3v8.map2.ssl.hwcdn.net
endpoint1.collection.eu.sumologic.com
l4op.com
ssl.google-analytics.com
storage.googleapis.com
www.google-analytics.com
cipmepknanmbbaneimacddfemfbfgpgo
154.16.116.164
209.197.3.7
2a00:1450:4001:808::2008
2a00:1450:4001:816::200e
2a00:1450:4001:818::200a
2a00:1450:4001:81b::2010
34.242.34.56
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556
24e59526b5fc9816d6e16a670bf9603b1c01ecff1b432926cc3cd72eefaf502c
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466
476981d3a31a5348ff22f410c2c65ef9960c2cff9f9fa64f5749d05aa4e597b4
5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc
7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
97f454e8dd422e2597ec098c1dfd5f13fc9fa19fa7467110e6ca66e34a56b0b1
aa99efb299ea82cf5f741a65d1949694a2a6353c7ebc7a8a54b52857061a56f0
ac9c69a40ac981f62b2560e98899dfc8d72e17370b8c106d8160c28449ce5c77
b78dde8e5dda52580849a148be01fe076415bff9dd832f7f4060c166ff5c9880
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e73ec758c4da39298816c8e87058029d84beb14bd29d502d4f72af110f869bd7