tekshield.cloudcover.it Open in urlscan Pro
216.32.56.110 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Submission: On February 23 via api (February 23rd 2020, 8:08:52 am UTC) from US

Summary HTTP 17 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 216.32.56.110, located in United States and belongs to CENTURYLINK-LEGACY-SAVVIS, US. The main domain is tekshield.cloudcover.it.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 2nd 2019. Valid for: a year.

This is the only time tekshield.cloudcover.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 13	216.32.56.110 216.32.56.110		3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS)
2	23.111.9.35 23.111.9.35		33438 (HIGHWINDS2) (HIGHWINDS2)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a		20446 (HIGHWINDS3) (HIGHWINDS3)
2	2a00:1450:400... 2a00:1450:4001:824::200e		15169 (GOOGLE) (GOOGLE)
17	4

13 216.32.56.110 (United States) 1 redirects

ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)

tekshield.cloudcover.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	cloudcover.it 1 redirects tekshield.cloudcover.it	387 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	fontawesome.com use.fontawesome.com	70 KB
1	jquery.com code.jquery.com	30 KB
17	4

	Domain	Requested by
13	tekshield.cloudcover.it	1 redirects tekshield.cloudcover.it
2	www.google-analytics.com	tekshield.cloudcover.it
2	use.fontawesome.com	tekshield.cloudcover.it
1	code.jquery.com	tekshield.cloudcover.it
17	4

This site contains no links.

Subject Issuer	Validity	Valid
*.cloudcover.it Sectigo RSA Domain Validation Secure Server CA	`2019-07-02` - `2020-08-30`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Frame ID: 65A5E08A276F28ACC8E698D7801A1D6B
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

505 kB
Transfer

1020 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://tekshield.cloudcover.it/Scripts/jquery.unobtrusive-ajax.min.js HTTP 301
https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login Show response
tekshield.cloudcover.it/ 3 KB
2 KB 555ms
196ms Document
text/html 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b12e7a9a697a6f1b17083d15e39e06cc895a0e00266db78ef01f2a49f14e0022

Request headers

:method: GET
:authority: tekshield.cloudcover.it
:scheme: https
:path: /login?url=%2Fcontracts%3Fproperty%3Dexpire
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: document

Response headers

status: 200
cache-control: private
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=pm2gfwxbh5i4fyc2ak3qbjfy; path=/; HttpOnly
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Sun, 23 Feb 2020 08:08:35 GMT
content-length: 1570

GET
H2 200 font-face.css
tekshield.cloudcover.it/content/ 14 KB
2 KB 186ms
184ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/font-face.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c1e802cf65b8a472ab80da196f8df1065fbbd08e988782e25055489bf0cc5917

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "b735ccff90d51:0"
last-modified: Thu, 31 Oct 2019 17:22:45 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 1650

GET
H2 200 all.css
use.fontawesome.com/releases/v5.1.0/css/ 45 KB
11 KB 29ms
28ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
last-modified: Wed, 20 Jun 2018 20:19:16 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"826c57385f3d35cfed5478ba7b1f5c03"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 bootstrap.min.css
tekshield.cloudcover.it/vendor/bootstrap-4.1/ 137 KB
31 KB 392ms
391ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/vendor/bootstrap-4.1/bootstrap.min.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1212f28ff9fe4b7829e31633b30c67bbb1209ecd1a7bb915f96b6e0eedaf02a4

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "9d953deff90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:38 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 32089

GET
H2 200 theme.css
tekshield.cloudcover.it/content/ 245 KB
44 KB 463ms
462ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/theme.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e6fce3d179935b03c7121361b86045e462e23ea69c8f6462ccca8bdc90cab231

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "f5c775d0f90d51:0"
last-modified: Thu, 31 Oct 2019 17:22:47 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 45130

GET
H2 200 site.css
tekshield.cloudcover.it/content/ 10 KB
4 KB 184ms
184ms Stylesheet
text/css 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/content/site.css
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 8c2cf32a0bfcea9c2c11702eff6f6102c1c133995e8a53348d8e9d82f3582504

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "21ba5d0f90d51:0"
last-modified: Thu, 31 Oct 2019 17:22:46 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 3813

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 40ms
7ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 08:08:35 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: W/"5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1582445315.dop097.fr8.shc,1582445315.dop097.fr8.t,1582445315.cds057.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H2 200 108.png
tekshield.cloudcover.it/images/logos/ 2 KB
2 KB 171ms
171ms Image
image/png 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tekshield.cloudcover.it/images/logos/108.png
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2b96a03478161ecbcf30fd5eab645c762b54dea5e0592b004d704ddb054ed4cf

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
last-modified: Thu, 31 Oct 2019 17:23:05 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "59107fdbf90d51:0"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 1935

GET
H2 200 bootstrap.min.js Show response
tekshield.cloudcover.it/vendor/bootstrap-4.1/ 49 KB
19 KB 294ms
293ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/vendor/bootstrap-4.1/bootstrap.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 44a7e1e6e7f4f6ad49f162ce33dfd72f05d3162e150415b7ac9cefba8d51acc1

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "d8cbb4eff90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:39 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 19209

GET
H2

200

jquery.unobtrusive-ajax.min.js Show response
tekshield.cloudcover.it/scripts/
Redirect Chain

https://tekshield.cloudcover.it/Scripts/jquery.unobtrusive-ajax.min.js
https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js

4 KB
2 KB

158ms
157ms

Script
application/javascript

216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "8037b4e5f90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 1620

Redirect headers

status: 301
date: Sun, 23 Feb 2020 08:08:35 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 193
location: https://tekshield.cloudcover.it/scripts/jquery.unobtrusive-ajax.min.js
content-type: text/html; charset=UTF-8

GET
H2 200 main.js Show response
tekshield.cloudcover.it/scripts/ 41 KB
7 KB 207ms
206ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/main.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: bb5696c276b0b67c92180c41f76bf73fae34f64afe3e0c12c21afe7aa48d7806

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "f93ccae7f90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 7549

GET
H2 200 custom.js Show response
tekshield.cloudcover.it/scripts/ 14 KB
5 KB 193ms
192ms Script
application/javascript 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/scripts/custom.js
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 653354883c74c1438eab7f76fd53ebb38db55fab652e630aa41ff114a68a569d

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
content-encoding: gzip
etag: "39d96e4f90d51:0"
last-modified: Thu, 31 Oct 2019 17:23:21 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 4635

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 1205
date: Sun, 23 Feb 2020 07:48:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Sun, 23 Feb 2020 09:48:30 GMT

GET
H2 200 poppins-v5-latin-regular.woff2
tekshield.cloudcover.it/fonts/poppins/ 8 KB
8 KB 167ms
167ms Font
application/font-woff2 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to

Full URL: https://tekshield.cloudcover.it/fonts/poppins/poppins-v5-latin-regular.woff2
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 44bae3586c48283835d9e8155b181de3f59c660b72e3a2b3f2ccb1c0ee618487

Request headers

Referer: https://tekshield.cloudcover.it/content/font-face.css
Origin: https://tekshield.cloudcover.it
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
last-modified: Fri, 15 Mar 2019 16:13:58 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "956993184adbd41:0"
content-type: application/font-woff2
status: 200
accept-ranges: bytes
content-length: 7904

GET
H2 200 loading.gif
tekshield.cloudcover.it/images/ 261 KB
262 KB 196ms
196ms Image
image/gif 216.32.56.110
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tekshield.cloudcover.it/images/loading.gif
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.32.56.110 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: fc7a90ee92500cf7aab3d36e707f49fc809769bea1df8a66a50c0b9b42fd9014

Request headers

Referer: https://tekshield.cloudcover.it/content/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
last-modified: Thu, 31 Oct 2019 17:22:52 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "693148d3f90d51:0"
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 267502

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.1.0/webfonts/ 58 KB
59 KB 185ms
185ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
Requested by: Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

Request headers

Referer: https://use.fontawesome.com/releases/v5.1.0/css/all.css
Origin: https://tekshield.cloudcover.it
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sun, 23 Feb 2020 08:08:35 GMT
last-modified: Wed, 20 Jun 2018 20:19:36 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: "18d2347ab2a9f40ca2247cdb03303d84"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 59572

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1503073325&t=pageview&_s=1&dl=https%3A%2F%2Ftekshield.cloudcover.it%2Flogin%3Furl%3D%252Fcontracts%253Fproperty%253Dexpire&ul=en-us&de=UTF-8&dt=Login&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=331720621&gjid=241161352&cid=1399990176.1582445316&tid=UA-54206512-2&_gid=474741891.1582445316&_r=1&z=967883511

Requested by

Host: tekshield.cloudcover.it
URL: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://tekshield.cloudcover.it/login?url=%2Fcontracts%3Fproperty%3Dexpire
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 08:08:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| bootstrap object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| UpdateUrl function| contractTypeTrigger function| getFormattedDate

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cloudcover.it/	1970-01-19 07:34:05	Name: _gat Value: 1
			.cloudcover.it/	1970-01-19 07:35:31	Name: _gid Value: GA1.2.474741891.1582445316
			.cloudcover.it/	1970-01-20 01:05:17	Name: _ga Value: GA1.2.1399990176.1582445316
			tekshield.cloudcover.it/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: pm2gfwxbh5i4fyc2ak3qbjfy

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
tekshield.cloudcover.it
use.fontawesome.com
www.google-analytics.com
2001:4de0:ac19::1:b:3a
216.32.56.110
23.111.9.35
2a00:1450:4001:824::200e
1212f28ff9fe4b7829e31633b30c67bbb1209ecd1a7bb915f96b6e0eedaf02a4
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2b96a03478161ecbcf30fd5eab645c762b54dea5e0592b004d704ddb054ed4cf
44a7e1e6e7f4f6ad49f162ce33dfd72f05d3162e150415b7ac9cefba8d51acc1
44bae3586c48283835d9e8155b181de3f59c660b72e3a2b3f2ccb1c0ee618487
653354883c74c1438eab7f76fd53ebb38db55fab652e630aa41ff114a68a569d
755f82e7a0f8a0c0ea3ed5806e77b6e4eb0a5e4b96d739f09602b51274e75461
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c2cf32a0bfcea9c2c11702eff6f6102c1c133995e8a53348d8e9d82f3582504
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
b12e7a9a697a6f1b17083d15e39e06cc895a0e00266db78ef01f2a49f14e0022
bb5696c276b0b67c92180c41f76bf73fae34f64afe3e0c12c21afe7aa48d7806
c1e802cf65b8a472ab80da196f8df1065fbbd08e988782e25055489bf0cc5917
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
e6fce3d179935b03c7121361b86045e462e23ea69c8f6462ccca8bdc90cab231
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
fc7a90ee92500cf7aab3d36e707f49fc809769bea1df8a66a50c0b9b42fd9014