jharriott.arkansasheatelite.org

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 108.167.142.86, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is jharriott.arkansasheatelite.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 28th 2019. Valid for: 3 months.

This is the only time jharriott.arkansasheatelite.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Universities (Education)

Domain & IP information

	IP Address	AS Autonomous System
4	108.167.142.86 108.167.142.86	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
3	163.1.221.200 163.1.221.200	786 (JANET Jis...) (JANET Jisc Services Limited)
7	2

4 108.167.142.86 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: misscreature.com

jharriott.arkansasheatelite.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 163.1.221.200 (Oxford, United Kingdom)

ASN786 (JANET Jisc Services Limited, GB)
PTR: webauth2.ox.ac.uk

webauth.ox.ac.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	arkansasheatelite.org jharriott.arkansasheatelite.org	7 KB
3	ox.ac.uk webauth.ox.ac.uk	33 KB
7	2

	Domain	Requested by
4	jharriott.arkansasheatelite.org	jharriott.arkansasheatelite.org
3	webauth.ox.ac.uk	jharriott.arkansasheatelite.org
7	2

This site contains links to these domains. Also see Links.

Domain
help.it.ox.ac.uk
webauth.ox.ac.uk
www.it.ox.ac.uk

Subject Issuer	Validity	Valid
jharriott.arkansasheatelite.org Let's Encrypt Authority X3	`2019-12-28` - `2020-03-27`	3 months	crt.sh
webauth.ox.ac.uk AffirmTrust Certificate Authority - OV1	`2018-09-26` - `2020-09-26`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://jharriott.arkansasheatelite.org/include/index.html
Frame ID: 598413C6248355F68C7C7435C7FA6BC0
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

40 kB
Transfer

50 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://help.it.ox.ac.uk/webauth/oxfordusername
Title: Oxford username

Search URL Search Domain Scan URL

URL: http://help.it.ox.ac.uk/webauth/oxfordusername#forgotten
Title: Having trouble logging in?

Search URL Search Domain Scan URL

URL: https://webauth.ox.ac.uk/activate
Title: Activate a new account

Search URL Search Domain Scan URL

URL: http://www.it.ox.ac.uk/rules
Title: University of Oxford Computer Usage Rules and Etiquette

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.html Show response
jharriott.arkansasheatelite.org/include/ 5 KB
2 KB 546ms
176ms Document
text/html 108.167.142.86
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://jharriott.arkansasheatelite.org/include/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.167.142.86 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: misscreature.com
Software: nginx/1.17.6 /
Resource Hash: d51f4027e94991f12bd3dcb0f3ce71291d646e478e88869036ca812da6b749b1

Request headers

:method: GET
:authority: jharriott.arkansasheatelite.org
:scheme: https
:path: /include/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Wed, 15 Jan 2020 12:10:33 GMT
server: nginx/1.17.6
content-type: text/html
content-length: 2227
last-modified: Wed, 15 Jan 2020 08:41:00 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-server-cache: false

GET
H2 200 webauth.css
jharriott.arkansasheatelite.org/include/index_files/ 9 KB
3 KB 232ms
232ms Stylesheet
text/css 108.167.142.86
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://jharriott.arkansasheatelite.org/include/index_files/webauth.css
Requested by: Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.167.142.86 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: misscreature.com
Software: nginx/1.17.6 /
Resource Hash: 8efdcc9e95f8e9c766df8193ae271b5ec36ecfb7b72dfdf92bdc6887f0247749

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 15 Jan 2020 12:10:33 GMT
content-encoding: gzip
last-modified: Wed, 15 Jan 2020 08:41:00 GMT
server: nginx/1.17.6
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 3298

GET
H2 200 webauth-large.css
jharriott.arkansasheatelite.org/include/index_files/ 3 KB
1 KB 195ms
194ms Stylesheet
text/css 108.167.142.86
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://jharriott.arkansasheatelite.org/include/index_files/webauth-large.css
Requested by: Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.167.142.86 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: misscreature.com
Software: nginx/1.17.6 /
Resource Hash: d3baed52cb2be7d3f0ee779100be409a999ce50751809468c79cbe0276e13bbf

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 15 Jan 2020 12:10:33 GMT
content-encoding: gzip
last-modified: Wed, 15 Jan 2020 08:41:00 GMT
server: nginx/1.17.6
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 1067

GET
H2 200 webauth-handheld.css
jharriott.arkansasheatelite.org/include/index_files/ 2 KB
853 B 184ms
184ms Stylesheet
text/css 108.167.142.86
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: https://jharriott.arkansasheatelite.org/include/index_files/webauth-handheld.css
Requested by: Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.167.142.86 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: misscreature.com
Software: nginx/1.17.6 /
Resource Hash: 38238a3c2b869b27ed3e8e17afd9df7f02e832f33c31c8bb6f885354480f498b

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 15 Jan 2020 12:10:33 GMT
content-encoding: gzip
last-modified: Wed, 15 Jan 2020 08:41:00 GMT
server: nginx/1.17.6
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 813

GET
H/1.1 200
OK header-bg.jpg
webauth.ox.ac.uk/images/ 19 KB
19 KB 245ms
30ms Image
image/jpeg 163.1.221.200
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webauth.ox.ac.uk/images/header-bg.jpg

Requested by

Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

163.1.221.200 Oxford, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),

Reverse DNS

webauth2.ox.ac.uk

Software

Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141 /

Resource Hash

5ebb16ae872ad8e63c53c0153918b7242c124145e7b87c1b3543725ef90ae958

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	DENY

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index_files/webauth-large.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 15 Jan 2020 12:10:34 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Tue, 03 Nov 2009 11:56:03 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141
ETag: "4aa2-477762dacfac0"
X-Frame-Options: DENY
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 19106

GET
H/1.1 200
OK crest.png
webauth.ox.ac.uk/images/ 7 KB
7 KB 242ms
28ms Image
image/png 163.1.221.200
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webauth.ox.ac.uk/images/crest.png

Requested by

Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

163.1.221.200 Oxford, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),

Reverse DNS

webauth2.ox.ac.uk

Software

Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141 /

Resource Hash

aa6d58cc6907b55d3a4c4eb62cb980e6cb02dd01364c98afdfdb50d33cd57867

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	DENY

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index_files/webauth-large.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 15 Jan 2020 12:10:34 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Wed, 30 Jul 2008 13:31:29 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141
ETag: "1ace-4533dc620ee40"
X-Frame-Options: DENY
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 6862

GET
H/1.1 200
OK servicename.png
webauth.ox.ac.uk/images/ 6 KB
7 KB 245ms
31ms Image
image/png 163.1.221.200
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webauth.ox.ac.uk/images/servicename.png

Requested by

Host: jharriott.arkansasheatelite.org
URL: https://jharriott.arkansasheatelite.org/include/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

163.1.221.200 Oxford, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),

Reverse DNS

webauth2.ox.ac.uk

Software

Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141 /

Resource Hash

d99de8c81f831ff1f926c99ea0269330391834e1262cb89965f6594890fcc33f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	DENY

Request headers

Referer: https://jharriott.arkansasheatelite.org/include/index_files/webauth-large.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 15 Jan 2020 12:10:34 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Tue, 18 Sep 2012 13:17:55 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t WebKDC/4.6.1 mod_fastcgi/mod_fastcgi-SNAP-0910052141
ETag: "18fe-4c9f9b7d3e6c0"
X-Frame-Options: DENY
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 6398

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Universities (Education)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| init

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jharriott.arkansasheatelite.org
webauth.ox.ac.uk
108.167.142.86
163.1.221.200
38238a3c2b869b27ed3e8e17afd9df7f02e832f33c31c8bb6f885354480f498b
5ebb16ae872ad8e63c53c0153918b7242c124145e7b87c1b3543725ef90ae958
8efdcc9e95f8e9c766df8193ae271b5ec36ecfb7b72dfdf92bdc6887f0247749
aa6d58cc6907b55d3a4c4eb62cb980e6cb02dd01364c98afdfdb50d33cd57867
d3baed52cb2be7d3f0ee779100be409a999ce50751809468c79cbe0276e13bbf
d51f4027e94991f12bd3dcb0f3ce71291d646e478e88869036ca812da6b749b1
d99de8c81f831ff1f926c99ea0269330391834e1262cb89965f6594890fcc33f

jharriott.arkansasheatelite.org Open in urlscan Pro 108.167.142.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

40 kBTransfer

50 kBSize

0 Cookies

4 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

jharriott.arkansasheatelite.org Open in urlscan Pro
108.167.142.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

40 kB
Transfer

50 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!