covidgatech.com Open in urlscan Pro
192.185.5.249 Malicious Activity! Public Scan

URL:
http://covidgatech.com/
Submission: On September 10 via api (September 10th 2020, 8:08:16 pm UTC) from US

Summary HTTP 13 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 192.185.5.249, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is covidgatech.com.

This is the only time covidgatech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Universities (Education)

Domain & IP information

	IP Address	AS Autonomous System
7	192.185.5.249 192.185.5.249	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
4	130.207.160.55 130.207.160.55	2637 (GEORGIA-TECH) (GEORGIA-TECH)
1	130.207.188.160 130.207.188.160	2637 (GEORGIA-TECH) (GEORGIA-TECH)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
13	4

7 192.185.5.249 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-5-249.unifiedlayer.com

covidgatech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 130.207.160.55 (Atlanta, United States)

ASN2637 (GEORGIA-TECH, US)
PTR: login.bcdc.gatech.edu

login.gatech.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.207.188.160 (Atlanta, United States)

ASN2637 (GEORGIA-TECH, US)
PTR: web-plesk31.gatech.edu

gac.gatech.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	covidgatech.com covidgatech.com	79 KB
5	gatech.edu login.gatech.edu gac.gatech.edu	288 KB
1	google-analytics.com www.google-analytics.com	118 B
13	3

	Domain	Requested by
7	covidgatech.com	covidgatech.com
4	login.gatech.edu	covidgatech.com
1	www.google-analytics.com	covidgatech.com
1	gac.gatech.edu	covidgatech.com
13	4

This site contains links to these domains. Also see Links.

Domain
login.gatech.edu
b.gatech.edu
passport.gatech.edu
tsc.oit.gatech.edu
iam.gatech.edu
www.gatech.edu
www.careers.gatech.edu
wordpress.org

Subject Issuer	Validity	Valid
login.gatech.edu InCommon RSA Server CA	`2020-08-17` - `2022-08-17`	2 years	crt.sh
hosting.gatech.edu InCommon RSA Server CA	`2019-11-07` - `2021-11-06`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://covidgatech.com/
Frame ID: 3DE9D14B3F7E956F834F3B47ADB0018F
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

13
Requests

46 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

367 kB
Transfer

599 kB
Size

4
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://login.gatech.edu/cas/login#content
Title: Skip to content

Search URL Search Domain Scan URL

URL: https://login.gatech.edu/
Title:

Search URL Search Domain Scan URL

URL: http://b.gatech.edu/it-policies
Title: http://b.gatech.edu/it-policies

Search URL Search Domain Scan URL

URL: https://passport.gatech.edu/activation/forgot-username
Title: I don't know my GT Account

Search URL Search Domain Scan URL

URL: https://passport.gatech.edu/activation/forgot-password
Title: I don't know my password

Search URL Search Domain Scan URL

URL: https://passport.gatech.edu/?action=check-account-status
Title: My correct username and password aren't working

Search URL Search Domain Scan URL

URL: http://tsc.oit.gatech.edu/
Title: OIT Technology Support Center

Search URL Search Domain Scan URL

URL: https://iam.gatech.edu/iam/index.html
Title: Additional documentation including how to integrate your application with GT Login

Search URL Search Domain Scan URL

URL: http://www.gatech.edu/emergency/
Title: Emergency Information

Search URL Search Domain Scan URL

URL: http://www.gatech.edu/legal/
Title: Legal & Privacy Information

Search URL Search Domain Scan URL

URL: http://www.gatech.edu/accessibility/
Title: Accessibility

Search URL Search Domain Scan URL

URL: http://www.gatech.edu/accountability/
Title: Accountability

Search URL Search Domain Scan URL

URL: https://www.gatech.edu/accreditation/
Title: Accreditation

Search URL Search Domain Scan URL

URL: http://www.careers.gatech.edu/
Title: Employment

Search URL Search Domain Scan URL

URL: https://wordpress.org/
Title: Proudly powered by WordPress.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&utmac=UA-12654089-10&utmcc=__utma%3D215602053.499874424.1599768481.1599768481.1599768481.1%3B%2B__utmz%3D215602053.1599768481.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&gaq=1 HTTP 307
https://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&utmac=UA-12654089-10&utmcc=__utma%3D215602053.499874424.1599768481.1599768481.1599768481.1%3B%2B__utmz%3D215602053.1599768481.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&gaq=1

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
covidgatech.com/ 12 KB
6 KB 453ms
290ms Document
text/html 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: f023c3e102dd8ff4b192ba958608c7f76bc2f8f683a4224f76453865bcd2498d

Request headers

Host: covidgatech.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 09 Sep 2020 01:11:52 GMT
Accept-Ranges: bytes
Cache-Control: max-age=300
Expires: Thu, 10 Sep 2020 20:12:57 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Endurance-Cache-Level: 2
Content-Length: 5323
Keep-Alive: timeout=5, max=75
Content-Type: text/html

GET
H/1.1 200
OK style.min.css
covidgatech.com/wp-includes/css/dist/block-library/ 53 KB
11 KB 415ms
414ms Stylesheet
text/css 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.1
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: 8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:29 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Content-Type: text/css
Cache-Control: max-age=86400
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 10450
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK theme.min.css
covidgatech.com/wp-includes/css/dist/block-library/ 2 KB
1 KB 330ms
303ms Stylesheet
text/css 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.5.1
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: 5d5575c28819cc80d5cf47729e998387ddc2d510a6adf37ce5a19b8f2127ee05

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:29 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Upgrade: h2,h2c
Cache-Control: max-age=86400
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75
Content-Length: 790
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK style.css
covidgatech.com/wp-content/themes/twentynineteen/ 227 KB
54 KB 640ms
611ms Stylesheet
text/css 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-content/themes/twentynineteen/style.css?ver=1.7
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: 628919bbe7d6a3aa328af68a8f61745b1c81d41bcf4fad5e835e83fcb30a5102

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:25 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Upgrade: h2,h2c
Cache-Control: max-age=86400
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK responsive.css
login.gatech.edu/cas/css/gatech/ 162 KB
163 KB 1862ms
149ms Stylesheet
text/css 130.207.160.55
GEORGIA-TECH

General

Check archive.org

Show headers Download Go to

Full URL

https://login.gatech.edu/cas/css/gatech/responsive.css?2020-08-17-151746

Requested by

Host: covidgatech.com
URL: http://covidgatech.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

130.207.160.55 Atlanta, United States, ASN2637 (GEORGIA-TECH, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

70e8d892de983a4d8dd651f9250948a035ffed1bf44029cf3c396c7579082a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:58 GMT
Last-Modified: Mon, 29 Oct 2018 08:50:58 GMT
Server: Apache-Coyote/1.1
ETag: W/"166268-1540803058000"
Strict-Transport-Security: max-age=15552000
Content-Type: text/css;charset=UTF-8
X-Pool-Member: /webauth/cas 130.207.160.66 8080
Accept-Ranges: bytes
Content-Length: 166268

GET
H/1.1 200
OK logo-gt-cropped.png
login.gatech.edu/cas/images/ 2 KB
3 KB 1848ms
151ms Image
image/png 130.207.160.55
GEORGIA-TECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.gatech.edu/cas/images/logo-gt-cropped.png

Requested by

Host: covidgatech.com
URL: http://covidgatech.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

130.207.160.55 Atlanta, United States, ASN2637 (GEORGIA-TECH, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

72ede2775dc5a4c59c9ca711471e82490d70fed38fc0d20a018478c9aedda922

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:58 GMT
Last-Modified: Mon, 29 Oct 2018 08:50:58 GMT
Server: Apache-Coyote/1.1
ETag: W/"2257-1540803058000"
Strict-Transport-Security: max-age=15552000
Content-Type: image/png;charset=UTF-8
X-Pool-Member: /webauth/cas 130.207.160.66 8080
Accept-Ranges: bytes
Content-Length: 2257

GET
H/1.1 200
OK jquery-1.12.4.min.js;jsessionid=A4D66378A4EEF7DF79D14AC38B2191DA Show response
login.gatech.edu/cas/js/ 95 KB
95 KB 1846ms
152ms Script
text/javascript 130.207.160.55
GEORGIA-TECH

General

Check archive.org

Show headers Download Go to

Full URL

https://login.gatech.edu/cas/js/jquery-1.12.4.min.js;jsessionid=A4D66378A4EEF7DF79D14AC38B2191DA

Requested by

Host: covidgatech.com
URL: http://covidgatech.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

130.207.160.55 Atlanta, United States, ASN2637 (GEORGIA-TECH, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:58 GMT
Last-Modified: Mon, 29 Oct 2018 08:50:58 GMT
Server: Apache-Coyote/1.1
ETag: W/"97163-1540803058000"
Strict-Transport-Security: max-age=15552000
Content-Type: text/javascript;charset=UTF-8
X-Pool-Member: /webauth/cas 130.207.160.66 8080
Accept-Ranges: bytes
Content-Length: 97163

GET
H/1.1 200
OK cas_login.js;jsessionid=A4D66378A4EEF7DF79D14AC38B2191DA Show response
login.gatech.edu/cas/js/ 2 KB
2 KB 1848ms
151ms Script
text/javascript 130.207.160.55
GEORGIA-TECH

General

Check archive.org

Show headers Download Go to

Full URL

https://login.gatech.edu/cas/js/cas_login.js;jsessionid=A4D66378A4EEF7DF79D14AC38B2191DA?2020-08-17-151746

Requested by

Host: covidgatech.com
URL: http://covidgatech.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

130.207.160.55 Atlanta, United States, ASN2637 (GEORGIA-TECH, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

a2d509b7f6dffc9e889472ab4cb9b436f6fc675594fd35a996cb10d2e0c545b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:58 GMT
Last-Modified: Mon, 29 Oct 2018 08:50:58 GMT
Server: Apache-Coyote/1.1
ETag: W/"1574-1540803058000"
Strict-Transport-Security: max-age=15552000
Content-Type: text/javascript;charset=UTF-8
X-Pool-Member: /webauth/cas 130.207.160.66 8080
Accept-Ranges: bytes
Content-Length: 1574

GET
H/1.1 200
OK wp-embed.min.js Show response
covidgatech.com/wp-includes/js/ 1 KB
1 KB 593ms
567ms Script
application/javascript 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-includes/js/wp-embed.min.js?ver=5.5.1
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:30 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Upgrade: h2,h2c
Cache-Control: max-age=86400
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=75
Content-Length: 782
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
covidgatech.com/wp-includes/js/ 14 KB
5 KB 610ms
583ms Script
application/javascript 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-includes/js/wp-emoji-release.min.js?ver=5.5.1
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: 8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:30 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Upgrade: h2,h2c
Cache-Control: max-age=86400
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=75
Content-Length: 4950
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK print.css
covidgatech.com/wp-content/themes/twentynineteen/ 4 KB
2 KB 476ms
450ms Stylesheet
text/css 192.185.5.249
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://covidgatech.com/wp-content/themes/twentynineteen/print.css?ver=1.7
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Server: 192.185.5.249 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-5-249.unifiedlayer.com
Software: Apache /
Resource Hash: f111b1f427b5a8a9e99e36afb4c8c53c86ec6af60fe3274e43db9407073e5626

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:07:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Sep 2020 23:36:25 GMT
Server: Apache
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
Upgrade: h2,h2c
Cache-Control: max-age=86400
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75
Content-Length: 1308
Expires: Fri, 11 Sep 2020 20:07:57 GMT

GET
H/1.1 200
OK ga.js Show response
gac.gatech.edu/ga/ 25 KB
25 KB 746ms
162ms Script
application/javascript 130.207.188.160
GEORGIA-TECH

General

Check archive.org

Show headers Download Go to

Full URL: https://gac.gatech.edu/ga/ga.js
Requested by: Host: covidgatech.com
URL: http://covidgatech.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 130.207.188.160 Atlanta, United States, ASN2637 (GEORGIA-TECH, US),
Reverse DNS: web-plesk31.gatech.edu
Software: Apache / PleskLin
Resource Hash: f41eb157b8cf0ca4355307ac06ed9a1c306630fc07a373fedc1f402cbeba09fe

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 10 Sep 2020 20:08:00 GMT
Last-Modified: Tue, 29 Jun 2010 13:39:03 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "6231-48a2b5c438bc0"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 25137

GET
H2

200

__utm.gif
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&ut...
https://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&u...

35 B
118 B

6ms
5ms

Image
image/gif

2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&utmac=UA-12654089-10&utmcc=__utma%3D215602053.499874424.1599768481.1599768481.1599768481.1%3B%2B__utmz%3D215602053.1599768481.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&gaq=1

Requested by

Host: covidgatech.com
URL: http://covidgatech.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://covidgatech.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Sep 2020 11:12:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 32146
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=1699586943&utmhn=covidgatech.com&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1267769235&utmr=-&utmp=%2F&utmac=UA-12654089-10&utmcc=__utma%3D215602053.499874424.1599768481.1599768481.1599768481.1%3B%2B__utmz%3D215602053.1599768481.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&gaq=1
Non-Authoritative-Reason: HSTS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Universities (Education)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.covidgatech.com/	1970-01-19 12:22:50	Name: __utmb Value: 215602053.1.10.1599768481
.covidgatech.com/	1970-01-19 16:45:36	Name: __utmz Value: 215602053.1599768481.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.covidgatech.com/	1969-12-31 23:59:59	Name: __utmc Value: 215602053
.covidgatech.com/	1970-01-20 05:54:00	Name: __utma Value: 215602053.499874424.1599768481.1599768481.1599768481.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

covidgatech.com
gac.gatech.edu
login.gatech.edu
www.google-analytics.com
130.207.160.55
130.207.188.160
192.185.5.249
2a00:1450:4001:824::200e
5d5575c28819cc80d5cf47729e998387ddc2d510a6adf37ce5a19b8f2127ee05
628919bbe7d6a3aa328af68a8f61745b1c81d41bcf4fad5e835e83fcb30a5102
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
70e8d892de983a4d8dd651f9250948a035ffed1bf44029cf3c396c7579082a4d
72ede2775dc5a4c59c9ca711471e82490d70fed38fc0d20a018478c9aedda922
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
a2d509b7f6dffc9e889472ab4cb9b436f6fc675594fd35a996cb10d2e0c545b4
f023c3e102dd8ff4b192ba958608c7f76bc2f8f683a4224f76453865bcd2498d
f111b1f427b5a8a9e99e36afb4c8c53c86ec6af60fe3274e43db9407073e5626
f41eb157b8cf0ca4355307ac06ed9a1c306630fc07a373fedc1f402cbeba09fe

covidgatech.com Open in urlscan Pro 192.185.5.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

46 %HTTPS

25 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

367 kBTransfer

599 kBSize

4 Cookies

15 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

4 Cookies

Indicators

covidgatech.com Open in urlscan Pro
192.185.5.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

46 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

367 kB
Transfer

599 kB
Size

4
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!