Yep! You were hacked. You have been hacked for a period of time too.
Not to panic! It happens enough and can potentially be a low-level breach that can be fixed with not too much worry.
HTTPS vs. HTTP is another protocol and not another site. Theoretically, these should be the same site served as either HTTP protocol port 80 or secured/encrypted HTTP (HTTPS) protocol port 443.
So your cic.nyu.edu (IP address: 220.127.116.11) has been compromised. You want to get a network administrator immediately or at least experienced help immediately. You need to ensure that you are running an up to date anti-virus, I use ClamAV for Linux, and that you scan the entire set of hard drives including rootkit and other options to fully ensure that it is virus free. Then you want to close off all avenues of entry by updating all software including and especially web based applications. Next, you have to find where and how the various pages live and remove them. Much of this will take detective work. You can take notes on what applications exist on your server including web applications and the version numbers of each and search for vulnerabilities using the NVD database found here: http://web.nvd.nist.gov/view/vuln/search?execution=e2s1 This should help you to understand how the hackers got into your system.
It is also important to check all user accounts for your system including any web based accounts. Check for unknown accounts and terminate or suspend them if you are not sure. As well, update the passwords of all remaining accounts with strong passwords that are new and unique.
It is important to know that likely your domain name/IP address has been black-listed as being compromised. If not, then you are lucky. You can check the status here: http://mxtoolbox.com/blacklists.aspx You will need to enter both the domain name and IP address to be sure. Follow any directions provided for removal. You may have to go to the blacklist site to know what that is. The system admin will understand this if you don't.
For the future, if you are not using HTTPS, then you want to redirect all HTTPS requests to HTTP (assuming Apache) using the apache2.conf or .htaccess files. It may help to close off IP/port 18.104.22.168:443 at the firewall. Any network admin should be thrilled you asked and may require being picked up off of the floor before complying. Make sure you have smelling salts handy.