consultyou.at Open in urlscan Pro
75.98.162.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/
Effective URL:
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+....
Submission: On October 25 via automatic, source phishtank (October 25th 2021, 5:06:21 pm UTC) — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 75.98.162.75, located in Ann Arbor, United States and belongs to A2HOSTING, US. The main domain is consultyou.at.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 17th 2021. Valid for: 3 months.

This is the only time consultyou.at was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3 4	137.207.76.172 137.207.76.172	11700 (CA-CW-E) (CA-CW-E)
3 19	75.98.162.75 75.98.162.75	55293 (A2HOSTING) (A2HOSTING)
17	2

4 137.207.76.172 (Windsor, Canada) 3 redirects

ASN11700 (CA-CW-E, CA)
PTR: myweb.cs.uwindsor.ca

kobti.myweb.cs.uwindsor.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 75.98.162.75 (Ann Arbor, United States) 3 redirects

ASN55293 (A2HOSTING, US)
PTR: server.wpprhosting.net

consultyou.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	consultyou.at 3 redirects consultyou.at	121 KB
4	uwindsor.ca 3 redirects kobti.myweb.cs.uwindsor.ca	819 B
17	2

	Domain	Requested by
19	consultyou.at	3 redirects consultyou.at
4	kobti.myweb.cs.uwindsor.ca	3 redirects
17	2

This site contains no links.

Subject Issuer	Validity	Valid
*.myweb.cs.uwindsor.ca R3	`2021-09-17` - `2021-12-16`	3 months	crt.sh
consultyou.at cPanel, Inc. Certification Authority	`2021-08-17` - `2021-11-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
Frame ID: 39CCBE0CC5B52B731C092459DB980BB4
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Edd Sign In Debit Card

Page URL History Show full URLs

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm Page URL
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca9... HTTP 301
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca9... HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca9... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css
<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

121 kB
Transfer

512 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm Page URL
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f HTTP 301
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

ru5e.htm Show response
kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/
Redirect Chain

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm

435 B
421 B

144ms
143ms

Document
text/html

137.207.76.172
CA-CW-E

General

Check archive.org

Show headers Download Go to

Full URL: https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.207.76.172 Windsor, Canada, ASN11700 (CA-CW-E, CA),
Reverse DNS: myweb.cs.uwindsor.ca
Software: Apache/2 /
Resource Hash: 18ede9e444c9e3c98cb78c79e7a5439efed2e140c59a8cbb54ee862f6577d4ea

Request headers

:method: GET
:authority: kobti.myweb.cs.uwindsor.ca
:scheme: https
:path: /EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=q0biqdcckpqt75dm0v35ct5hiu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 25 Oct 2021 17:06:17 GMT
server: Apache/2
last-modified: Mon, 25 Oct 2021 17:06:17 GMT
etag: W/"1b3-5cf30610cbac8-gzip"
accept-ranges: bytes
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 306
content-type: text/html

Redirect headers

date: Mon, 25 Oct 2021 17:06:17 GMT
server: Apache/2
x-powered-by: PHP/7.4.24
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=q0biqdcckpqt75dm0v35ct5hiu; path=/
location: ru5e.htm
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

Primary Request _+_==+==_+.htm Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/
Redirect Chain

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

14 KB
4 KB

120ms
120ms

Document
text/html

75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: consultyou.at
:scheme: https
:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://kobti.myweb.cs.uwindsor.ca/
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/2d03001b5c0bd86af979ea0560ac72c2/ru5e.htm

Response headers

content-type: text/html
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
date: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Redirect headers

set-cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: _+_==+==_+.htm?ip=216.131.111.46
content-type: text/html; charset=UTF-8
content-length: 0
date: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff

GET
H3 200 foundation.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 2 KB
827 B 112ms
112ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/foundation.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

82a851132267e95ec73fc7385ba9c4020852182ee41f11145a28be75280d74d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/foundation.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 wasa.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 300 KB
46 KB 125ms
125ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

b1d9fe0ab1861e3ea9b9da7c146863d62387a3be5a2daa3358a334151d2f3d78

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 jquery.css Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 103 KB
38 KB 288ms
287ms Script
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/jquery.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

5df50c6df8d5b460d8faa72fa083896b64903e2760b4afaf11ca65be5491cae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/jquery.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 prevent.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 45 B
66 B 124ms
124ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/prevent.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/prevent.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 45
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 clikck.css Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 271 B
293 B 287ms
287ms Script
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/clikck.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

8332e9865442439990cc3f27b3e8a38c9b3bd5f548af382ae4fea0968181b4ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/clikck.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 271
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 site.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 62 KB
11 KB 133ms
133ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

e930ad9ebfea6a521dbf9ee896cc959c836ba201cdc8a21faa84b92eef3e0fb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 logo.png
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/ 8 KB
8 KB 110ms
110ms Image
image/png 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/logo.png

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/logo.png
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 7719
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 EmailLogo.png
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/ 4 KB
4 KB 113ms
113ms Image
image/png 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/EmailLogo.png

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/img/EmailLogo.png
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 3908
expires: Mon, 01 Nov 2021 17:06:18 GMT

GET
H3 200 print.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/ 2 KB
541 B 111ms
111ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/print.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

e384da2b74e0a93bfb683dca1c793fff75d2d71fdaaa3303f607bf1ffac32590

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/print.css
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 469
expires: Mon, 01 Nov 2021 17:06:19 GMT

GET
H3 200 _+_==+==_+.htm Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/ 14 KB
4 KB 115ms
115ms Script
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:06:18 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:06:18 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes

GET
H3 404 flagscape-header-1610.gif
consultyou.at/content/PRC384/_Images/ 5 KB
5 KB 457ms
456ms Image
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/content/PRC384/_Images/flagscape-header-1610.gif

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

337aca8c06c8a43c49154c8a8bd9400ebac015e443593edc946b83c69415554a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /content/PRC384/_Images/flagscape-header-1610.gif
pragma: no-cache
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 ConnectionsMedium.woff
consultyou.at/content/PRC384/_Fonts/ 0
0 430ms
429ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.woff

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
:path: /content/PRC384/_Fonts/ConnectionsMedium.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 fontawesome-webfont.woff
consultyou.at/Content/_Fonts/ 0
0 419ms
418ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/Content/_Fonts/fontawesome-webfont.woff?v=4.0.3

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
:path: /Content/_Fonts/fontawesome-webfont.woff?v=4.0.3
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 fontawesome-webfont.ttf
consultyou.at/Content/_Fonts/ 0
0 383ms
383ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
:path: /Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/wasa.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 ConnectionsMedium.ttf
consultyou.at/content/PRC384/_Fonts/ 0
0 388ms
388ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.ttf

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=7464284754e84e8e6b7a9e39ef4c4319
:path: /content/PRC384/_Fonts/ConnectionsMedium.ttf
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/site.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| dataLayer

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kobti.myweb.cs.uwindsor.ca/	1969-12-31 23:59:59	Name: PHPSESSID Value: q0biqdcckpqt75dm0v35ct5hiu
			consultyou.at/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7464284754e84e8e6b7a9e39ef4c4319

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/jquery.css' because its MIME type ('text/css') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/js/clikck.css' because its MIME type ('text/css') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/2c0a55be436aec63e4581ca977088d0f/_+_==+==_+.htm?ip=216.131.111.46#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://consultyou.at/Content/_Fonts/fontawesome-webfont.woff?v=4.0.3 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/content/PRC384/_Images/flagscape-header-1610.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

consultyou.at
kobti.myweb.cs.uwindsor.ca
137.207.76.172
75.98.162.75
18ede9e444c9e3c98cb78c79e7a5439efed2e140c59a8cbb54ee862f6577d4ea
337aca8c06c8a43c49154c8a8bd9400ebac015e443593edc946b83c69415554a
42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49
4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf
5df50c6df8d5b460d8faa72fa083896b64903e2760b4afaf11ca65be5491cae9
82a851132267e95ec73fc7385ba9c4020852182ee41f11145a28be75280d74d5
8332e9865442439990cc3f27b3e8a38c9b3bd5f548af382ae4fea0968181b4ff
880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7
b1d9fe0ab1861e3ea9b9da7c146863d62387a3be5a2daa3358a334151d2f3d78
db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb
e384da2b74e0a93bfb683dca1c793fff75d2d71fdaaa3303f607bf1ffac32590
e930ad9ebfea6a521dbf9ee896cc959c836ba201cdc8a21faa84b92eef3e0fb9

consultyou.at Open in urlscan Pro 75.98.162.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

121 kBTransfer

512 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

15 Console Messages

Indicators

consultyou.at Open in urlscan Pro
75.98.162.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

121 kB
Transfer

512 kB
Size

2
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!