oratorslawacademy.com Open in urlscan Pro
166.62.28.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.digiasennus.fi/undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/dhdldllddhldldlhldldl...
Effective URL:
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWl...
Submission: On July 20 via automatic, source openphish (July 20th 2021, 1:20:45 am UTC)

Summary HTTP 14 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 8 IPs in 4 countries across 7 domains to perform 14 HTTP transactions. The main IP is 166.62.28.106, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is oratorslawacademy.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 11th 2021. Valid for: a year.

This is the only time oratorslawacademy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2a01:4f8:fff0... 2a01:4f8:fff0:6a:10::190	24940 (HETZNER-AS) (HETZNER-AS)
1	108.167.131.129 108.167.131.129	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1 3	166.62.28.106 166.62.28.106	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
5	152.199.23.37 152.199.23.37	15133 (EDGECAST) (EDGECAST)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
1	2620:1ec:bdf::45 2620:1ec:bdf::45	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:6c0... 2a02:26f0:6c00:2b4::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
14	8

1 2a01:4f8:fff0:6a:10::190 (Germany)

ASN24940 (HETZNER-AS, DE)

www.digiasennus.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.167.131.129 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 108-167-131-129.unifiedlayer.com

www.roomtogrowav.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 166.62.28.106 (Singapore, Singapore) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-28-106.ip.secureserver.net

oratorslawacademy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.199.23.37 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::45 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:2b4::35c1 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	msftauth.net aadcdn.msftauth.net	54 KB
3	oratorslawacademy.com 1 redirects oratorslawacademy.com	14 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	14 KB
2	msauth.net logincdn.msauth.net aadcdn.msauth.net	3 KB
1	jquery.com code.jquery.com	30 KB
1	roomtogrowav.com www.roomtogrowav.com	657 B
1	digiasennus.fi www.digiasennus.fi	368 B
14	7

	Domain	Requested by
5	aadcdn.msftauth.net	oratorslawacademy.com
3	oratorslawacademy.com	1 redirects code.jquery.com
2	secure.aadcdn.microsoftonline-p.com	oratorslawacademy.com
1	aadcdn.msauth.net	oratorslawacademy.com
1	logincdn.msauth.net	oratorslawacademy.com
1	code.jquery.com	oratorslawacademy.com
1	www.roomtogrowav.com
1	www.digiasennus.fi
14	8

This site contains links to these domains. Also see Links.

Domain
login.live.com
passwordreset.microsoftonline.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
digiasennus.fi cPanel, Inc. Certification Authority	`2021-07-05` - `2021-10-03`	3 months	crt.sh
oratorslawacademy.com Sectigo RSA Domain Validation Secure Server CA	`2021-03-11` - `2022-03-11`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2021-05-13` - `2022-05-13`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-05-13` - `2022-05-13`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-07-08` - `2022-07-08`	a year	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 01	`2020-12-22` - `2021-12-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Frame ID: E22FA8502FD845AFA5BDE82848CA7A36
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.digiasennus.fi/undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/d... Page URL
http://www.roomtogrowav.com/wp-includes/wp_includesss/wp_includess/offficees/moladerivessss/greattioolol... Page URL
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/?ss=2&e... HTTP 302
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.ph... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

93 %
HTTPS

50 %
IPv6

7
Domains

8
Subdomains

8
IPs

4
Countries

114 kB
Transfer

276 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAYWSO2_TUABG46R100hAQQWVBXVgQEhO7_UrcSSGJHYbJ3FcJ05iZzF5-HEdP9LEefkXdEKdGDIydmRCSEjMnTogIZWVATEhJtgo_AGWT_p0xnMyO2w2nwVZ8DwFs7DwlKZopp8bcATXZymC5iAg-jTJEhRDsRQJ4IgB1PRBZu_m828H114J5wg_eLwTfNlgu4aHFmZ2GPqX2BMniiazwtHRcrnMhpaFhv_AkdcPRiiw32HYNYZ9w7BNctsMiHbrMjljqRydgzkWUizkuDzDgKyuCozkK7EeS1FDtUmpBUAjVui6ajO9rhLJXYWST6pIchUo-QKQ_PZKvmUNVYl093gslwHouQ6qq54vqe1IOhHonloEja6ybsQieZO8JxfnkUP-nXCKYvNnctcKp74xCWfRJvU6WRuO8_5Mcx0NeU5-QRuxq47apJ73RwJlAMOIomiNAD0eylpcDdWKo8DZolQrEW5zatl9Va76WrM8iKq05Kw7FXNqeIPSSlSG0Ars0zVZU-ApvyYHTcfuGiWqrKA57ZdztK2RK61YZwUe0EADFopq3QFkZznDW1h9Y1Sxl3WHHxXdvK6rljyuEsiwm0ZnecZVO8Spr_EeYo9Pfc4VdY49s0K3VXE5wTD1Cm3PQrHJm7VOs6HQDCtD0uyZFSevjb1hzVk6UhmITLN7Fk7NamDl597cnztTbxDPV76olZDyNoXfyvTD4Cp1N5yYARodTqahhTzzegv7vvUoje-lDxKHiWf7IFVIpzN7ib_v1xb2Zvu2HLv-KXvxtVzavHwofejjiavtow4URXN5Vl8JbWsR5mqcq_MVJ2jJXDzyl9VFdyLXxgD1cm3xBSzACxy7wPEr_L7IGw1BbanFBl9s8qQBfuDY-U7i_e5_-rvJ7JOAhASABMkcQrLAMAWK7X28k_gD0&estsfed=1&uaid=68f9d7da5806458e8869061819076edb&signup=1&lw=1&fl=easi2&fci=4345a7b9-9a63-4910-a426-35363201d503&mkt=en-US
Title: Create one!

Search URL Search Domain Scan URL

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ7HweiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10
Title: reset it now.

Search URL Search Domain Scan URL

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZzH_eiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.digiasennus.fi/undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/dhdldllddhldldlhldldldl/vlloovodohsjlooeoeyytru/Gwfgghhgkkbnloggdgdirect.php?email=inquiry@gorelyant.com Page URL
http://www.roomtogrowav.com/wp-includes/wp_includesss/wp_includess/offficees/moladerivessss/greattioololh/smellintgtonnn/Gwaraghghghghgt.php?email=inquiry@gorelyant.com Page URL
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/?ss=2&ea=inquiry@gorelyant.com HTTP 302
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Gwfgghhgkkbnloggdgdirect.php Show response
www.digiasennus.fi/undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/dhdldllddhldldlhldldldl/vlloovodohsjlooeoeyytru/ 404 B
368 B 86ms
29ms Document
text/html 2a01:4f8:fff0:6a:10::190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.digiasennus.fi/undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/dhdldllddhldldlhldldldl/vlloovodohsjlooeoeyytru/Gwfgghhgkkbnloggdgdirect.php?email=inquiry@gorelyant.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a01:4f8:fff0:6a:10::190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 9483cb7fe3a34d1104416e772b068d06cabcb045513a36bee08dafd5e020121c

Request headers

:method: GET
:authority: www.digiasennus.fi
:scheme: https
:path: /undersressss/wp_includesss/velorrlolduidi/molueeeeeeloookk/nialolgeheuuloo/dhdldllddhldldlhldldldl/vlloovodohsjlooeoeyytru/Gwfgghhgkkbnloggdgdirect.php?email=inquiry@gorelyant.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:20:26 GMT
server: Apache
content-encoding: gzip
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK Gwaraghghghghgt.php Show response
www.roomtogrowav.com/wp-includes/wp_includesss/wp_includess/offficees/moladerivessss/greattioololh/smellintgtonnn/ 365 B
657 B 559ms
271ms Document
text/html 108.167.131.129
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roomtogrowav.com/wp-includes/wp_includesss/wp_includess/offficees/moladerivessss/greattioololh/smellintgtonnn/Gwaraghghghghgt.php?email=inquiry@gorelyant.com
Protocol: HTTP/1.1
Server: 108.167.131.129 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-131-129.unifiedlayer.com
Software: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 / PHP/5.4.30
Resource Hash: f57455d3db4d0d98cd68b9dea014798015a3027f53f094514c8e77d3a556da37

Request headers

Host: www.roomtogrowav.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 01:20:27 GMT
Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4
X-Powered-By: PHP/5.4.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2

200

Primary Request next.php Show response
oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/
Redirect Chain

https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/?ss=2&ea=inquiry@gorelyant.com
https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t

62 KB
13 KB

272ms
271ms

Document
text/html

166.62.28.106
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 166.62.28.106 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-28-106.ip.secureserver.net
Software: Apache / PHP/7.1.33
Resource Hash: ea59c3cd3f55b714c4f8aa13f2665a0dfbe42f4071f059b8af9de3f9940b8429

Request headers

:method: GET
:authority: oratorslawacademy.com
:scheme: https
:path: /zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: http://www.roomtogrowav.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=2f60e31636940fc9c2c881cbeaaf1a0d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://www.roomtogrowav.com/wp-includes/wp_includesss/wp_includess/offficees/moladerivessss/greattioololh/smellintgtonnn/Gwaraghghghghgt.php?email=inquiry@gorelyant.com

Response headers

date: Tue, 20 Jul 2021 01:20:30 GMT
server: Apache
x-powered-by: PHP/7.1.33
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 13203
content-type: text/html; charset=UTF-8

Redirect headers

date: Tue, 20 Jul 2021 01:20:30 GMT
server: Apache
x-powered-by: PHP/7.1.33
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=2f60e31636940fc9c2c881cbeaaf1a0d; path=/
location: next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 105 KB
20 KB 111ms
28ms Stylesheet
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FAB) /
Resource Hash: ea6449d448a48495c557755af39701567925ceafc30e06fba05f65e723c91aa3

Request headers

Origin: https://oratorslawacademy.com
Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: +rPQJ6BWMovrMLNrlexvKQ==
age: 2852247
x-cache: HIT
content-length: 19595
x-ms-lease-status: unlocked
last-modified: Sat, 21 Nov 2020 03:49:00 GMT
server: ECAcc (frc/8FAB)
etag: 0x8D88DD061D3546B
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 9bf8b192-801e-000e-2214-631f6b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 29ms
10ms Script
application/javascript 2001:4de0:ac18::1:a:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:20:30 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2016 22:32:34 GMT
server: nginx
etag: W/"57e45c02-152b5"
vary: Accept-Encoding
x-hw: 1626744030.dop238.fr8.t,1626744030.cds252.fr8.hn,1626744030.cds012.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30070

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 4 KB
2 KB 103ms
28ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E9E) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 6897482
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Thu, 16 Jan 2020 00:32:52 GMT
server: ECAcc (frc/8E9E)
etag: 0x8D79A1B9F5E121A
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 0c55977d-f01e-0098-2849-3ebec7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 114ms
27ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35DE) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 19699683
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:50 GMT
server: ECAcc (lhd/35DE)
etag: 0x8D79ED29CF0C29A
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 677ab0c3-901e-0002-4bda-c9d3e8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msauth.net/ests/2.1/content/images/ 513 B
948 B 33ms
10ms Image
image/svg+xml 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:30 GMT
content-encoding: gzip
x-azure-ref-originshield: 0ZGPxYAAAAAAONn5WdHqwR41CXuo9H1CMTE9OMjFFREdFMDIxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
x-cache: TCP_HIT
content-length: 276
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:09 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D64101494758DF
x-azure-ref: 03yT2YAAAAAD6iiqYFQFzSZtp7wWf2N2XRlJBRURHRTEwMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6a68f886-001e-0047-7107-7a356c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 0
19 KB 36ms
35ms Other
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FAB) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: +rPQJ6BWMovrMLNrlexvKQ==
age: 2852247
x-cache: HIT
content-length: 19595
x-ms-lease-status: unlocked
last-modified: Sat, 21 Nov 2020 03:49:00 GMT
server: ECAcc (frc/8FAB)
etag: 0x8D88DD061D3546B
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 9bf8b192-801e-000e-2214-631f6b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 0
12 KB 30ms
30ms Other
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA5) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: 6Qvaph3XjGlz0gTgNQb8QQ==
age: 16763037
x-cache: HIT
content-length: 12109
x-ms-lease-status: unlocked
last-modified: Wed, 06 Jan 2021 18:56:03 GMT
server: ECAcc (frc/8FA5)
etag: 0x8D8B274B724F769
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 4a0f046c-b01e-0072-658f-e4ee33000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/ 2 KB
824 B 33ms
32ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE5) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
age: 683668
x-cache: HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 12 Feb 2020 22:01:50 GMT
server: ECAcc (frc/8FE5)
etag: 0x8D7B007297AE131
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 1528e04b-101e-0063-5ccd-76af16000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

POST
H2 200 brand.php Show response
oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/ 347 B
249 B 1384ms
1383ms XHR
text/html 166.62.28.106
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/brand.php?ss=2
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.1.1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 166.62.28.106 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-28-106.ip.secureserver.net
Software: Apache / PHP/7.1.33
Resource Hash: d5199235af19d71e3edb5fb200defe936ba8398ea54782a49d45aadf9e371f9d

Request headers

sec-fetch-mode: cors
origin: https://oratorslawacademy.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: PHPSESSID=2f60e31636940fc9c2c881cbeaaf1a0d
content-length: 37
:path: /zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/brand.php?ss=2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: */*
cache-control: no-cache
:authority: oratorslawacademy.com
referer: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
:scheme: https
sec-fetch-site: same-origin
:method: POST
Accept: */*
Referer: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/next.php?ss=2&email=aW5xdWlyeUBnb3JlbHlhbnQuY29t
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 20 Jul 2021 01:20:31 GMT
content-encoding: gzip
server: Apache
x-powered-by: PHP/7.1.33
content-length: 195
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-erfbho4n-xdruepqih5z3eavflals4f3ysyeu0szu5k/logintenantbranding/0/ 9 KB
10 KB 391ms
373ms Image
image/* 2a02:26f0:6c00:2b4::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-erfbho4n-xdruepqih5z3eavflals4f3ysyeu0szu5k/logintenantbranding/0/bannerlogo?ts=637232789404249722

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

0d319fd74fe95e83be3438ee695e810e82005c832e15812380dda1dd612174db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 01:20:32 GMT
Last-Modified: Thu, 23 Apr 2020 22:49:00 GMT
Content-MD5: p1LoaaqFF5+nWkMzQWPS4A==
Strict-Transport-Security: max-age=31536000
Content-Type: image/*
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Connection: keep-alive
Content-Length: 9718

GET
H/1.1 200
OK illustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-erfbho4n-xdruepqih5z3eavflals4f3ysyeu0szu5k/logintenantbranding/0/ 4 KB
4 KB 385ms
368ms Image
image/* 2a02:26f0:6c00:2b4::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-erfbho4n-xdruepqih5z3eavflals4f3ysyeu0szu5k/logintenantbranding/0/illustration?ts=637232790681235748

Requested by

Host: oratorslawacademy.com
URL: https://oratorslawacademy.com/zzwiommlo/zengerrlol/wp_includesss/moladerivessss/flenjorororo/fakes/common/oauth2/?authoriseclient_id=4315ab9-913as3-40a0u-a4ut6-3536ade03&redirect_uri=https%3A%2F%2Fwww.office.com%2Flanding&response_type=code%20id_token&scope=openid%20profile&response_mode=form_post&nonce=637471761361998550.YTE5MmQzYzMtNTg2MS00NzQ4LTg5ZWQtOWQ3OGJiMjQ1MmE0MmUxOTg5NTQtYjFkOC00ZjhiLTlmMTUtMGE4ZTA0NWQyNzI2&ui_locales=en-US&mkt=en-US&client-request-id=68f9d7da-5456-46658e-88as69ads-06sad18ads19dsa076edb&state=Kck8msXjhXilh8v4_zjTdU2Y8mdE3_0__tttyi04kcOXzJoTHhQ1svBKB-jRrfgaTOJmXRCbtJ4MhyVHer_lbBxIQc1fngPy2KQ1PDy2bRhgW_B3CQiu4mC74gX2xXAL6ED040X0fitKWb16s7_lvfa_dHgwLhDdAj8YYTfOkJ-i_gR_Vwq9JV-PmXDli6FPm9jIY96qfojSHj9E_eYH4gsoIRDeKVRNQ456O12eZeHh8XklcKhwhMC0I5RWqoreJnf8ulumuhrlbzuxmIXBiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.8.0.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

3cc72481ad1cbbaba27686803d955225bdf5bd0e85c6c084f2cb02d62fbcfd32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://oratorslawacademy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Jul 2021 01:20:32 GMT
Last-Modified: Thu, 23 Apr 2020 22:51:08 GMT
Content-MD5: 0nE0DBxCHZOO5SBKZF+T6Q==
Strict-Transport-Security: max-age=31536000
Content-Type: image/*
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Connection: keep-alive
Content-Length: 4130

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			oratorslawacademy.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2f60e31636940fc9c2c881cbeaaf1a0d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
code.jquery.com
logincdn.msauth.net
oratorslawacademy.com
secure.aadcdn.microsoftonline-p.com
www.digiasennus.fi
www.roomtogrowav.com
108.167.131.129
152.199.23.37
166.62.28.106
192.229.221.185
2001:4de0:ac18::1:a:2b
2620:1ec:bdf::45
2a01:4f8:fff0:6a:10::190
2a02:26f0:6c00:2b4::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0d319fd74fe95e83be3438ee695e810e82005c832e15812380dda1dd612174db
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3cc72481ad1cbbaba27686803d955225bdf5bd0e85c6c084f2cb02d62fbcfd32
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9483cb7fe3a34d1104416e772b068d06cabcb045513a36bee08dafd5e020121c
d5199235af19d71e3edb5fb200defe936ba8398ea54782a49d45aadf9e371f9d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea59c3cd3f55b714c4f8aa13f2665a0dfbe42f4071f059b8af9de3f9940b8429
ea6449d448a48495c557755af39701567925ceafc30e06fba05f65e723c91aa3
f57455d3db4d0d98cd68b9dea014798015a3027f53f094514c8e77d3a556da37

oratorslawacademy.com Open in urlscan Pro 166.62.28.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

50 %IPv6

7 Domains

8 Subdomains

8 IPs

4 Countries

114 kBTransfer

276 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

oratorslawacademy.com Open in urlscan Pro
166.62.28.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

50 %
IPv6

7
Domains

8
Subdomains

8
IPs

4
Countries

114 kB
Transfer

276 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!