consultyou.at Open in urlscan Pro
75.98.162.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/
Effective URL:
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+....
Submission: On October 25 via manual (October 25th 2021, 5:11:36 pm UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 75.98.162.75, located in Ann Arbor, United States and belongs to A2HOSTING, US. The main domain is consultyou.at.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 17th 2021. Valid for: 3 months.

This is the only time consultyou.at was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3 4	137.207.76.172 137.207.76.172	11700 (CA-CW-E) (CA-CW-E)
3 19	75.98.162.75 75.98.162.75	55293 (A2HOSTING) (A2HOSTING)
17	2

4 137.207.76.172 (Windsor, Canada) 3 redirects

ASN11700 (CA-CW-E, CA)
PTR: myweb.cs.uwindsor.ca

kobti.myweb.cs.uwindsor.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 75.98.162.75 (Ann Arbor, United States) 3 redirects

ASN55293 (A2HOSTING, US)
PTR: server.wpprhosting.net

consultyou.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	consultyou.at 3 redirects consultyou.at	172 KB
4	uwindsor.ca 3 redirects kobti.myweb.cs.uwindsor.ca	820 B
17	2

	Domain	Requested by
19	consultyou.at	3 redirects consultyou.at
4	kobti.myweb.cs.uwindsor.ca	3 redirects
17	2

This site contains no links.

Subject Issuer	Validity	Valid
*.myweb.cs.uwindsor.ca R3	`2021-09-17` - `2021-12-16`	3 months	crt.sh
consultyou.at cPanel, Inc. Certification Authority	`2021-08-17` - `2021-11-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
Frame ID: F4CE1B498FFB8EE41AC1F6E6D844F4CE
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Edd Sign In Debit Card

Page URL History Show full URLs

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm Page URL
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc1... HTTP 301
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc1... HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc1... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css
<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

171 kB
Transfer

571 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm Page URL
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7 HTTP 301
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/ HTTP 302
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003 HTTP 301
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ HTTP 302
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

ru5e.htm Show response
kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/
Redirect Chain

https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/
https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm

435 B
421 B

130ms
130ms

Document
text/html

137.207.76.172
CA-CW-E

General

Check archive.org

Show headers Download Go to

Full URL: https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.207.76.172 Windsor, Canada, ASN11700 (CA-CW-E, CA),
Reverse DNS: myweb.cs.uwindsor.ca
Software: Apache/2 /
Resource Hash: 18ede9e444c9e3c98cb78c79e7a5439efed2e140c59a8cbb54ee862f6577d4ea

Request headers

:method: GET
:authority: kobti.myweb.cs.uwindsor.ca
:scheme: https
:path: /EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=d6u33p1qkl4bl3t3315g3ri042
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 25 Oct 2021 17:11:32 GMT
server: Apache/2
last-modified: Mon, 25 Oct 2021 17:11:31 GMT
etag: W/"1b3-5cf3073ce06e0-gzip"
accept-ranges: bytes
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 306
content-type: text/html

Redirect headers

date: Mon, 25 Oct 2021 17:11:32 GMT
server: Apache/2
x-powered-by: PHP/7.4.24
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=d6u33p1qkl4bl3t3315g3ri042; path=/
location: ru5e.htm
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

Primary Request _+_==+==_+.htm Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/
Redirect Chain

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/
https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

14 KB
4 KB

113ms
112ms

Document
text/html

75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: consultyou.at
:scheme: https
:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://kobti.myweb.cs.uwindsor.ca/
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://kobti.myweb.cs.uwindsor.ca/EDD-CA-GOV/BANK-OF-AMERICA/c8e8ea161f4c868686f013935d95f003/ru5e.htm

Response headers

content-type: text/html
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
date: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Redirect headers

set-cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: _+_==+==_+.htm?ip=216.131.114.217
content-type: text/html; charset=UTF-8
content-length: 0
date: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff

GET
H3 200 foundation.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 2 KB
785 B 113ms
112ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/foundation.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

82a851132267e95ec73fc7385ba9c4020852182ee41f11145a28be75280d74d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/foundation.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 690
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 wasa.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 300 KB
41 KB 129ms
128ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

b1d9fe0ab1861e3ea9b9da7c146863d62387a3be5a2daa3358a334151d2f3d78

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 42265
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 jquery.css Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 103 KB
36 KB 283ms
282ms Script
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/jquery.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

5df50c6df8d5b460d8faa72fa083896b64903e2760b4afaf11ca65be5491cae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/jquery.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 36320
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 prevent.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 45 B
66 B 127ms
126ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/prevent.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/prevent.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 45
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 clikck.css Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 271 B
293 B 282ms
281ms Script
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/clikck.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

8332e9865442439990cc3f27b3e8a38c9b3bd5f548af382ae4fea0968181b4ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/clikck.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 271
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 site.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 62 KB
10 KB 159ms
158ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

e930ad9ebfea6a521dbf9ee896cc959c836ba201cdc8a21faa84b92eef3e0fb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 9937
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 logo.png
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/ 8 KB
8 KB 112ms
112ms Image
image/png 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/logo.png

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/logo.png
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 7719
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 EmailLogo.png
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/ 4 KB
4 KB 112ms
112ms Image
image/png 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/EmailLogo.png

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/img/EmailLogo.png
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 3908
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 print.css
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/ 2 KB
494 B 112ms
112ms Stylesheet
text/css 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/print.css

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

e384da2b74e0a93bfb683dca1c793fff75d2d71fdaaa3303f607bf1ffac32590

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/print.css
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 469
expires: Mon, 01 Nov 2021 17:11:33 GMT

GET
H3 200 _+_==+==_+.htm Show response
consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/ 14 KB
3 KB 116ms
116ms Script
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 17:11:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 3545

GET
H3 404 flagscape-header-1610.gif
consultyou.at/content/PRC384/_Images/ 64 KB
64 KB 426ms
426ms Image
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consultyou.at/content/PRC384/_Images/flagscape-header-1610.gif

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

f5ca684799cb1a5926fc380aa7b0c6b033bf6743f5dd8bf67e91c4bd6cda9d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /content/PRC384/_Images/flagscape-header-1610.gif
pragma: no-cache
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:11:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 ConnectionsMedium.woff
consultyou.at/content/PRC384/_Fonts/ 0
0 444ms
443ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.woff

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
:path: /content/PRC384/_Fonts/ConnectionsMedium.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:11:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 fontawesome-webfont.woff
consultyou.at/Content/_Fonts/ 0
0 426ms
425ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/Content/_Fonts/fontawesome-webfont.woff?v=4.0.3

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
:path: /Content/_Fonts/fontawesome-webfont.woff?v=4.0.3
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:11:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 fontawesome-webfont.ttf
consultyou.at/Content/_Fonts/ 0
0 397ms
397ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
:path: /Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/wasa.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:11:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H3 404 ConnectionsMedium.ttf
consultyou.at/content/PRC384/_Fonts/ 0
0 392ms
391ms Font
text/html 75.98.162.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.ttf

Requested by

Host: consultyou.at
URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css

Protocol

Security

QUIC, , AES_128_GCM

Server

75.98.162.75 Ann Arbor, United States, ASN55293 (A2HOSTING, US),

Reverse DNS

server.wpprhosting.net

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://consultyou.at
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: PHPSESSID=92d6de6672bae73298279bb1d0fe8c1a
:path: /content/PRC384/_Fonts/ConnectionsMedium.ttf
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: consultyou.at
referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/site.css
Origin: https://consultyou.at
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Oct 2021 17:11:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: LiteSpeed
link: <https://consultyou.at/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| dataLayer

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kobti.myweb.cs.uwindsor.ca/	1969-12-31 23:59:59	Name: PHPSESSID Value: d6u33p1qkl4bl3t3315g3ri042
			consultyou.at/	1969-12-31 23:59:59	Name: PHPSESSID Value: 92d6de6672bae73298279bb1d0fe8c1a

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/jquery.css' because its MIME type ('text/css') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/js/clikck.css' because its MIME type ('text/css') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217 Message: Refused to execute script from 'https://consultyou.at/wp-includes/certificates/prepaid-mariam.tamarajulia/546fff1c0953782e02e65fc10045c9b7/_+_==+==_+.htm?ip=216.131.114.217#' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://consultyou.at/content/PRC384/_Images/flagscape-header-1610.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/Content/_Fonts/fontawesome-webfont.woff?v=4.0.3 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/Content/_Fonts/fontawesome-webfont.ttf?v=4.0.3 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consultyou.at/content/PRC384/_Fonts/ConnectionsMedium.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

consultyou.at
kobti.myweb.cs.uwindsor.ca
137.207.76.172
75.98.162.75
18ede9e444c9e3c98cb78c79e7a5439efed2e140c59a8cbb54ee862f6577d4ea
42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49
4cbf4c28c67105f3b8d5bf35f76b1199b74d50f958bb0b4554a4e6918942fcaf
5df50c6df8d5b460d8faa72fa083896b64903e2760b4afaf11ca65be5491cae9
82a851132267e95ec73fc7385ba9c4020852182ee41f11145a28be75280d74d5
8332e9865442439990cc3f27b3e8a38c9b3bd5f548af382ae4fea0968181b4ff
880607ae689c1b591ea1162ac16e6ad0b2ec68e80bb86b5e9f86bce6c0e274a7
b1d9fe0ab1861e3ea9b9da7c146863d62387a3be5a2daa3358a334151d2f3d78
db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb
e384da2b74e0a93bfb683dca1c793fff75d2d71fdaaa3303f607bf1ffac32590
e930ad9ebfea6a521dbf9ee896cc959c836ba201cdc8a21faa84b92eef3e0fb9
f5ca684799cb1a5926fc380aa7b0c6b033bf6743f5dd8bf67e91c4bd6cda9d2f

consultyou.at Open in urlscan Pro 75.98.162.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

171 kBTransfer

571 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

15 Console Messages

Indicators

consultyou.at Open in urlscan Pro
75.98.162.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

171 kB
Transfer

571 kB
Size

2
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!