wick-bots.site Open in urlscan Pro
2a00:f940:2:2:1:1:0:181  Malicious Activity! Public Scan

Submitted URL: https://clck.ru/34fqqj
Effective URL: https://wick-bots.site/qr/
Submission: On June 11 via manual from KR — Scanned from DE

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 19 HTTP transactions. The main IP is 2a00:f940:2:2:1:1:0:181, located in Russian Federation and belongs to AS-REG, RU. The main domain is wick-bots.site.
TLS certificate: Issued by R3 on June 10th 2023. Valid for: 3 months.
This is the only time wick-bots.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discord (Instant Messenger) Wickbot (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2a02:6b8::221 208722 (GLOBAL_DC)
1 1 2a02:6b8::232 208722 (GLOBAL_DC)
3 2a00:f940:2:2... 197695 (AS-REG)
1 2a00:1450:400... 15169 (GOOGLE)
10 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 34.149.204.188 15169 (GOOGLE)
19 7
Apex Domain
Subdomains
Transfer
10 wickbot.com
wickbot.com
288 KB
3 wick-bots.site
wick-bots.site
83 KB
2 gstatic.com
fonts.gstatic.com
16 KB
1 repl.co
rawcultivatedlinks--alekseevivan90.repl.co
319 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 263
7 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
929 B
1 yandex.ru
sba.yandex.ru — Cisco Umbrella Rank: 356335
313 B
1 clck.ru
clck.ru — Cisco Umbrella Rank: 229938
564 B
19 8
Domain Requested by
10 wickbot.com wick-bots.site
wickbot.com
3 wick-bots.site wick-bots.site
2 fonts.gstatic.com fonts.googleapis.com
1 rawcultivatedlinks--alekseevivan90.repl.co wick-bots.site
1 cdnjs.cloudflare.com wick-bots.site
1 fonts.googleapis.com wick-bots.site
1 sba.yandex.ru 1 redirects
1 clck.ru 1 redirects
19 8

This site contains links to these domains. Also see Links.

Domain
dashboard.wickbot.com
old.wickbot.com
discord.com
docs.wick.bot
Subject Issuer Validity Valid
wick-bots.site
R3
2023-06-10 -
2023-09-08
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-05-19 -
2023-08-11
3 months crt.sh
wickbot.com
GTS CA 1P5
2023-05-05 -
2023-08-03
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-05-19 -
2023-08-11
3 months crt.sh
repl.co
R3
2023-04-23 -
2023-07-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wick-bots.site/qr/
Frame ID: 17B95D8E65597D6D86191B4467C85054
Requests: 21 HTTP requests in this frame

Screenshot

Page Title

Wick Bot - VerificationDiamond

Page URL History Show full URLs

  1. https://clck.ru/34fqqj HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fwick-bots.site%2Fqr%2F%2310323670%3A1117082642903... HTTP 302
    https://wick-bots.site/qr/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

19
Requests

95 %
HTTPS

88 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

394 kB
Transfer

635 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clck.ru/34fqqj HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fwick-bots.site%2Fqr%2F%2310323670%3A1117082642903474319&client=clck&request_id=1686492630885524-14403208352996479750&sign=eb726a8fc86ace9dbd434c8dc66e7557 HTTP 302
    https://wick-bots.site/qr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wick-bots.site/qr/
Redirect Chain
  • https://clck.ru/34fqqj
  • https://sba.yandex.ru/redirect?url=https%3A%2F%2Fwick-bots.site%2Fqr%2F%2310323670%3A1117082642903474319&client=clck&request_id=1686492630885524-14403208352996479750&sign=eb726a8fc86ace9dbd434c8dc6...
  • https://wick-bots.site/qr/
84 KB
15 KB
Document
General
Full URL
https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:181 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
522e62a36c2539684f4555798a26b19a290381a7f005838ffb10078cfcf5d5a2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Sun, 11 Jun 2023 14:10:31 GMT
server
nginx
vary
Accept-Encoding

Redirect headers

Content-Length
316
Content-Type
text/html; charset=utf-8
Date
Sun, 11 Jun 2023 14:10:31 GMT
Location
https://wick-bots.site/qr/#10323670:1117082642903474319
Strict-Transport-Security
max-age=3600; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
css2
fonts.googleapis.com/
3 KB
929 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 11 Jun 2023 12:49:56 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 11 Jun 2023 14:10:31 GMT
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/
5 KB
1 KB
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tw25Asa6fxE%2FFqBj%2FQqSEW%2FQmIfMn%2BnNVHb1My24cOxNfOVjY0k0rRaD%2BI1X1XNlV%2FznV5dUcosq%2BLVWjbrwRHtAP%2F3QcADv0dRv0nmlp%2BGehfrhIVUgth5Bnkdzskh0cnU9dTrTwOb%2F"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d5a9214-FRA
alt-svc
h3=":443"; ma=86400
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/
969 B
549 B
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TGBEXFM9CsX4v9Aa4Of0jloBEUC%2FUJKCZILr92dqHKRBxQqHB6dfLgXnYn7tZhU1NW8rtVhMHfsnjs9JktCQB5VaepST2l94sV2KqvcPN6GxdZsGmarzEdFu7XqidUjCLqbrj%2BHtAu%2BQ"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d5b9214-FRA
alt-svc
h3=":443"; ma=86400
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/
473 B
484 B
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vkdLn26eaNbVOpY54%2BV%2FMtBKijIE2odAt3h2fOoT8R1Fxo9%2BvvQrGl89wDzyJDFjUJiraPpT5Hh%2Btok0vbJvuH8p8N%2BiE726t84fAcmzUkA%2F539kcM9RG0bElwKMmVTMi3nrEWia3E9p"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d5e9214-FRA
alt-svc
h3=":443"; ma=86400
stores-31916336.css
wickbot.com/_app/immutable/assets/
152 KB
22 KB
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/stores-31916336.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lq8Dx9nMZbkuJ6CXiYriCDXDjuGfz1hKaxsqOlyq8RLwMm7tIH5Gz6uG1IZs6yLNBpb%2FpVCtdPzwy406sfF9pTKWjNEu%2BX2lnXMLtlTTPQZirGhrfQKhZz8B1TqieF4c1xbn26vtp7Hs"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d5f9214-FRA
alt-svc
h3=":443"; ma=86400
index.svelte_svelte_type_style_lang-9f398910.css
wickbot.com/_app/immutable/assets/
5 KB
1 KB
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/index.svelte_svelte_type_style_lang-9f398910.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evvMB0sVv6FDQc1HtLYraUKsYLtd%2FN2hPwkTQC2YbmO65U3QE6QJRmEolOxKRAF3WTudvKYzviWsxP4%2FTaJKmyZcdwNPjE%2F6OdXKHwGifIq1c9NOFIhzhmt8MSdKLh32NdDn104TTGkv"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d609214-FRA
alt-svc
h3=":443"; ma=86400
ExtraFeatures-ef88e16b.css
wickbot.com/_app/immutable/assets/
12 KB
1 KB
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/ExtraFeatures-ef88e16b.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xvOUdWhEJTqBrH6iiq0VCjkwS%2FDnpsC9lFethply51jaEmaxP56klZTN9h5V0jxkthzlEuaUgEg9%2B6mFlWZNkpEDXPag2IbmaYRAxBG7z3I4YdUYkJlRjYXA7pusEgkPGeO28fQYNQS6"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d629214-FRA
alt-svc
h3=":443"; ma=86400
Reviews2-8838cbd4.css
wickbot.com/_app/immutable/assets/
121 B
606 B
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/Reviews2-8838cbd4.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=seUEtZNfJfb5wH3rl0c%2FjhPD%2B9zWEJL49ZNGGslLqC9Do6xnibGFQZp2m96gszqtp9Vg5kcXKtgLVR%2B7o3Pg2HsKGizsf5uLJqVqXRmG%2FSImUfZCiNs%2FG6K4KobovHHQWsuC5i8CGGFW"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d639214-FRA
alt-svc
h3=":443"; ma=86400
Invite-595352ac.css
wickbot.com/_app/immutable/assets/
392 B
449 B
Stylesheet
General
Full URL
https://wickbot.com/_app/immutable/assets/Invite-595352ac.css
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iFyLNLDMFGuD%2BG9tigRahhg99pxLU%2BfiPsoL8TNtT37FUtcMmmddbYWJJkJgcgu97jrrzekvZohRDN%2Bgap%2FG0NnQt9SU1VvhX7uYQWa8okosLXxhVm%2F771R8rsfdPF48YRw9Fvtkm9do"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
7d5a70239d649214-FRA
alt-svc
h3=":443"; ma=86400
loading.gif
wick-bots.site/qr/
66 KB
66 KB
Image
General
Full URL
https://wick-bots.site/qr/loading.gif
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:181 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
1827e9d30f9e24480d9f61158b1a701def6d07f814858109aedb8f48b9d2fd28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/qr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
last-modified
Sat, 10 Jun 2023 19:28:13 GMT
server
nginx
etag
"6484cecd-10838"
content-type
image/gif
cache-control
max-age=3888000
accept-ranges
bytes
content-length
67640
expires
Wed, 26 Jul 2023 14:10:31 GMT
qrcode.min.js
cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/
19 KB
7 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://wick-bots.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
3832259
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6083
last-modified
Mon, 04 May 2020 16:15:41 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fad-4dd7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o3Q6l4PnLqwSe2U06%2FiUxVLl9HU98hDoDVHJHDgq5qHh5E5XTyw4S8SxA1P%2FkXVsFm9r4k%2FA7lIRdebXsInNyw2P0Ou9CcUscvDwy55Sp5zh4FfaVP86Rh27IaTzhpaGozDr3llXgjdh3jGXtFZypjK6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7d5a70245d1fbb5b-FRA
expires
Fri, 31 May 2024 14:10:31 GMT
dash_hero.webp
wickbot.com/
142 KB
142 KB
Image
General
Full URL
https://wickbot.com/dash_hero.webp
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
168846
etag
"dash_hero.6854a092cb.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nwx%2FyYSVYltmsBeg9RAnZLyOR1zM7N7zJt6RSwZB11Yvh75wHkTw1ClfvAb6YpNJc375V7c8%2FBb6fmvtDUvKDjdGi3uYEMEuH6ydEd1cXzR%2F2X%2FZozW4ikwP8po2GXTQllfBf7qg76VU"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
7d5a70248e489214-FRA
alt-svc
h3=":443"; ma=86400
content-length
145102
dash_hero_light.webp
wickbot.com/
117 KB
117 KB
Image
General
Full URL
https://wickbot.com/dash_hero_light.webp
Requested by
Host: wickbot.com
URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:31 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
166574
etag
"dash_hero_light.ab926aa196.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cXxcKZ8XoMCkcfC109w0uGZweKEHPWzg0HZ8PKibDSIMObiMmOecfcGPDBQ3hYmShpvKHph3XhgR2E5pBDayoqcWbjcrwo8qlaRbIZPTOMt91FtuTEo9uYeWBjjt9dKUmNoR2WZonuX3"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
7d5a70248e4a9214-FRA
alt-svc
h3=":443"; ma=86400
content-length
119624
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick-bots.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Thu, 08 Jun 2023 18:06:15 GMT
x-content-type-options
nosniff
age
245056
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 17:03:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 07 Jun 2024 18:06:15 GMT
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/
8 KB
8 KB
Font
General
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick-bots.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sat, 10 Jun 2023 06:24:35 GMT
x-content-type-options
nosniff
age
114356
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 09 Jun 2024 06:24:35 GMT
n
rawcultivatedlinks--alekseevivan90.repl.co/
60 B
319 B
Fetch
General
Full URL
https://rawcultivatedlinks--alekseevivan90.repl.co/n
Requested by
Host: wick-bots.site
URL: https://wick-bots.site/qr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
188.204.149.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
b9f414c6d7398417e2a8013f17d0123717fe8f8cb6bb2486bdb1f20c6cbad3e7
Security Headers
Name Value
Strict-Transport-Security max-age=3558995; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:32 GMT
strict-transport-security
max-age=3558995; includeSubDomains
etag
W/"3c-NMo2qXlugqLKQMSXC/2dhx9YbCM"
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
x-powered-by
Express
content-type
text/html; charset=utf-8
access-control-allow-origin
*
replit-cluster
global
content-length
60
truncated
/
85 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
image/gif
discord.png
wick-bots.site/qr/
1 KB
2 KB
Image
General
Full URL
https://wick-bots.site/qr/discord.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:181 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick-bots.site/qr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sun, 11 Jun 2023 14:10:32 GMT
last-modified
Sat, 10 Jun 2023 19:28:13 GMT
server
nginx
etag
"6484cecd-5fc"
content-type
image/png
cache-control
max-age=3888000
accept-ranges
bytes
content-length
1532
expires
Wed, 26 Jul 2023 14:10:32 GMT
truncated
/
10 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2498932bcaa7311bca21fe92245838605be9983335d5823d7fd812079eb815b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type
image/png
t
rawcultivatedlinks--alekseevivan90.repl.co/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
rawcultivatedlinks--alekseevivan90.repl.co
URL
https://rawcultivatedlinks--alekseevivan90.repl.co/t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger) Wickbot (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| _0x42d60a function| _0x21eb function| _0x5da5 function| _0x16b4 function| _0x26cb function| QRCode function| _0x288a function| _0x2cbd function| _0xa321 function| _0x3456

1 Cookies

Domain/Path Name / Value
.clck.ru/ Name: _yasc
Value: 7sVp9zrQ164fidnVfOI5/dvDRsWN91AT8yamVUHvYXqNwO5Ju2I02EaP7/w=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
clck.ru
fonts.googleapis.com
fonts.gstatic.com
rawcultivatedlinks--alekseevivan90.repl.co
sba.yandex.ru
wick-bots.site
wickbot.com
rawcultivatedlinks--alekseevivan90.repl.co
2606:4700:20::681a:688
2606:4700::6811:190e
2a00:1450:4001:82b::2003
2a00:1450:4001:831::200a
2a00:f940:2:2:1:1:0:181
2a02:6b8::221
2a02:6b8::232
34.149.204.188
1827e9d30f9e24480d9f61158b1a701def6d07f814858109aedb8f48b9d2fd28
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
522e62a36c2539684f4555798a26b19a290381a7f005838ffb10078cfcf5d5a2
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
b9f414c6d7398417e2a8013f17d0123717fe8f8cb6bb2486bdb1f20c6cbad3e7
c2498932bcaa7311bca21fe92245838605be9983335d5823d7fd812079eb815b
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453