botwick.site Open in urlscan Pro
2a00:f940:2:2:1:1:0:161  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response botwick.site/qr/	83 KB 14 KB	350ms 145ms	Document text/html	2a00:f940:2:2:1:1:0:161 AS-REG
General Check archive.org Show headers Download Go to Full URL https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:1:0:161 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash 1375f5ac03edd5887033d6c68ceb3531288fd7b0dde6e2e701d7a9c1c7d6e384 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers content-encoding gzip content-type text/html date Thu, 01 Jun 2023 19:41:00 GMT server nginx vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	3 KB 929 B	265ms 91ms	Stylesheet text/css	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 01 Jun 2023 19:41:00 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 01 Jun 2023 18:13:03 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 01 Jun 2023 19:41:00 GMT
GET H2	200	__layout.svelte-c111369e.css wickbot.com/_app/immutable/assets/pages/	5 KB 2 KB	194ms 79ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AJs%2BOxgUlFqaKJozSZW%2BJfBsfTWFLOD1tCFF%2Fowgq7vQAmOP2kaRtYyOQVJWp0goR23H%2Fel%2FJeI3xyK%2FV7e384m8khU4iODJPjKT3jF%2F7pcUDJYHbAfvrW7L00%2ByVLUDP9tgvcxbb6L2"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58c0d922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	Core.svelte_svelte_type_style_lang-7571463e.css wickbot.com/_app/immutable/assets/	969 B 552 B	200ms 86ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cU9vItCmFBJzW%2F6Zk4kzsq92VB8xTaWWhMzEr%2FM7qY570DtdN6AYUODALuK%2FsiQ1Pz3zRgEGGM4rcooZ1vSitoLKjLUU4GTAAFLyCYcRfqNJwr9l8vLMlOY1eVtEF8rA%2BMCTpKYZ%2BpDe"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58c2d922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	Footer.svelte_svelte_type_style_lang-5a318128.css wickbot.com/_app/immutable/assets/	473 B 483 B	199ms 85ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XM6Omkg4vRcwH8hUVPFA0dj04VpBh%2B84UPsRvxqzgMwPgACnA02sp3cgXyw1Mk74wE6S8hGV0VisES9pTOE9leWS%2BptC56YerGtKRImm%2F9wNAHh9J%2Bl6fvbfRL8V0pesYiL9KzLQTvh4"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58c5d922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	stores-31916336.css wickbot.com/_app/immutable/assets/	152 KB 22 KB	202ms 88ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/stores-31916336.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=70ZY%2FvQnj2uGzp8xw9WyYC7jfC2EsykL%2FI3IWhhfFTYX%2FyaRnGDxxgCm0nugawyNKeE0lBiuk0b2iHX0N7vMG9veE%2F0rtu%2FazIDGzsY%2BymZbfGbhJho%2F69GUUrLywtKCeGNvtWQ%2Fo%2F7a"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58c6d922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	index.svelte_svelte_type_style_lang-9f398910.css wickbot.com/_app/immutable/assets/	5 KB 1 KB	240ms 127ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/index.svelte_svelte_type_style_lang-9f398910.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RKjuFP52DNYtW%2BwfrFCMnGicQhKWvQNiju%2FXqL5Mvbc2D287sWR9z2VUIVW%2FidUo0kTrsgBWMwWS7IMDW%2BidqVkGivC%2FH7gteqkOqTHWWvNDOBbStEI8KS%2BehhVR5JEI9j6t0w74jTIA"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58c7d922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	ExtraFeatures-ef88e16b.css wickbot.com/_app/immutable/assets/	12 KB 1 KB	195ms 82ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/ExtraFeatures-ef88e16b.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cuWXNOqeQi0JeT7h96kZICkldiH7pgKb7LX5erpowr7ydAtueYVX%2FIqWKV%2FU17optM7XGYXciRQFOymEAc6AQCjFYDsKTNd%2B27gQrv766UV3OyvgWs%2FVgSBjb9syV5LZt4VEsDijDAzx"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58cfd922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	Reviews2-8838cbd4.css wickbot.com/_app/immutable/assets/	121 B 377 B	193ms 80ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Reviews2-8838cbd4.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ChbHbi2uo1kdlpfHeYFWDqDO2T5rZDuO1rpm77REiTjvBHpUYdhNHgymV%2BW9PdRzcxv9pzZzXkf9%2BOYV1NzT0ejd2i5uu%2BP6quUzbSD1MmLHkAtghdVoOiAXHgpo7jwM%2F5%2B%2FUwOQxzZ"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58ccd922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	Invite-595352ac.css wickbot.com/_app/immutable/assets/	392 B 441 B	198ms 85ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Invite-595352ac.css Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0y4EhKWWH8TvoLuwpHYCQoLHK4M3wk7260IAKPBMpUDq6UDd8LLhLYsXUehElPr%2B2TPuRIUZG%2BzWC3YZFSdv41pg24%2FmQsWSLzyhqg96ed1xNcM9wnBajMAvcvj2ExKbjbHTXLkMAA0H"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7d09ee7f58cbd922-HEL alt-svc h3=":443"; ma=86400
GET H2	200	loading.gif botwick.site/qr/	66 KB 66 KB	146ms 146ms	Image image/gif	2a00:f940:2:2:1:1:0:161 AS-REG
General Check archive.org Show headers Download Go to Show image Full URL https://botwick.site/qr/loading.gif Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:1:0:161 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash 1827e9d30f9e24480d9f61158b1a701def6d07f814858109aedb8f48b9d2fd28 Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/qr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT last-modified Thu, 01 Jun 2023 19:27:10 GMT server nginx etag "6478f10e-10838" content-type image/gif cache-control max-age=3888000 accept-ranges bytes content-length 67640 expires Sun, 16 Jul 2023 19:41:00 GMT
GET H2	200	qrcode.min.js Show response cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/	19 KB 7 KB	207ms 65ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer Origin https://botwick.site accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1808965 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6083 last-modified Mon, 04 May 2020 16:15:41 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fad-4dd7" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3y8b0d0O1jsPkgIW%2B9EKE%2Fn5nLl9M%2FhHWRMgJ7TaOjcmCcdaDnddHsvAXqDOCP0XUWdMxD6IBklTshz%2BoI3pMQk90Mn8OFI6gR1cf%2BB34gZe60la4VCXHuAkxGOi4dJyApGj0UKgQwHR3BpC9aIxTYQN"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7d09ee811cb41c06-OSL expires Tue, 21 May 2024 19:41:00 GMT
GET H2	200	dash_hero.webp wickbot.com/	142 KB 142 KB	75ms 75ms	Image image/webp	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wickbot.com/dash_hero.webp Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 117329 etag "dash_hero.6854a092cb.webp" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i038qF0m4zM%2F86AoMSN9xDMKvAfeww2c079UrV4zQ4SNJYAmYMY9JB1oxisewKHg0NEWm5HuxtTD%2BO2uoiVe5ZkkeaRwGwHwcufL6awGagnmVGDZez6Sz42Jmh6iUSpVsc1oPbMVwPbs"}],"group":"cf-nel","max_age":604800} content-type image/webp accept-ranges bytes cf-ray 7d09ee807b2cd922-HEL alt-svc h3=":443"; ma=86400 content-length 145102
GET H2	200	dash_hero_light.webp wickbot.com/	117 KB 117 KB	94ms 94ms	Image image/webp	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wickbot.com/dash_hero_light.webp Requested by Host: wickbot.com URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:00 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 24842 etag "dash_hero_light.ab926aa196.webp" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7adm2GBx2xByTrV%2BPDJdG4WI6gTOTFlcs%2BHmvksIKVZPJ63CmFUV84AiN5hJTaOkUZVdhhKzWLnwSFk%2FY%2BYqaZS5PvmtUU9hzksCqO1InF0jCEaxjpbFWz%2FwjsEsC1AYSU7FASPS6Qbi"}],"group":"cf-nel","max_age":604800} content-type image/webp accept-ranges bytes cf-ray 7d09ee807b2fd922-HEL alt-svc h3=":443"; ma=86400 content-length 119624
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v20/	8 KB 8 KB	257ms 85ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://botwick.site accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Sat, 27 May 2023 18:01:47 GMT x-content-type-options nosniff age 437954 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7884 x-xss-protection 0 last-modified Wed, 27 Apr 2022 17:03:52 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 26 May 2024 18:01:47 GMT
GET H2	200	pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 fonts.gstatic.com/s/poppins/v20/	8 KB 8 KB	263ms 94ms	Font font/woff2	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://botwick.site accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Tue, 30 May 2023 20:39:35 GMT x-content-type-options nosniff age 169286 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7748 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:21:30 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 29 May 2024 20:39:35 GMT
POST H2	200	n Show response aquamarinelonelysecurity.avdeevandrey12.repl.co/	60 B 319 B	990ms 653ms	Fetch text/html	34.149.204.188 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://aquamarinelonelysecurity.avdeevandrey12.repl.co/n Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.149.204.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 188.204.149.34.bc.googleusercontent.com Software / Express Resource Hash 6fba061c529168921c0a735730636a796538f487180c8003a9e4f1a13fd38ffc Security Headers Name Value Strict-Transport-Security max-age=7771827; includeSubDomains Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:01 GMT strict-transport-security max-age=7771827; includeSubDomains etag W/"3c-KP2yTTkHducFmQXvEZ6V8wobLlk" expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" x-powered-by Express content-type text/html; charset=utf-8 access-control-allow-origin * replit-cluster global content-length 60
GET DATA	200 OK	truncated /	85 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	discord.png botwick.site/qr/	1 KB 2 KB	75ms 74ms	Image image/png	2a00:f940:2:2:1:1:0:161 AS-REG
General Check archive.org Show headers Download Go to Show image Full URL https://botwick.site/qr/discord.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:1:0:161 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144 Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/qr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:02 GMT last-modified Thu, 01 Jun 2023 19:27:10 GMT server nginx etag "6478f10e-5fc" content-type image/png cache-control max-age=3888000 accept-ranges bytes content-length 1532 expires Sun, 16 Jul 2023 19:41:02 GMT
GET DATA	200 OK	truncated /	10 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 32d0145697523075889e4f7c2cfe59dceab4c69862c2b0f15aa9a854d36e65fd Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Content-Type image/png
POST H2	200	t Show response aquamarinelonelysecurity.avdeevandrey12.repl.co/	1 B 108 B	211ms 211ms	Fetch text/html	34.149.204.188 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://aquamarinelonelysecurity.avdeevandrey12.repl.co/t Requested by Host: botwick.site URL: https://botwick.site/qr/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.149.204.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 188.204.149.34.bc.googleusercontent.com Software / Express Resource Hash a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b Security Headers Name Value Strict-Transport-Security max-age=7771824; includeSubDomains Request headers accept-language fi-FI,fi;q=0.9 Referer https://botwick.site/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 19:41:04 GMT strict-transport-security max-age=7771824; includeSubDomains etag W/"1-qXnvEMxvajbfa4oyMwfuO7Li25w" expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" x-powered-by Express content-type text/html; charset=utf-8 access-control-allow-origin * replit-cluster global content-length 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger) Wickbot (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| _0x42d60a function| _0x16b4 function| _0x26cb function| QRCode function| _0xa321 function| _0x3456

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aquamarinelonelysecurity.avdeevandrey12.repl.co
botwick.site
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
wickbot.com
2606:4700:20::ac43:48d0
2606:4700::6811:180e
2a00:1450:4001:801::200a
2a00:1450:4001:813::2003
2a00:f940:2:2:1:1:0:161
34.149.204.188
1375f5ac03edd5887033d6c68ceb3531288fd7b0dde6e2e701d7a9c1c7d6e384
1827e9d30f9e24480d9f61158b1a701def6d07f814858109aedb8f48b9d2fd28
32d0145697523075889e4f7c2cfe59dceab4c69862c2b0f15aa9a854d36e65fd
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
6fba061c529168921c0a735730636a796538f487180c8003a9e4f1a13fd38ffc
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453