wicksvip.com Open in urlscan Pro
107.23.138.6 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wicksvip.com/
Effective URL:
https://wicksvip.com/fp.php?aid=430038&
Submission Tags: phishingrod
Submission: On April 19 via api (April 19th 2024, 6:06:28 am UTC) from DE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 107.23.138.6, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is wicksvip.com.
TLS certificate: Issued by R3 on April 18th 2024. Valid for: 3 months.

This is the only time wicksvip.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 7	107.23.138.6 107.23.138.6	14618 (AMAZON-AES) (AMAZON-AES)
3	142.250.186.68 142.250.186.68	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	157.240.252.13 157.240.252.13	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
12	5

7 107.23.138.6 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: mail1.granburysalesbuilder.com

wicksvip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.wicksvip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.68 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.252.13 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	wicksvip.com 1 redirects wicksvip.com www.wicksvip.com	154 KB
3	google.com www.google.com — Cisco Umbrella Rank: 2	856 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	89 KB
1	gstatic.com www.gstatic.com	201 KB
12	4

	Domain	Requested by
6	wicksvip.com	1 redirects wicksvip.com
3	www.google.com	wicksvip.com www.gstatic.com
2	connect.facebook.net	wicksvip.com connect.facebook.net
1	www.gstatic.com	www.google.com
1	www.wicksvip.com	wicksvip.com
12	5

This site contains no links.

Subject Issuer	Validity	Valid
wicksvip.com R3	`2024-04-18` - `2024-07-17`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-27` - `2024-04-26`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-18` - `2024-06-10`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://wicksvip.com/fp.php?aid=430038&
Frame ID: C1635761C74824DFBF92E20623DF534F
Requests: 10 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld7b0EUAAAAAO_mp4fOd_VyfNBfj-DxunI391T2&co=aHR0cHM6Ly93aWNrc3ZpcC5jb206NDQz&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=invisible&cb=mgu0eocq9fgr
Frame ID: 34C7564424AC3DE05A8E69707DB28FF4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6Ld7b0EUAAAAAO_mp4fOd_VyfNBfj-DxunI391T2
Frame ID: 48C74495ED548EB872A66D227652745B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://wicksvip.com/ HTTP 302
https://wicksvip.com/fp.php?aid=430038& Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

12
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

445 kB
Transfer

956 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wicksvip.com/ HTTP 302
https://wicksvip.com/fp.php?aid=430038& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request fp.php Show response
wicksvip.com/
Redirect Chain

https://wicksvip.com/
https://wicksvip.com/fp.php?aid=430038&

7 KB
7 KB

137ms
136ms

Document
text/html

107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://wicksvip.com/fp.php?aid=430038&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 / PHP/7.2.34
Resource Hash: 90a668740f9ee6bfbdf3f093e15e3c06e7ffd75e462e8467d7f0a039d3be61eb

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 7158
Content-Type: text/html; charset=UTF-8
Date: Fri, 19 Apr 2024 06:06:24 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
X-Powered-By: PHP/7.2.34

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Fri, 19 Apr 2024 06:06:24 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Location: /fp.php?aid=430038&
Pragma: no-cache
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
X-Powered-By: PHP/7.2.34

GET
H/1.1 200
OK site.css
wicksvip.com/css/ 18 KB
19 KB 119ms
119ms Stylesheet
text/css 107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://wicksvip.com/css/site.css
Requested by: Host: wicksvip.com
URL: https://wicksvip.com/fp.php?aid=430038&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: 5bbf213c61cd041308bd0c6f634671c0f628be134573ac2343197f46077544de

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/fp.php?aid=430038&
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 19 Apr 2024 06:06:24 GMT
Last-Modified: Fri, 22 Jan 2021 16:19:58 GMT
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
ETag: "49ad-5b97f8f371526"
Content-Type: text/css
Cache-Control: max-age=3600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 18861
Expires: Fri, 19 Apr 2024 07:06:24 GMT

GET
H/1.1 200
OK salesbuilder.js Show response
wicksvip.com/js/ 50 KB
50 KB 121ms
120ms Script
text/javascript 107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://wicksvip.com/js/salesbuilder.js
Requested by: Host: wicksvip.com
URL: https://wicksvip.com/fp.php?aid=430038&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: 466198ccf77a2a24080614a35d2815878b492190705da6b689ed4dda257ae1b9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/fp.php?aid=430038&
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 19 Apr 2024 06:06:24 GMT
Last-Modified: Tue, 12 May 2020 13:25:13 GMT
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
ETag: "c84c-5a57364bb1d53"
Content-Type: text/javascript
Cache-Control: max-age=3600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 51276
Expires: Fri, 19 Apr 2024 07:06:24 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
856 B 128ms
49ms Script
text/javascript 142.250.186.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: wicksvip.com
URL: https://wicksvip.com/fp.php?aid=430038&

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f4.1e100.net

Software

GSE /

Resource Hash

0eb1d1903c6765eb52f6fba4dd782620116b398b8f11de986533eafcd838b616

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 19 Apr 2024 06:06:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Fri, 19 Apr 2024 06:06:24 GMT

GET
H/1.1 200
OK logo.website.jpg
www.wicksvip.com/cligx/430038/web/ 64 KB
65 KB 384ms
119ms Image
image/jpeg 107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.wicksvip.com/cligx/430038/web/logo.website.jpg
Requested by: Host: wicksvip.com
URL: https://wicksvip.com/fp.php?aid=430038&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: 9e7a9a903b99df1889c07f9b13f742433f45b49861c30f726b7385dd3bed4c43

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 19 Apr 2024 06:06:24 GMT
Last-Modified: Tue, 01 Jul 2014 00:04:16 GMT
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
ETag: "10104-4fd1684432441"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 65796

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
3 KB 130ms
41ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: wicksvip.com
URL: https://wicksvip.com/js/salesbuilder.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

52dae8029b9bb3acae7de3f2812ed9ce4595c4da8922cfe62fec56e8d3d87a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 19 Apr 2024 06:06:24 GMT
content-md5: vJ5a0hYUl4Ziy9W/KdGipA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=12, mss=1294, tbw=2773, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: DJX6WPmue+PU0cE+FIAULlYPBQqnlpxlVmdeYMGNvgJIwADlPylwVWZ0YbMjoVsb9lhVG7yWbI5iqDhHTOC6Yw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 50f67756b58cffbdf3d431ea2a242f7a
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "d296b6439478aa9e7085f91db16f68ac"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Fri, 19 Apr 2024 06:19:19 GMT

GET
H/1.1 200
OK buttonbg.jpg
wicksvip.com/images/ 11 KB
11 KB 119ms
118ms Image
image/jpeg 107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicksvip.com/images/buttonbg.jpg
Requested by: Host: wicksvip.com
URL: https://wicksvip.com/css/site.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: e29c83ec716c9bf32ad9e11e1216a96d99e40187c13446321ce70a7a20df7b25

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/css/site.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 19 Apr 2024 06:06:24 GMT
Last-Modified: Sat, 11 Apr 2020 02:50:20 GMT
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
ETag: "2acd-5a2fae9257f13"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 10957

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 299 KB
86 KB 89ms
44ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=c44ecd9b24422662ed44d04ca83bc0a4

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra3.fbcdn.net

Software

Resource Hash

53e28fe2984dba47e78842766fb5e00aa92a825a8b9bd001647e70bb0b421593

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/
Origin: https://wicksvip.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 19 Apr 2024 06:06:24 GMT
content-md5: tWbEqBgE+k4UVc9m6tLESQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87562
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=43, rtx=0, c=38, mss=1232, tbw=4289, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: 4AdfYpwehb7YgNhQMLP2noIFTFBcxbiiqKhVBGintIjCUsMZWaKSGm6TKTEdJrvsy+WxOzOcwY+YwXIHMaemJw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 248fda463b7690a4bff635f7ce50c6fc
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "6245d0a7aa8d61ee436aea5303ada299"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Fri, 18 Apr 2025 21:07:41 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/ 501 KB
201 KB 140ms
44ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/
Origin: https://wicksvip.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 11:29:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67034
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205471
x-xss-protection: 0
last-modified: Fri, 29 Mar 2024 04:30:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 18 Apr 2025 11:29:10 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 34C7 0
0 144ms
64ms Document
text/html 142.250.186.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld7b0EUAAAAAO_mp4fOd_VyfNBfj-DxunI391T2&co=aHR0cHM6Ly93aWNrc3ZpcC5jb206NDQz&hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&size=invisible&cb=mgu0eocq9fgr

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0_J6iHtkflSM_Q3Hyk95ag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://wicksvip.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-0_J6iHtkflSM_Q3Hyk95ag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 19 Apr 2024 06:06:25 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame 48C7 0
0 53ms
53ms Document
text/html 142.250.186.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6Ld7b0EUAAAAAO_mp4fOd_VyfNBfj-DxunI391T2

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2u6YRjavACx3M0eKJyexRQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://wicksvip.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-2u6YRjavACx3M0eKJyexRQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 19 Apr 2024 06:06:25 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK favicon.ico
wicksvip.com/ 1 KB
1 KB 119ms
119ms Other
image/vnd.microsoft.icon 107.23.138.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://wicksvip.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.23.138.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: mail1.granburysalesbuilder.com
Software: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: b459a6e605023415b78109b095ba25abc209851bac32939511eb8720df1019ba

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wicksvip.com/fp.php?aid=430038&
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 19 Apr 2024 06:06:25 GMT
Last-Modified: Sat, 11 Apr 2020 02:57:13 GMT
Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.34
ETag: "47e-5a2fb01c0ebb8"
Content-Type: image/vnd.microsoft.icon
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1150

Verdicts & Comments Add Verdict or Comment

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.google.com/recaptcha	1970-01-21 00:17:38	Name: _GRECAPTCHA Value: 09ALYNOah2T6Th696grWdXkt2Trkt8pqg35CI5caa1EZvtNWpJbXYwXjQzkaVFnIRRjZClF14R20t3iwDLC32zC3k
			wicksvip.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: f0hdhgd8r4mg9k170gres8u6uf

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://wicksvip.com/fp.php?aid=430038& Message: Mixed Content: The page at 'https://wicksvip.com/fp.php?aid=430038&' was loaded over HTTPS, but requested an insecure element 'http://www.wicksvip.com/cligx/430038/web/logo.website.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://wicksvip.com/fp.php?aid=430038&(Line 78) Message: Mixed Content: The page at 'https://wicksvip.com/fp.php?aid=430038&' was loaded over HTTPS, but requested an insecure element 'http://www.wicksvip.com/cligx/430038/web/logo.website.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
other	warning	URL: https://wicksvip.com/fp.php?aid=430038& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://wicksvip.com/fp.php?aid=430038& Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
wicksvip.com
www.google.com
www.gstatic.com
www.wicksvip.com
107.23.138.6
142.250.186.68
157.240.252.13
2a00:1450:4001:811::2003
2a03:2880:f084:d:face:b00c:0:3
0eb1d1903c6765eb52f6fba4dd782620116b398b8f11de986533eafcd838b616
3958a93184f498eaa140c746fa8b3ce7e540d38898f2b1c1acf9c7e8f6c5f429
466198ccf77a2a24080614a35d2815878b492190705da6b689ed4dda257ae1b9
52dae8029b9bb3acae7de3f2812ed9ce4595c4da8922cfe62fec56e8d3d87a5c
53e28fe2984dba47e78842766fb5e00aa92a825a8b9bd001647e70bb0b421593
5bbf213c61cd041308bd0c6f634671c0f628be134573ac2343197f46077544de
90a668740f9ee6bfbdf3f093e15e3c06e7ffd75e462e8467d7f0a039d3be61eb
9e7a9a903b99df1889c07f9b13f742433f45b49861c30f726b7385dd3bed4c43
b459a6e605023415b78109b095ba25abc209851bac32939511eb8720df1019ba
e29c83ec716c9bf32ad9e11e1216a96d99e40187c13446321ce70a7a20df7b25

wicksvip.com Open in urlscan Pro 107.23.138.6 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

445 kBTransfer

956 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

96 JavaScript Global Variables

2 Cookies

4 Console Messages

Indicators

wicksvip.com Open in urlscan Pro
107.23.138.6 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

445 kB
Transfer

956 kB
Size

2
Cookies

12 HTTP transactions
0 data transactions