wickbot.online Open in urlscan Pro
2a00:7ee0:8:0:3:57:0:7  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response wickbot.online/	86 KB 17 KB	106ms 30ms	Document text/html	2a00:7ee0:8:0:3:57:0:7 ADISTA-SAS
General Check archive.org Show headers Download Go to Full URL http://wickbot.online/ Protocol HTTP/1.1 Server 2a00:7ee0:8:0:3:57:0:7 , France, ASN16347 (ADISTA-SAS, FR), Reverse DNS Software / Resource Hash 5a6f4d8b1a092514eb5206e66c9e448c21bac56e146f511c196d3d04f5a4449e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Encoding gzip Content-Length 16973 Content-Type text/html Date Tue, 27 Jun 2023 20:20:55 GMT ETag "1569c-5f7a8951faa00-gzip" Last-Modified Fri, 24 Mar 2023 17:18:32 GMT Vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	3 KB 929 B	104ms 37ms	Stylesheet text/css	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 27 Jun 2023 20:20:55 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 27 Jun 2023 19:18:55 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 27 Jun 2023 20:20:55 GMT
GET H2	200	__layout.svelte-c111369e.css wickbot.com/_app/immutable/assets/pages/	5 KB 2 KB	106ms 37ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vJalZS44r0nMbm1rGS%2Bpk6UDNfDK1iN%2FLPRhoQ2KmCKGoydFsL3feXLGrdOmjwUQMl4sFK6K9ZNaaJLw8WIyCfx0lXc0nCImSyAor5P6j2N3445jDV21YFoYcLZlduG6Zj%2BOT30DmkSX"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789bc2a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	Core.svelte_svelte_type_style_lang-7571463e.css wickbot.com/_app/immutable/assets/	969 B 559 B	106ms 38ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2BNsJcL9Pd%2BN%2FZsxG5jwNIs%2F7oD2HFSC%2Fr1RJXFMNyaHFwNoW41rtkiwicgFXS7ECgyJ9VFH%2FKDZpq%2BJu0XPTJjXVU4KJZg0UdOlNpFHLN2%2BkkZnJPC0zln7vHS7HeiF7E%2BiRbjvqnlg"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789be2a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	Footer.svelte_svelte_type_style_lang-5a318128.css wickbot.com/_app/immutable/assets/	473 B 504 B	128ms 59ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FzcgN%2FwvLJgn8iBfzGbL5qi%2FWWAyOnaC%2BWf%2BlSI%2B5NuJQJ2fN02StwHpigIe5t0TrhNxq81z90BmmbTAi6PcApFkcrAYImREuPfaDvksEuPM8QqWYaeXHQfepKAMstwJTyWySlOwtk1C"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789bf2a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	stores-31916336.css wickbot.com/_app/immutable/assets/	152 KB 22 KB	112ms 43ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/stores-31916336.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=po6i3%2FaeyC69AgurP9Lj65sK%2Fni6MAN2aE8Ah9fHSAtnylfq%2FjVRKBc0Lipzh25aajlg7RNX2x5l6oFrWnZF3QQ%2F3gwz8a4lEGAJ%2FGFb7AtlsVKALpjaLFttu4ORfBDHjFLbcpFGWtmp"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789c32a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	index.svelte_svelte_type_style_lang-9f398910.css wickbot.com/_app/immutable/assets/	5 KB 1 KB	108ms 40ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/index.svelte_svelte_type_style_lang-9f398910.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yNE0OFBxfjPfC6owNNHiWfPMGYTCUgkAoVtD74mZ66QezbrYHC0fBoJvGvAsV083aZmDtnwjId%2FVeoO7pdfrnR3bQ%2FgvsHkCizJNzebBOP9k7LmYfgzwxPn5GUcaDsV3cLnhRHBLwC35"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789c42a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	ExtraFeatures-ef88e16b.css wickbot.com/_app/immutable/assets/	12 KB 1 KB	126ms 57ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/ExtraFeatures-ef88e16b.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZuKmvbapkrOUyACfE4o1pzzrxOe8oPg%2BRUNdToHL48UPY6B7oqTGpzZjj6mdmMLv94R7emQREwNLnBKdkQBDxubDSstr514e3xxtFefWzfWuZ0BtxbXrBVeAhLlr8hP5pYXNaBYpWl4P"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789c62a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	Reviews2-8838cbd4.css wickbot.com/_app/immutable/assets/	121 B 387 B	112ms 44ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Reviews2-8838cbd4.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4NJljvF5K9%2FY34MZSb3EUCA4EFTGNIiV8xu4CDuZWxdt9%2F%2FTTzB6RA12FrR7Ex2wqrScZU6eH3U5xLQB4b2HGjmiZ%2FauKUohfrEvJwoNbKWjr37vrI%2B4iyFVCdqeOojsfUawKNxOYC%2FA"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789ca2a05-CDG alt-svc h3=":443"; ma=86400
GET H2	200	Invite-595352ac.css wickbot.com/_app/immutable/assets/	392 B 435 B	126ms 58ms	Stylesheet text/css	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wickbot.com/_app/immutable/assets/Invite-595352ac.css Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT content-encoding br x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ArrS3EBDrW3EZj6LK%2BjiQctpKIsBUjf1eO2aj17qXa7ELqmeUXFuWmtlkCXSnkL3ThONuinT3HOXfMSBNpid80%2FkGCYvVJ%2BhHw69%2BsiAWQkuxnz%2B1%2FG79hBfCxxPQ8V5K6xletbrY%2BPr"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, immutable, max-age=31536000 x-robots-tag noindex cf-ray 7de064b789ce2a05-CDG alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	1.gif wickbot.online/	417 KB 417 KB	29ms 28ms	Image image/gif	2a00:7ee0:8:0:3:57:0:7 ADISTA-SAS
General Check archive.org Show headers Download Go to Show image Full URL http://wickbot.online/1.gif Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol HTTP/1.1 Server 2a00:7ee0:8:0:3:57:0:7 , France, ASN16347 (ADISTA-SAS, FR), Reverse DNS Software / Resource Hash f18f620beb48d2fad6e3f77748e2de9342a2d287a14b67fccb226cc824bc1862 Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 20:20:55 GMT Last-Modified Fri, 24 Mar 2023 17:16:24 GMT Connection keep-alive Accept-Ranges bytes ETag "68223-5f7a88d7e8a00" Content-Length 426531 Content-Type image/gif
GET H/1.1	200 OK	2.gif wickbot.online/	6 MB 6 MB	54ms 27ms	Image image/gif	2a00:7ee0:8:0:3:57:0:7 ADISTA-SAS
General Check archive.org Show headers Download Go to Show image Full URL http://wickbot.online/2.gif Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol HTTP/1.1 Server 2a00:7ee0:8:0:3:57:0:7 , France, ASN16347 (ADISTA-SAS, FR), Reverse DNS Software / Resource Hash 6ebc34cc6a790cdb3bdceec4e66d1d864e3d08a68d96cc8c2ba45c22ad7085b1 Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 20:20:55 GMT Last-Modified Fri, 24 Mar 2023 17:16:19 GMT Connection keep-alive Accept-Ranges bytes ETag "628a2c-5f7a88d323ec0" Content-Length 6457900 Content-Type image/gif
GET H/1.1	200 OK	3.gif wickbot.online/	1 MB 1 MB	55ms 29ms	Image image/gif	2a00:7ee0:8:0:3:57:0:7 ADISTA-SAS
General Check archive.org Show headers Download Go to Show image Full URL http://wickbot.online/3.gif Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol HTTP/1.1 Server 2a00:7ee0:8:0:3:57:0:7 , France, ASN16347 (ADISTA-SAS, FR), Reverse DNS Software / Resource Hash ce0895e7b0c4996611c00ab6814303d3e2e7996d858acdfae3ec0d9f3b8ba90a Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 20:20:55 GMT Last-Modified Fri, 24 Mar 2023 17:16:14 GMT Connection keep-alive Accept-Ranges bytes ETag "17ed65-5f7a88ce5f380" Content-Length 1568101 Content-Type image/gif
GET H2	200	dash_hero.webp wickbot.com/	142 KB 142 KB	36ms 35ms	Image image/webp	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wickbot.com/dash_hero.webp Requested by Host: wickbot.online URL: http://wickbot.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer http://wickbot.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 112440 etag "dash_hero.6854a092cb.webp" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ep09z7IrzE3qwPvgJAX6ES4yZHRpfcg2dK2bs3oXUcbt8KsTT34igsvHRHDP6fyFyx2WpoEBceOUx3zO%2FGZdS3A5ZScvxuB%2BTJXJ3jo6S4G%2BCvtbds59SdC%2FR1I1r4z49WJfptxLqpPV"}],"group":"cf-nel","max_age":604800} content-type image/webp accept-ranges bytes cf-ray 7de064b82a5d2a05-CDG alt-svc h3=":443"; ma=86400 content-length 145102
GET H2	200	dash_hero_light.webp wickbot.com/	117 KB 117 KB	46ms 45ms	Image image/webp	2606:4700:20::ac43:48d0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wickbot.com/dash_hero_light.webp Requested by Host: wickbot.com URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 20:20:55 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 93384 etag "dash_hero_light.ab926aa196.webp" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PBUOe34mzYOniZnRDBgm2%2Bm8%2B3kwjkLv%2B%2BkGeqNU%2FzbAtZdUMLmiimuRnG0lkSAVeDf%2Brsj0MWlnIauoBeDkqtsKgW49Xa%2FkZdKKw4pi1Be1%2BCR1%2B%2BeVYWaxDjxpBfz3fnkxQoI%2F2n2s"}],"group":"cf-nel","max_age":604800} content-type image/webp accept-ranges bytes cf-ray 7de064b82a5e2a05-CDG alt-svc h3=":443"; ma=86400 content-length 119624
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v20/	8 KB 8 KB	94ms 27ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://wickbot.online accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 21 Jun 2023 18:19:00 GMT x-content-type-options nosniff age 525715 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7884 x-xss-protection 0 last-modified Wed, 27 Apr 2022 17:03:52 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 20 Jun 2024 18:19:00 GMT
GET H2	200	pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 fonts.gstatic.com/s/poppins/v20/	8 KB 8 KB	94ms 31ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://wickbot.online accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 20 Jun 2023 20:39:35 GMT x-content-type-options nosniff age 603680 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7748 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:21:30 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 19 Jun 2024 20:39:35 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wickbot (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
wickbot.com
wickbot.online
2606:4700:20::ac43:48d0
2a00:1450:4001:803::200a
2a00:1450:4001:806::2003
2a00:7ee0:8:0:3:57:0:7
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
5a6f4d8b1a092514eb5206e66c9e448c21bac56e146f511c196d3d04f5a4449e
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
6ebc34cc6a790cdb3bdceec4e66d1d864e3d08a68d96cc8c2ba45c22ad7085b1
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
ce0895e7b0c4996611c00ab6814303d3e2e7996d858acdfae3ec0d9f3b8ba90a
f18f620beb48d2fad6e3f77748e2de9342a2d287a14b67fccb226cc824bc1862
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453