urlscan.io logo urlscan.io
SecurityTrails logo

wick.captchacom.site Open in urlscan Pro
2606:4700:3031::ac43:9a4c  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://clck.ru/36tUg2
Effective URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1...
Submission: On December 03 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3031::ac43:9a4c, located in United States and belongs to CLOUDFLARENET, US. The main domain is wick.captchacom.site.
TLS certificate: Issued by GTS CA 1P5 on November 27th 2023. Valid for: 3 months.
This is the only time wick.captchacom.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wickbot (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2a02:6b8::221 208722 (GLOBAL_DC)
1 1 2a02:6b8::232 208722 (GLOBAL_DC)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
1 104.19.219.90 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 104.19.218.90 13335 (CLOUDFLAR...)
12 6
1    2a02:6b8::221 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)
clck.ru
1    2a02:6b8::232 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)
sba.yandex.ru
1    2606:4700:3033::ac43:87a1 (United States)

ASN13335 (CLOUDFLARENET, US)
verify.url-shortnest.space
1    2606:4700:3031::ac43:9a4c (United States)

ASN13335 (CLOUDFLARENET, US)
wick.captchacom.site
6    2606:4700:20::ac43:48d0 (United States)

ASN13335 (CLOUDFLARENET, US)
wickbot.com
1    104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hcaptcha.com
1    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    104.19.218.90 (None, )

ASN13335 (CLOUDFLARENET, US)
newassets.hcaptcha.com
Apex Domain
Subdomains		 Transfer
6 wickbot.com
wickbot.com
167 KB
2 gstatic.com
fonts.gstatic.com
16 KB
2 hcaptcha.com
js.hcaptcha.com — Cisco Umbrella Rank: 9944
newassets.hcaptcha.com — Cisco Umbrella Rank: 9853
96 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
929 B
1 captchacom.site
wick.captchacom.site
8 KB
1 url-shortnest.space
verify.url-shortnest.space
607 B
1 yandex.ru
sba.yandex.ru — Cisco Umbrella Rank: 339188
370 B
1 clck.ru
clck.ru — Cisco Umbrella Rank: 292101
914 B
12 8
Domain Requested by
6 wickbot.com wick.captchacom.site
wickbot.com
2 fonts.gstatic.com fonts.googleapis.com
1 newassets.hcaptcha.com js.hcaptcha.com
1 fonts.googleapis.com wick.captchacom.site
1 js.hcaptcha.com wick.captchacom.site
1 wick.captchacom.site
1 verify.url-shortnest.space 1 redirects
1 sba.yandex.ru 1 redirects
1 clck.ru 1 redirects
12 9

This site contains no links.

Subject Issuer Validity Valid
captchacom.site
GTS CA 1P5		 2023-11-27 -
2024-02-25		 3 months crt.sh
wickbot.com
GTS CA 1P5		 2023-10-29 -
2024-01-27		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-15 -
2024-04-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Frame ID: D0A19B5FDF9823A94230C1C092CC7481
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Wick Verification

Page URL History Show full URLs

  1. https://clck.ru/36tUg2 HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3De... HTTP 302
    https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9 HTTP 302
    https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEs... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

78 %
IPv6

8
Domains

9
Subdomains

6
IPs

4
Countries

288 kB
Transfer

683 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clck.ru/36tUg2 HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3DeyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9&client=clck&request_id=1701587222857394-3807400629919074015&sign=50b0cab207bc428e2a48709a9ea4da36 HTTP 302
    https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9 HTTP 302
    https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request verify
wick.captchacom.site/
Redirect Chain
  • https://clck.ru/36tUg2
  • https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3DeyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9&client=clck&request_id=170158722285...
  • https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9
  • https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
29 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:9a4c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
9161f44a677ba49b6fa7131aabbc9b115db5097d1a6c6609a973685792e9c90e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
82f9f877396b4db0-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 03 Dec 2023 07:07:04 GMT
last-modified
Sat, 02 Dec 2023 02:32:09 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YqODA2W9psDgkSkQXXh3nQ1LpPH4TI2Oz0NfCE8v8ogfalKbdcm1ZDP%2FfrvVBlV6DeGR6%2FX0SRsSEoNDNVaNB3AXuGQH%2FPm2rsqCPL664sFied892xT%2FniyrMsbIxui2HMiEIiTV6OQr3jqjtL%2BNsKoOrw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82f9f875bed51c42-FRA
content-type
text/html; charset=utf-8
date
Sun, 03 Dec 2023 07:07:04 GMT
location
https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pKsL59407ywIKZGERq%2Fq6iWOTF8a2U0qklOV6NMJAvO2N1sCMF%2BCH5S9qJIwrWLPFMgQ9ushpYSLVO0VN14c9ZJig9veGuExxLkmzaYkhGSqZ6lzc5jlRF4xblgzw3FwW%2Fj21p8aZlCPy%2FoSDaJe8%2B39wHjnJprFNg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept
x-powered-by
Express
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KQZ99sZ0Vgd8izYODgKpCqwjUjAsak1%2BacnOBHoTnWokxpYQof%2BXaRjE4bX1%2FZGex%2BVl01zyimZckAlIuxYeS%2Fx%2FMM4f%2FPbo6CJhacCDN%2FilUFeq6ZlJi%2BeRy5%2FGS0tqn%2BXJ8w9Zcth"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9f878eacf19ad-FRA
alt-svc
h3=":443"; ma=86400
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ 		969 B
550 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0IXaVb47PfGy6zjJEFt3X7IFGXxoperZW9wNEr3%2F3l6lbyVfrfvv17U9Izw9zS3%2F1BsdlX8V%2Bb52q9yAPxcsWiZfwNpjbUhyyMMsTf%2FQUEgPxW9VzjMVN8q0Q1ml7DA8uYpRtM3Lv0sm"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9f878ead119ad-FRA
alt-svc
h3=":443"; ma=86400
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ 		473 B
494 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m9d7ozAUo3zmLqURRcxNfU7HXvQASPHBR2x8HEvk4aTVdA%2BOWZy3QBHMUGUO7FSIB0f4RvnrnJaQ1VOZPDCFuvH%2FZ%2BY4VFhHfiicuIAxMJTotyP61CnzDTW3ysgh6gDPaEk3bmlys6n4"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9f878ead319ad-FRA
alt-svc
h3=":443"; ma=86400
stores-31916336.css
wickbot.com/_app/immutable/assets/ 		152 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/stores-31916336.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O8xmv76ys80BePoXB0hZOW39OaoYwOMDOZznnpr0xxkICEO4Sj76d06%2FewuhmuEiWnk%2FdQGK5I6ss4Ah5jXRnhkAJcGzoOmsoNvM2VlQssuAVhjK4jzE3eEANtDmCdz0V6G0CTJ53nBC"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9f878ead019ad-FRA
alt-svc
h3=":443"; ma=86400
api.js
js.hcaptcha.com/1/ 		325 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hcaptcha.com/1/api.js?hl=fr&onload=loadCaptcha&render=explicit
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e3d226a080ed55fa5cd80e9b526353615725dd91f71d28aca1a5f9cf8f989f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 392060e737ac00b4ceaf733942c6b428.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
5R.cD6enL2w3aksUxVbBtDhRU.J.y.sj
age
0
x-amz-cf-pop
MRS52-P5
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 29 Nov 2023 16:00:24 GMT
server
cloudflare
etag
W/"e384453ae4e919ae0cdfb219d73036d4"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
cf-ray
82f9f878ba4558de-TXL
x-amz-cf-id
i1dl9SnCMzqjj8Pn8xh1cWlwQ-ru2HuwrBOrEIT8qq68KWSmHize4w==
css2
fonts.googleapis.com/ 		3 KB
929 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 03 Dec 2023 06:12:13 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 03 Dec 2023 07:07:04 GMT
__error.svelte-49cc1fa9.css
wickbot.com/_app/immutable/assets/pages/ 		927 B
480 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__error.svelte-49cc1fa9.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODczOTg4NzcsImlwIjoiMmEwMTo0YTA6MTMzODo5Mjo6MTIifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d3fcd95f428479ffd71abca6b02da07e67e1951cb245b20ffe71d9012f6bf9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sXXsK8eRVcHlpeQxOAGM%2BW%2F5wSE1eYdO0X51i38b9a8mEulfq%2FAGNeTe6eMTUs%2Fso%2BWrfxvebO%2BtXXfeToSSwNwDKcdaO1KV5SOiIQE0TTFv2Hfv9ePxG78mHFFlRWNVbaJD9GT%2FWD4a"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9f878ead419ad-FRA
alt-svc
h3=":443"; ma=86400
dash_hero.webp
wickbot.com/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wickbot.com/dash_hero.webp
Requested by
Host: wickbot.com
URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
17248
etag
"dash_hero.6854a092cb.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2F0WLu4B8z23zFalQy1h4TqzIawa2FWzlgCOTu5rSh3qfqcGQhNDqln8HUdYXTGIONgEuZn2DP73iWg8pSTg%2Bp9B0cPXi2aC1A9OFwTLi%2F2Lo3f88DtZiSVMyjdoFKim6c9mSGLpOHkB"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
82f9f8796b3419ad-FRA
alt-svc
h3=":443"; ma=86400
content-length
145102
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.captchacom.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 19:33:17 GMT
x-content-type-options
nosniff
age
128027
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 17:03:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Nov 2024 19:33:17 GMT
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.captchacom.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 16:18:30 GMT
x-content-type-options
nosniff
age
139714
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Nov 2024 16:18:30 GMT
fr.json
newassets.hcaptcha.com/captcha/v1/fb33c5c/static/i18n/ 		10 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/fb33c5c/static/i18n/fr.json
Requested by
Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js?hl=fr&onload=loadCaptcha&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0b1a9c3a05ee98a34c24a4e715adf2c341ff4b3c60ab20951952ec4c9c94c3d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:07:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 c813ed55721b9ee3209e2abab7207a00.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
7vB4dfOEeeh4EFN2yn_oBl7HfEMgUEcA
age
2424
x-amz-cf-pop
FRA56-P4
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 29 Nov 2023 16:00:24 GMT
server
cloudflare
etag
W/"c389c602b159fa7e7c5487bd7c831354"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
82f9f879ed076a77-TXL
x-amz-cf-id
42XN2oy1CUCVUZJwsXrTHt0z_cMqcy8VXTw7cGuyKpd1KGsrqtcWzQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wickbot (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| Raven object| hcaptcha function| loadCaptcha function| pass object| grecaptcha

1 Cookies

Domain/Path Name / Value
.clck.ru/ Name: _yasc
Value: E1WRaBM2UJ1qn1xT1M8ReA4fZCGgLLIUzEpmxaxE56tSGXiZ65GDTpTHXdLDdyDv