wickbot.online
Open in
urlscan Pro
2606:4700:3032::ac43:c05a
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On April 17 via api from FI — Scanned from FI
Summary
This is the only time wickbot.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wickbot (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700:303... 2606:4700:3032::ac43:c05a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 2606:4700:20:... 2606:4700:20::681a:688 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
17 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
wickbot.com
wickbot.com |
288 KB |
4 |
wickbot.online
wickbot.online |
2 MB |
2 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39 |
910 B |
17 | 4 |
Domain | Requested by | |
---|---|---|
10 | wickbot.com |
wickbot.online
wickbot.com |
4 | wickbot.online |
wickbot.online
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
wickbot.online
|
17 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
dashboard.wickbot.com |
old.wickbot.com |
discord.com |
docs.wick.bot |
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.wickbot.com GTS CA 1P5 |
2023-03-07 - 2023-06-05 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://wickbot.online/
Frame ID: A99BD42B58CEDF26868C6B651445E373
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Wick Bot - VerificationDiamondDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: New Dashboard
Search URL Search Domain Scan URL
Title: Old Dashboard
Search URL Search Domain Scan URL
Title: Invite
Search URL Search Domain Scan URL
Title: Documentation
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
wickbot.online/ |
86 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 910 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ |
969 B 546 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ |
473 B 486 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stores-31916336.css
wickbot.com/_app/immutable/assets/ |
152 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.svelte_svelte_type_style_lang-9f398910.css
wickbot.com/_app/immutable/assets/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ExtraFeatures-ef88e16b.css
wickbot.com/_app/immutable/assets/ |
12 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Reviews2-8838cbd4.css
wickbot.com/_app/immutable/assets/ |
121 B 374 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Invite-595352ac.css
wickbot.com/_app/immutable/assets/ |
392 B 440 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.gif
wickbot.online/ |
417 KB 417 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.gif
wickbot.online/ |
5 MB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.gif
wickbot.online/ |
1 MB 1 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dash_hero.webp
wickbot.com/ |
142 KB 142 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dash_hero_light.webp
wickbot.com/ |
117 KB 117 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wickbot (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
wickbot.com
wickbot.online
2606:4700:20::681a:688
2606:4700:3032::ac43:c05a
2a00:1450:4001:80b::2003
2a00:1450:4001:828::200a
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
4dd5e623d0b1b4d2dac6312893651aa01bbfdc27e051cae5641a07ad56f07e6b
5a6f4d8b1a092514eb5206e66c9e448c21bac56e146f511c196d3d04f5a4449e
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
ce0895e7b0c4996611c00ab6814303d3e2e7996d858acdfae3ec0d9f3b8ba90a
f18f620beb48d2fad6e3f77748e2de9342a2d287a14b67fccb226cc824bc1862
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453