botwick.site
Open in
urlscan Pro
2a00:f940:2:2:1:1:0:161
Malicious Activity!
Public Scan
Effective URL: https://botwick.site/qr/
Submission: On June 01 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 1st 2023. Valid for: 3 months.
This is the only time botwick.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Discord (Instant Messenger) Wickbot (Online)Live information
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2a00:f940:2:2... 2a00:f940:2:2:1:1:0:161 | 197695 (AS-REG) (AS-REG) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 2606:4700:20:... 2606:4700:20::681a:788 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:800::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 34.149.204.188 34.149.204.188 | 15169 (GOOGLE) (GOOGLE) | |
19 | 7 |
ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com
aquamarinelonelysecurity.avdeevandrey12.repl.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
wickbot.com
wickbot.com |
288 KB |
3 |
botwick.site
botwick.site |
82 KB |
2 |
repl.co
aquamarinelonelysecurity.avdeevandrey12.repl.co |
426 B |
2 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 249 |
7 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 66 |
929 B |
19 | 6 |
Domain | Requested by | |
---|---|---|
10 | wickbot.com |
botwick.site
wickbot.com |
3 | botwick.site |
botwick.site
|
2 | aquamarinelonelysecurity.avdeevandrey12.repl.co |
botwick.site
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | cdnjs.cloudflare.com |
botwick.site
|
1 | fonts.googleapis.com |
botwick.site
|
19 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
dashboard.wickbot.com |
old.wickbot.com |
discord.com |
docs.wick.bot |
Subject Issuer | Validity | Valid | |
---|---|---|---|
botwick.site R3 |
2023-06-01 - 2023-08-30 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
wickbot.com GTS CA 1P5 |
2023-05-05 - 2023-08-03 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
avdeevandrey12.repl.co GTS CA 1P5 |
2023-06-01 - 2023-08-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://botwick.site/qr/
Frame ID: 23CD82EA002D125DC2C34EF6DCCE84D2
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Wick Bot - VerificationDiamondDetected technologies
Svelte (JavaScript frameworks) ExpandDetected patterns
- <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: New Dashboard
Search URL Search Domain Scan URL
Title: Old Dashboard
Search URL Search Domain Scan URL
Title: Invite
Search URL Search Domain Scan URL
Title: Documentation
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
botwick.site/qr/ |
83 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 929 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ |
969 B 540 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ |
473 B 496 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stores-31916336.css
wickbot.com/_app/immutable/assets/ |
152 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.svelte_svelte_type_style_lang-9f398910.css
wickbot.com/_app/immutable/assets/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ExtraFeatures-ef88e16b.css
wickbot.com/_app/immutable/assets/ |
12 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Reviews2-8838cbd4.css
wickbot.com/_app/immutable/assets/ |
121 B 597 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Invite-595352ac.css
wickbot.com/_app/immutable/assets/ |
392 B 435 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
botwick.site/qr/ |
66 KB 66 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qrcode.min.js
cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dash_hero.webp
wickbot.com/ |
142 KB 142 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dash_hero_light.webp
wickbot.com/ |
117 KB 117 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
n
aquamarinelonelysecurity.avdeevandrey12.repl.co/ |
60 B 318 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discord.png
botwick.site/qr/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
t
aquamarinelonelysecurity.avdeevandrey12.repl.co/ |
1 B 108 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Discord (Instant Messenger) Wickbot (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| _0x42d60a function| _0x16b4 function| _0x26cb function| QRCode function| _0xa321 function| _0x34560 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aquamarinelonelysecurity.avdeevandrey12.repl.co
botwick.site
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
wickbot.com
2606:4700:20::681a:788
2606:4700::6811:180e
2a00:1450:4001:800::2003
2a00:1450:4001:80b::200a
2a00:f940:2:2:1:1:0:161
34.149.204.188
1375f5ac03edd5887033d6c68ceb3531288fd7b0dde6e2e701d7a9c1c7d6e384
1827e9d30f9e24480d9f61158b1a701def6d07f814858109aedb8f48b9d2fd28
1c1c7dbbcbb6a0a005201cd7658a890077843370ba1668fa3408067863a7c590
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
3d4e378ec542de71aca8b47e89bd7d61bb968e3b283949087a7b5463a8f1ea6a
3f944feac78b8943d31c4e6d3bcb8ddf1ff4cb356b2283f09ff83a0c472d564f
468231c9ab589dba18f5101d6a968abe7f38b7aa13ef22b4a4aa7a1f6c7bfb67
4a711f5cd03c09fd79ae2f19bb2f71168e71c18b7562626a1ae8d99ebc3212ff
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dffe8bac6fef49b373b7574d593b5b49f6f9b3f1103ce5b5a286a75e37dcfb9
860b65cfe764f1a01af4cb9113cb299394746d4b55af81cc3c08e7b23808983b
a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b
ac55513bcd5f567f5295d358dc02e6c103d23bb8dfdd84d47039c683db11219d
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453