urlscan.io logo urlscan.io
SecurityTrails logo

protectcaptchabot.ru Open in urlscan Pro
2606:4700:3031::6815:5718  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ...
Submission: On March 19 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3031::6815:5718, located in United States and belongs to CLOUDFLARENET, US. The main domain is protectcaptchabot.ru.
TLS certificate: Issued by GTS CA 1P5 on March 14th 2024. Valid for: 3 months.
This is the only time protectcaptchabot.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wickbot (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
10 4
Apex Domain
Subdomains		 Transfer
6 wickbot.com
wickbot.com
167 KB
2 gstatic.com
fonts.gstatic.com
16 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110
938 B
1 protectcaptchabot.ru
protectcaptchabot.ru
8 KB
10 4
Domain Requested by
6 wickbot.com protectcaptchabot.ru
wickbot.com
2 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com protectcaptchabot.ru
1 protectcaptchabot.ru
10 4

This site contains no links.

Subject Issuer Validity Valid
protectcaptchabot.ru
GTS CA 1P5		 2024-03-14 -
2024-06-12		 3 months crt.sh
wickbot.com
GTS CA 1P5		 2024-02-24 -
2024-05-24		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2024-02-19 -
2024-05-13		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-02-19 -
2024-05-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Frame ID: 256517CD6F06EE155ED909CBF075D4C0
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Wick Verification

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

192 kB
Transfer

347 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
protectcaptchabot.ru/verify/ 		27 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:5718 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
32bdce558917828bb1b193c1d72a3d7ea454c177993fa9c6a06c119ce20edaaa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
866d3d3dad669259-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 19 Mar 2024 11:49:27 GMT
last-modified
Sun, 25 Feb 2024 23:01:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QV5GybENXxg7vTvqY6Lpf9seAqmA3eIN4SYCjjj7%2BepjOiRYT0nMfQzAWuQq0yxcq%2B9F7hZOdX%2BTGJ4brA94I3E8U2jMqEBfIyfl5M4%2FnK3qXJQ%2F1WbK%2BWaX9vzJkFxhekU0B7X7VqlWE1sD74aK%2FQFCog%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FtdNbiKz61sQ7BM8xhYxH8yuxCGoljkFLDGqMZUj4KbPf3%2FF6rWXjpYOazfdr7lwMVpCvoksVEN%2BpWcHxOHEMGWtQfb%2BZ75ICnQBTVJYXsT9cgdcKAh2A06TxHB4MKYH19hUtGoAH1L%2B"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
866d3d3ec9771c8b-FRA
alt-svc
h3=":443"; ma=86400
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ 		969 B
759 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwN6zBENJ%2BW6PyGUkw3Vnuct62cUhVgJtnegcCtmJebsZYpOCf7xzC6FvdNkKq9sZP7cDwFEGGHo5R2FgwENQrR71F%2FcpJyOj4YeusW3quOgXtidbBk22VwtuYnmbtovNCqoEph8LfkJ"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
866d3d3ec9711c8b-FRA
alt-svc
h3=":443"; ma=86400
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ 		473 B
496 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8SgHgUbyUL3V4Ry2tIQhLjfxyRsot8LQWVCXnnG5arNmz2ZJ%2FYaS8ZwiBn5d0vF1ueo16EX7eqc1gI%2F%2FvXg4wLGCIQZDF9K%2FFC6lxhtvESmz%2Fg6J4am23xj3uIIOetA9o09zsu%2BEMbnt"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
866d3d3ec97a1c8b-FRA
alt-svc
h3=":443"; ma=86400
stores-31916336.css
wickbot.com/_app/immutable/assets/ 		152 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/stores-31916336.css
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aoqx8aItYBH6WbOb4VLjoEJ1yBDORPwq%2BDJDL8Fhc9WIJbs%2BuKwe7RaUwVZCmd%2Bw5Q%2B4ZU7ZYyXpHHVAqK11bRffuy7Yz4JuGWAjCQ11b6WFvh3suqM4X8Iwbm18zuioSc28dmP2B5YK"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
866d3d3ec9791c8b-FRA
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		3 KB
938 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c464ff5f42697643a4a43da0d97e3b055b6ab94f50b2cd99225ee7ae9bbac3c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 19 Mar 2024 09:56:08 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 19 Mar 2024 11:49:27 GMT
__error.svelte-49cc1fa9.css
wickbot.com/_app/immutable/assets/pages/ 		927 B
465 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__error.svelte-49cc1fa9.css
Requested by
Host: protectcaptchabot.ru
URL: https://protectcaptchabot.ru/verify/?date=1710833754415&hash===QP9EFU5UEbaBnVrFWTohkTUFTVkZEcXNlMrBTUqJkbTREeV1kRStGV3VlRW9kQ6lVV5UVZSBnbURTOtFmSw5mV050RjNEaVp1cwBTUNx2VTFXNV5kTwhFV1wWVhBFbXVFWG1mWzVTbXdHcFdVYKp2UEhXVhpWNXNlMrBTVhRGSilkUXF2Msd1U2ETRWBFZYdlNxADZOJlVUZjVFZFUGpXYFFTVOZEcXRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d3fcd95f428479ffd71abca6b02da07e67e1951cb245b20ffe71d9012f6bf9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://protectcaptchabot.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Ha1nQed0IwsNXjgzQxjRTAhuxPefHVWmJXWD6SRFoqTm4izNukRPoCZ0l6aUvso9TvWyUXVBfOzphj91RaLSLEpb%2F5YzjAiAfS%2B6ySXHlxigVU1HHIoScZkXxsTh8sfswxJ4aHB55EL"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
866d3d3ec9761c8b-FRA
alt-svc
h3=":443"; ma=86400
dash_hero.webp
wickbot.com/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wickbot.com/dash_hero.webp
Requested by
Host: wickbot.com
URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:688 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 11:49:27 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
145038
etag
"dash_hero.6854a092cb.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v6D%2BFR6pLAuYABskpE4baZCjQB8Sy%2BOutXp0Ctko0lWWh7wHDkMxRaB46LiBDqgCwUKlMwWKUfNEX98LmNUDCxCxZOBja%2F0IqnBT1D3MCEKUllYWCfK75CowzDsmibIouHUNVESKVM3B"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
866d3d3f29f41c8b-FRA
alt-svc
h3=":443"; ma=86400
content-length
145102
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://protectcaptchabot.ru
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Thu, 14 Mar 2024 14:25:40 GMT
x-content-type-options
nosniff
age
422627
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 17:03:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Mar 2025 14:25:40 GMT
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://protectcaptchabot.ru
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Tue, 19 Mar 2024 07:53:44 GMT
x-content-type-options
nosniff
age
14143
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Mar 2025 07:53:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wickbot (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| isMobile function| pass

0 Cookies