urlscan.io logo urlscan.io
SecurityTrails logo

wick.captchacom.site Open in urlscan Pro
2606:4700:3030::6815:40b6  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://clck.ru/36tUg2
Effective URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1...
Submission: On December 03 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 8 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3030::6815:40b6, located in United States and belongs to CLOUDFLARENET, US. The main domain is wick.captchacom.site.
TLS certificate: Issued by GTS CA 1P5 on November 27th 2023. Valid for: 3 months.
This is the only time wick.captchacom.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wickbot (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2a02:6b8::221 208722 (GLOBAL_DC)
1 1 2a02:6b8::232 208722 (GLOBAL_DC)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
2 104.19.218.90 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
12 5
1    2a02:6b8::221 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)
clck.ru
1    2a02:6b8::232 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)
sba.yandex.ru
1    2606:4700:3033::ac43:87a1 (United States)

ASN13335 (CLOUDFLARENET, US)
verify.url-shortnest.space
1    2606:4700:3030::6815:40b6 (United States)

ASN13335 (CLOUDFLARENET, US)
wick.captchacom.site
6    2606:4700:20::ac43:48d0 (United States)

ASN13335 (CLOUDFLARENET, US)
wickbot.com
2    104.19.218.90 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hcaptcha.com
newassets.hcaptcha.com
1    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
6 wickbot.com
wickbot.com
167 KB
2 gstatic.com
fonts.gstatic.com
16 KB
2 hcaptcha.com
js.hcaptcha.com — Cisco Umbrella Rank: 9944
newassets.hcaptcha.com — Cisco Umbrella Rank: 9853
96 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
929 B
1 captchacom.site
wick.captchacom.site
8 KB
1 url-shortnest.space
verify.url-shortnest.space
593 B
1 yandex.ru
sba.yandex.ru — Cisco Umbrella Rank: 339188
370 B
1 clck.ru
clck.ru — Cisco Umbrella Rank: 292101
918 B
12 8
Domain Requested by
6 wickbot.com wick.captchacom.site
wickbot.com
2 fonts.gstatic.com fonts.googleapis.com
1 newassets.hcaptcha.com js.hcaptcha.com
1 fonts.googleapis.com wick.captchacom.site
1 js.hcaptcha.com wick.captchacom.site
1 wick.captchacom.site
1 verify.url-shortnest.space 1 redirects
1 sba.yandex.ru 1 redirects
1 clck.ru 1 redirects
12 9

This site contains no links.

Subject Issuer Validity Valid
captchacom.site
GTS CA 1P5		 2023-11-27 -
2024-02-25		 3 months crt.sh
wickbot.com
GTS CA 1P5		 2023-10-29 -
2024-01-27		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-15 -
2024-04-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Frame ID: 3667893742C1E3BDB030F3E371D4A97F
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Wick Verification

Page URL History Show full URLs

  1. https://clck.ru/36tUg2 HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3De... HTTP 302
    https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9 HTTP 302
    https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEs... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

88 %
IPv6

8
Domains

9
Subdomains

5
IPs

4
Countries

288 kB
Transfer

683 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clck.ru/36tUg2 HTTP 302
    https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3DeyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9&client=clck&request_id=1701587520325932-1079426981467323961&sign=d8e817cf8b40efec4fab3b9f2239ec6d HTTP 302
    https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9 HTTP 302
    https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request verify
wick.captchacom.site/
Redirect Chain
  • https://clck.ru/36tUg2
  • https://sba.yandex.ru/redirect?url=https%3A%2F%2Fverify.url-shortnest.space%2Fverify%2F%3Fhash%3DeyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9&client=clck&request_id=170158752032...
  • https://verify.url-shortnest.space/verify/?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTF9
  • https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
29 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:40b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
9161f44a677ba49b6fa7131aabbc9b115db5097d1a6c6609a973685792e9c90e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
82f9ffb53d60bbeb-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 03 Dec 2023 07:12:00 GMT
last-modified
Sat, 02 Dec 2023 02:32:09 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BoPONGypfa9wg7lGITyD73JxIjjGZNGbfTffBDRIi5j8S94hBHMGEuRVG%2BmT%2B0e74Z3KVxwNhbwjBeseMIvPDtl7%2Fcz679dgucwuHNxnldclEUWEMxG7qqplzRG9teZdBv4ZovgDmHlDTe8ZAG0H53Sl4A%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82f9ffb44f592bf1-FRA
content-type
text/html; charset=utf-8
date
Sun, 03 Dec 2023 07:12:00 GMT
location
https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GTkmXLAnn62KiyaUB8IvnZofbLlyCHI9%2BcANl4Dmc8hWtfyMmAasNAshoBqrATBXwgIq2QHxtsO2Q97oS9NE2YAdHMXsbot1bFK4%2B4LjCa43u3uwLhtE1AYXW3GrAG9102IetCPZKnHZ%2B4QluxaVZhfsksg705RfUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept
x-powered-by
Express
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xluhJEWegb2KlzfK63XCeWV3FL3D8s5q4vqAbj9QV15dwuGGTQDBAgiCCRmKVnK8G%2FP4zV9UlHfnua5f0rhSDZzd7FEtcw%2FuPfOgnLjMEkL6Qz9Aem4HT%2Fu%2BmGu2YcrkOEJHjMDAgSis"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9ffb6491890fe-FRA
alt-svc
h3=":443"; ma=86400
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ 		969 B
545 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15WfqDcMjnsFqguF%2FU8sWgRbVWwMtTIL8PdP7gPL1Nv8Wqe1IZWHygqdQGNC9qFl%2FoCKfCmRrv2aUIfF3mrWI0BMmFSZ9coz9C09aYrgx41U0XoxGthONdPyVuHUyyvr0b5OOviNCx2n"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9ffb6491a90fe-FRA
alt-svc
h3=":443"; ma=86400
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ 		473 B
715 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KRbZ2iGh%2FlT1Yuy1UlZb7asCQ7m8Cdb5An1oyEKFnbXfNzYIlNu0zG407ECtzG5VXyFCoSsGe%2FmP67TCaTchUz04lf9ksWr2WwkipB4qvPFWH6vfPdxG49cwry9NjdWRJ1OMYSlq6R%2F%2F"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9ffb6491990fe-FRA
alt-svc
h3=":443"; ma=86400
stores-31916336.css
wickbot.com/_app/immutable/assets/ 		152 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/stores-31916336.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ZRUpCr6%2BroEvE0Lpj0GpKganFuyKiLeVWjXLnGoZNndrkeHiyAcgXo7XkOWXlJcb%2BnWKRWo66MRLQAdtPQulJYYSyJuWtsKoiYYLWEnMGv%2BCfJp13%2B%2FnKVH8y7oQuB6rsZOzad2wuuY"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9ffb6491c90fe-FRA
alt-svc
h3=":443"; ma=86400
api.js
js.hcaptcha.com/1/ 		325 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hcaptcha.com/1/api.js?hl=fr&onload=loadCaptcha&render=explicit
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
021a73545e39b15848f5027cdc9bc78b78641fcb66c33bb0c50a14b430c50479
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 34fdfb7c7c11559df7e622af2b62f5ca.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
5R.cD6enL2w3aksUxVbBtDhRU.J.y.sj
age
0
x-amz-cf-pop
FRA56-P4
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 29 Nov 2023 16:00:24 GMT
server
cloudflare
etag
W/"e384453ae4e919ae0cdfb219d73036d4"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
cf-ray
82f9ffb65f89694b-FRA
x-amz-cf-id
W8AMUkeeCE1Z6kAiXSuan55sdIXEA8Vg8hyMGCMgI92aTzbUMLJumg==
css2
fonts.googleapis.com/ 		3 KB
929 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sun, 03 Dec 2023 07:12:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 03 Dec 2023 07:05:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 03 Dec 2023 07:12:00 GMT
__error.svelte-49cc1fa9.css
wickbot.com/_app/immutable/assets/pages/ 		927 B
469 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__error.svelte-49cc1fa9.css
Requested by
Host: wick.captchacom.site
URL: https://wick.captchacom.site/verify?hash=eyJnSWQiOiIxMTgwMDg2NjExODU0MjQxNzkyIiwidmVyaWZ5X2lkIjo5NDI2NTEsImV4cGlyZXMiOjE3MDE1ODc2OTU1OTksImlwIjoiMmEwMTo0YTA6MmI6OjcifQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d3fcd95f428479ffd71abca6b02da07e67e1951cb245b20ffe71d9012f6bf9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gn8eulhm%2FdeAv8%2F8B4Jx6Gqa9rLunJr%2FsIkGAx31oGqgL2RtV9%2BPGdJBx06iCbCES8GSkYVr5qTVn9J6uxHMFIZ9r2x5W6bvqTMYhotHifZ00fF%2F9HMwl3Gsvz0Wmyek55rPwoF%2BTT5s"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
82f9ffb6491d90fe-FRA
alt-svc
h3=":443"; ma=86400
dash_hero.webp
wickbot.com/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wickbot.com/dash_hero.webp
Requested by
Host: wickbot.com
URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48d0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
94801
etag
"dash_hero.6854a092cb.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W31Z1UfWwo3yru%2FwQvM0T5e1fmfrRMhw0lg14%2BwRshtklN9pdB%2FL6ozqVB27U9jkTUO4rLafGLkTuVTDRsfa4wJJS%2FfrnjdoK%2Bk6Yu7X4Z2Akh06eQLQW8dw7P3lDAG9jQIKqfk%2FdPbh"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
82f9ffb6b95a90fe-FRA
alt-svc
h3=":443"; ma=86400
content-length
145102
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.captchacom.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 19:33:17 GMT
x-content-type-options
nosniff
age
128324
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 17:03:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Nov 2024 19:33:17 GMT
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.captchacom.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 16:18:30 GMT
x-content-type-options
nosniff
age
140011
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Nov 2024 16:18:30 GMT
fr.json
newassets.hcaptcha.com/captcha/v1/fb33c5c/static/i18n/ 		10 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/fb33c5c/static/i18n/fr.json
Requested by
Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js?hl=fr&onload=loadCaptcha&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0b1a9c3a05ee98a34c24a4e715adf2c341ff4b3c60ab20951952ec4c9c94c3d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wick.captchacom.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 07:12:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 7cbec639ed3557aac04425ec5a5f177a.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
7vB4dfOEeeh4EFN2yn_oBl7HfEMgUEcA
age
83
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 29 Nov 2023 16:00:24 GMT
server
cloudflare
etag
W/"c389c602b159fa7e7c5487bd7c831354"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
82f9ffb6ea2330c3-FRA
x-amz-cf-id
2-b460GtqxUSS_oICQZR7M784yf7scXMQ7AZv38KsbmxTezd0ZDOvA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wickbot (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| Raven object| hcaptcha function| loadCaptcha function| pass object| grecaptcha

1 Cookies

Domain/Path Name / Value
.clck.ru/ Name: _yasc
Value: IzxFPd1HwX9F6uw9fuVbYuZfTWgJnwMrN+Lu88npWjOILw8oWK6UbprXSY6FNUZMwA==