urlscan.io logo urlscan.io
SecurityTrails logo

wick.hub-app.site Open in urlscan Pro
188.114.96.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u.to/VO42IA
Effective URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUF...
Submission: On January 02 via manual from PL — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 6 domains to perform 10 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is wick.hub-app.site.
TLS certificate: Issued by E1 on December 19th 2023. Valid for: 3 months.
This is the only time wick.hub-app.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wickbot (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 195.216.243.155 57724 (DDOS-GUARD)
1 1 172.67.175.9 13335 (CLOUDFLAR...)
1 188.114.96.3 13335 (CLOUDFLAR...)
6 104.26.6.136 13335 (CLOUDFLAR...)
1 172.217.18.10 15169 (GOOGLE)
2 142.250.186.35 15169 (GOOGLE)
10 4
1    195.216.243.155 (Moscow, Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: s5.uid.me
u.to
1    172.67.175.9 (United States)

ASN13335 (CLOUDFLARENET, US)
redirectionlink.site
1    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
wick.hub-app.site
6    104.26.6.136 (None, )

ASN13335 (CLOUDFLARENET, US)
wickbot.com
1    172.217.18.10 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f10.1e100.net
fonts.googleapis.com
2    142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
6 wickbot.com
wickbot.com
167 KB
2 gstatic.com
fonts.gstatic.com
16 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 115
929 B
1 hub-app.site
wick.hub-app.site
8 KB
1 redirectionlink.site
redirectionlink.site
683 B
1 u.to
u.to — Cisco Umbrella Rank: 614415
480 B
10 6
Domain Requested by
6 wickbot.com wick.hub-app.site
wickbot.com
2 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com wick.hub-app.site
1 wick.hub-app.site
1 redirectionlink.site 1 redirects
1 u.to 1 redirects
10 6

This site contains no links.

Subject Issuer Validity Valid
hub-app.site
E1		 2023-12-19 -
2024-03-18		 3 months crt.sh
wickbot.com
GTS CA 1P5		 2023-12-27 -
2024-03-26		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Frame ID: AB71235CE7786BDFB3EF9822CFF150E1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Wick Verification

Page URL History Show full URLs

  1. https://u.to/VO42IA HTTP 302
    https://redirectionlink.site/verify/?date=1704143516766&hash==0DME1UdstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjV... HTTP 302
    https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0w... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+class=\"[^\"]+\ssvelte-[\w]*\"
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

4
Countries

192 kB
Transfer

348 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u.to/VO42IA HTTP 302
    https://redirectionlink.site/verify/?date=1704143516766&hash==0DME1UdstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW HTTP 302
    https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request verify
wick.hub-app.site/
Redirect Chain
  • https://u.to/VO42IA
  • https://redirectionlink.site/verify/?date=1704143516766&hash==0DME1UdstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
  • https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYx...
29 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
f0e93ba6608f63fc529a56ffc27bf01983212f82f6b07525825bf852773fcaa7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
83ef991eab7b2298-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 02 Jan 2024 02:33:35 GMT
last-modified
Tue, 19 Dec 2023 06:50:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bWDTZFjg%2BIo8LKGwy4vy80fOFyZHInwPry7avkRqbAqBzv7CtL5rqucVTz2oQyW3uvrk9cD5WImzbSVWHdOPc9D6Q9vb5oIrB05W7wSTeXGTKWpV6hde0hqdkkUk%2FRSgs54T0w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
83ef9919d8a02bb5-FRA
content-type
text/html; charset=utf-8
date
Tue, 02 Jan 2024 02:33:35 GMT
location
https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=36%2FXJZ0djvfbsJuijUgjPl8qqZB%2Fy9J5fHQmM4Du1g%2BF4J5VjmD87VIzOGWrsehewZrqt1kovTN%2BCJuWO6lb5Pm3DrbwEkfXkHXqruN5QwNP0On6ZBftDJsApsE14P1CqbOJPFy9Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept
x-powered-by
Express
__layout.svelte-c111369e.css
wickbot.com/_app/immutable/assets/pages/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c28d957009aa0f81bf2ef88788404d4e0cdbb9000cfdea9f8c70b291480d065
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6bCo4AGhF07r09ojuvq%2BCTT5rN6gzjoB7yupGsdOtHKmK6aZuZr2AnZgQxSuKJ8aJ9VcKt1SMO0djQs4N3uBv88BtPhZXqev1%2Frmzn7DDQEbhuIZDFdvl6vKQLVn"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
83ef99233f6c65c8-FRA
alt-svc
h3=":443"; ma=86400
Core.svelte_svelte_type_style_lang-7571463e.css
wickbot.com/_app/immutable/assets/ 		969 B
536 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Core.svelte_svelte_type_style_lang-7571463e.css
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741087342fc87712d8ba412b7a7d858b8742f67f41002347489fce1ec4f6bbce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tsejSM6fAZaSSmpDkuYELLzXpX4RqNJX5wXrVZUUaxjiFvAve2E3d7Fe0Yl8M5dsArSEnXK2h%2BWoFKnaLcuDLBRAUlziaWLPYsg%2FX%2FAAbniYK53LApbuCsLivqVD"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
83ef99233f6d65c8-FRA
alt-svc
h3=":443"; ma=86400
Footer.svelte_svelte_type_style_lang-5a318128.css
wickbot.com/_app/immutable/assets/ 		473 B
475 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/Footer.svelte_svelte_type_style_lang-5a318128.css
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
faedaeda3385bf707055658c72614448ad10993e97724d9fb1ee860d51c97453
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FTMdW1BrKzSkx6NbTHQiXg4goR2GsR12ig%2BqMgTKbort4M613My6uj3VdC9OWfO1kr3jetxJOvshrcPKiPTuw4a6kbehxqKbpui%2FsmRXj6otrK3cnw31LtERBlLK"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
83ef99233f6b65c8-FRA
alt-svc
h3=":443"; ma=86400
stores-31916336.css
wickbot.com/_app/immutable/assets/ 		152 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/stores-31916336.css
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750161db9ec3945dd89dad7044bf80f640803e274500cc182b8946aa885a7627
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FjlS2lse0GNGTbZahXdIrwhXCSbSx8raPrIngkrx4k%2FSm%2BYWa41e0r%2FRQxbpK5EyXjwbCrhYMg%2FlD1A%2FM7QNMzGcG5MM17Vfkj94fGcan2DAWi8eCbmXs5yiIbyG"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
83ef99233f6e65c8-FRA
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		3 KB
929 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.10 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f10.1e100.net
Software
ESF /
Resource Hash
3b6e773a301b7091343b1571224cc02162262e1cca17a7edb02d3c144cd1cd35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 02 Jan 2024 02:33:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 02 Jan 2024 02:33:36 GMT
__error.svelte-49cc1fa9.css
wickbot.com/_app/immutable/assets/pages/ 		927 B
678 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wickbot.com/_app/immutable/assets/pages/__error.svelte-49cc1fa9.css
Requested by
Host: wick.hub-app.site
URL: https://wick.hub-app.site/verify?user_id=1704162815249&hash===QPwQUT1xWVNpmUWRVMWZkUQZFWRZTNVRmWStGV0wWVhBFbXFVWGdVYz4EMUFTRFZ1TohlU2EzaNZkUrR1MOdkVOpFVTVjTHJ2SoZVWzg2RXFGbyQGcstWZyJ1aUZjVsFmTsJjYxxGMhNnSEdVMvFjVoxmbWRnUXF2Msd1U5tWRSBlT6FWVxATTKBnbUNDbGJFUCRlUFVTRlJnUWRFNsVVYQx2VVhlTsJ2SshlW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d3fcd95f428479ffd71abca6b02da07e67e1951cb245b20ffe71d9012f6bf9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wick.hub-app.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WMJb4z%2BXGl9ScCiXt3s4dntojO2QC3aSANodU%2B8DtVaQd8%2F%2BGyLhf7L9eo6lME1lum9x6I%2BeWh1ZbPnrmh5mIxwsXOPh7kNAZQHFTg73HZNdEzksS7%2Bh7cpTmbZb"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
public, immutable, max-age=31536000
x-robots-tag
noindex
cf-ray
83ef99233f6a65c8-FRA
alt-svc
h3=":443"; ma=86400
dash_hero.webp
wickbot.com/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wickbot.com/dash_hero.webp
Requested by
Host: wickbot.com
URL: https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.6.136 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f78f9ca7e452e28f3829110309b90004e46101b4434067ce237ad44aac61c0f1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://wickbot.com/_app/immutable/assets/pages/__layout.svelte-c111369e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 02:33:36 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
113744
etag
"dash_hero.6854a092cb.webp"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T4V3VuCGltakMcJVuYMtI%2Bt%2FN%2FrhvGE2zacgN3YDxSgQE747qyde8NhbJ2bd0zErd4%2F%2FugDsuYFt9Gi84oUO0e0yE24wvVAFki04XdsXW5a%2BkhWdFqCw2Cn3iT09"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
accept-ranges
bytes
cf-ray
83ef9923afbb65c8-FRA
alt-svc
h3=":443"; ma=86400
content-length
145102
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.hub-app.site
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 26 Dec 2023 09:01:31 GMT
x-content-type-options
nosniff
age
581525
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 17:03:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 25 Dec 2024 09:01:31 GMT
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wick.hub-app.site
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Mon, 01 Jan 2024 15:39:51 GMT
x-content-type-options
nosniff
age
39225
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 31 Dec 2024 15:39:51 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wickbot (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Domain/Path Name / Value
.u.to/ Name: lng
Value: pl