URL: https://wickednwood.image76.com/
Submission Tags: phishingrod
Submission: On August 17 via api from DE — Scanned from IT

Summary

This website contacted 7 IPs in 1 countries across 6 domains to perform 25 HTTP transactions. The main IP is 209.182.202.91, located in United States and belongs to INMOTION, US. The main domain is wickednwood.image76.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 2nd 2024. Valid for: 3 months.
This is the only time wickednwood.image76.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 209.182.202.91 22611 (INMOTION)
1 142.250.185.74 15169 (GOOGLE)
1 192.0.77.32 2635 (AUTOMATTIC)
1 192.0.73.2 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
1 142.250.74.195 15169 (GOOGLE)
25 7
Apex Domain
Subdomains
Transfer
3 wp.com
s0.wp.com — Cisco Umbrella Rank: 11872
stats.wp.com — Cisco Umbrella Rank: 4519
pixel.wp.com — Cisco Umbrella Rank: 4225
6 KB
2 image76.com
wickednwood.image76.com
25 KB
1 gstatic.com
fonts.gstatic.com
35 KB
1 gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 3614
5 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110
1004 B
0 wickednwood.com Failed
wickednwood.com Failed
25 6
Domain Requested by
2 wickednwood.image76.com
1 pixel.wp.com wickednwood.image76.com
1 fonts.gstatic.com fonts.googleapis.com
1 stats.wp.com wickednwood.image76.com
1 secure.gravatar.com wickednwood.image76.com
1 s0.wp.com wickednwood.image76.com
1 fonts.googleapis.com wickednwood.image76.com
0 wickednwood.com Failed wickednwood.image76.com
25 8

This site contains links to these domains. Also see Links.

Domain
wickednwood.com
facebook.com
wordpress.org
www.webmandesign.eu
Subject Issuer Validity Valid
wickednwood.image76.com
cPanel, Inc. Certification Authority
2024-06-02 -
2024-08-31
3 months crt.sh
upload.video.google.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA
2023-11-28 -
2024-12-28
a year crt.sh
*.gravatar.com
Sectigo ECC Domain Validation Secure Server CA
2023-12-05 -
2025-01-04
a year crt.sh
*.gstatic.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wickednwood.image76.com/
Frame ID: 7E09D3DA32AD6C24379EA2A914F3129A
Requests: 25 HTTP requests in this frame

Screenshot

Page Title

Wicked n' wood

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

25
Requests

32 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

7
IPs

1
Countries

72 kB
Transfer

90 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wickednwood.image76.com/
25 KB
25 KB
Document
General
Full URL
https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.202.91 , United States, ASN22611 (INMOTION, US),
Reverse DNS
Software
Apache /
Resource Hash
bbdca251a199a3d7fff3da9f64c5318816a87d555da089017a5e7981c908089f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Sat, 17 Aug 2024 04:55:49 GMT
link
<https://wp.me/6KeaY>; rel=shortlink
server
Apache
x-pingback
https://wickednwood.com/xmlrpc.php
css
fonts.googleapis.com/
4 KB
1004 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Ubuntu%3A400%2C300&subset&ver=1.4.8
Requested by
Host: wickednwood.image76.com
URL: https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f10.1e100.net
Software
ESF /
Resource Hash
aa6bce0b06c78609bb5715f4df3e86a37cc40d35f2cfaa2dc0bae6d2eab65736
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 17 Aug 2024 04:55:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 17 Aug 2024 04:55:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 17 Aug 2024 04:55:51 GMT
genericons.css
wickednwood.com/wp-content/themes/auberge/genericons/
0
0

starter.css
wickednwood.com/wp-content/themes/auberge/css/
0
0

style.css
wickednwood.com/wp-content/themes/auberge/
0
0

colors.css
wickednwood.com/wp-content/themes/auberge/css/
0
0

jetpack.css
wickednwood.com/wp-content/plugins/jetpack/css/
0
0

jquery.js
wickednwood.com/wp-includes/js/jquery/
0
0

jquery-migrate.min.js
wickednwood.com/wp-includes/js/jquery/
0
0

wnw-web-header2.jpg
wickednwood.com/wp-content/uploads/2015/10/
0
0

jquery.cycle.js
wickednwood.com/wp-content/plugins/jetpack/modules/shortcodes/js/
0
0

slideshow-shortcode.js
wickednwood.com/wp-content/plugins/jetpack/modules/shortcodes/js/
0
0

devicepx-jetpack.js
s0.wp.com/wp-content/js/
8 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=202433
Requested by
Host: wickednwood.image76.com
URL: https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
e93e9f28c6e8c3ed7f642e1a7a67a4a294ffabbc49909ae5d8bbaa48238ba3e9

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-minify-cache
hit
date
Sat, 17 Aug 2024 04:55:52 GMT
content-encoding
br
x-ac
4.mxp _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT mxp 1
server
nginx
etag
W/21174-1684461116036.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Tue, 12 Aug 2025 00:00:00 GMT
gprofiles.js
secure.gravatar.com/js/
13 KB
5 KB
Script
General
Full URL
https://secure.gravatar.com/js/gprofiles.js?ver=2024Augaa
Requested by
Host: wickednwood.image76.com
URL: https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b46853b388ab997de6bfa04c1e397b91783aa2d3e125eb7f62b2f41b95dd5e57
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 04:55:52 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
last-modified
Tue, 02 Jul 2024 12:40:50 GMT
server
nginx
etag
W/"6683f552-3317"
content-type
application/javascript
cache-control
max-age=604800
alt-svc
h3=":443"; ma=86400
expires
Sat, 24 Aug 2024 04:55:52 GMT
wpgroho.js
wickednwood.com/wp-content/plugins/jetpack/modules/
0
0

masonry.min.js
wickednwood.com/wp-includes/js/
0
0

jquery.masonry.min.js
wickednwood.com/wp-includes/js/jquery/
0
0

imagesloaded.pkgd.min.js
wickednwood.com/wp-content/themes/auberge/js/
0
0

scripts-navigation.js
wickednwood.com/wp-content/themes/auberge/js/
0
0

scripts-global.js
wickednwood.com/wp-content/themes/auberge/js/
0
0

skip-link-focus-fix.js
wickednwood.com/wp-content/themes/auberge/js/
0
0

e-202433.js
stats.wp.com/
7 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202433.js
Requested by
Host: wickednwood.image76.com
URL: https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT mxp
date
Sat, 17 Aug 2024 04:55:52 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/14421-1717166114261.106
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
alt-svc
h3=":443"; ma=86400
expires
Mon, 11 Aug 2025 12:44:44 GMT
4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v20/
34 KB
35 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu%3A400%2C300&subset&ver=1.4.8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f3.1e100.net
Software
sffe /
Resource Hash
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wickednwood.image76.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 13 Aug 2024 14:09:39 GMT
x-content-type-options
nosniff
age
312374
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
34852
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:31:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 13 Aug 2025 14:09:39 GMT
g.gif
pixel.wp.com/
50 B
177 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A3.7&blog=99675600&post=0&tz=0&srv=wickednwood.com&host=wickednwood.image76.com&ref=&fcp=4391&rand=0.14790979633711832
Requested by
Host: wickednwood.image76.com
URL: https://wickednwood.image76.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 17 Aug 2024 04:55:54 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
favicon.ico
wickednwood.image76.com/
0
76 B
Other
General
Full URL
https://wickednwood.image76.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.182.202.91 , United States, ASN22611 (INMOTION, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wickednwood.image76.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 04:55:55 GMT
server
Apache
content-length
0
content-type
image/vnd.microsoft.icon

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/genericons/genericons.css?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/css/starter.css?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/style.css?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/css/colors.css?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/plugins/jetpack/css/jetpack.css?ver=3.7
Domain
wickednwood.com
URL
https://wickednwood.com/wp-includes/js/jquery/jquery.js?ver=1.11.3
Domain
wickednwood.com
URL
https://wickednwood.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/uploads/2015/10/wnw-web-header2.jpg
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/plugins/jetpack/modules/shortcodes/js/jquery.cycle.js?ver=2.9999.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/plugins/jetpack/modules/shortcodes/js/slideshow-shortcode.js?ver=20121214.1
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=4.3.26
Domain
wickednwood.com
URL
https://wickednwood.com/wp-includes/js/masonry.min.js?ver=3.1.2
Domain
wickednwood.com
URL
https://wickednwood.com/wp-includes/js/jquery/jquery.masonry.min.js?ver=3.1.2
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/js/imagesloaded.pkgd.min.js?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/js/scripts-navigation.js?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/js/scripts-global.js?ver=1.4.8
Domain
wickednwood.com
URL
https://wickednwood.com/wp-content/themes/auberge/js/skip-link-focus-fix.js?ver=1.4.8

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings object| jetpackSlideshowSettings object| wpcom_img_zoomer object| detectZoom object| Gravatar object| WPGroHo object| $scriptsInline object| _stq function| st_go function| linktracker_init object| wpcom

1 Cookies

Domain/Path Name / Value
.wickednwood.com/ Name: __cf_bm
Value: Ec_fl5Lk2qqRWRayKIT3b_T3lnLJTzDGkclin8EXB7A-1723870552-1.0.1.1-5eRUHulofqtmLZqTDAV.Pm.KlvTjm3kiWG1eIkGgC08kyx67K42cz4bKe7Yo.xov1v_egSsxEPt9WF3uD0Arfw