nexilogin.94-156-6-119.cprapid.com Open in urlscan Pro
94.156.6.119 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://nexilogin.94-156-6-119.cprapid.com/
Submission Tags: @ecarlesi threat #phishing #nexipayments Search All
Submission: On October 18 via api (October 18th 2023, 12:40:47 pm UTC) from FR — Scanned from FR

Summary HTTP 45 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 13 IPs in 5 countries across 13 domains to perform 45 HTTP transactions. The main IP is 94.156.6.119, located in Amsterdam, Netherlands and belongs to AS_DELIS, US. The main domain is nexilogin.94-156-6-119.cprapid.com.

This is the only time nexilogin.94-156-6-119.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	94.156.6.119 94.156.6.119	211252 (AS_DELIS) (AS_DELIS)
1	2a02:26f0:480... 2a02:26f0:480:99e::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
13	185.198.118.126 185.198.118.126	35051 (NEXI-AS) (NEXI-AS)
4	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	52.17.168.91 52.17.168.91	16509 (AMAZON-02) (AMAZON-02)
1 1	52.212.121.189 52.212.121.189	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	63.33.121.220 63.33.121.220	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7c60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	66.235.152.113 66.235.152.113	16509 (AMAZON-02) (AMAZON-02)
45	13

1 94.156.6.119 (Amsterdam, Netherlands)

ASN211252 (AS_DELIS, US)

nexilogin.94-156-6-119.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:99e::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 185.198.118.126 (Italy)

ASN35051 (NEXI-AS, IT)

www.nexi.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.168.91 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-168-91.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.121.189 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-121-189.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.121.220 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-121-220.eu-west-1.compute.amazonaws.com

nexipayments.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7c60 (United States)

ASN13335 (CLOUDFLARENET, US)

www.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-113.data.adobedc.net

nexipayments.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	nexi.it www.nexi.it	3 MB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	261 KB
3	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2250	338 B
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 242 nexipayments.demdex.net	5 KB
1	omtrdc.net nexipayments.tt.omtrdc.net	1 KB
1	cloudflare.com www.cloudflare.com — Cisco Umbrella Rank: 6224	458 B
1	gstatic.com www.gstatic.com	186 KB
1	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108	455 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1318	517 B
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 468	70 KB
1	cprapid.com nexilogin.94-156-6-119.cprapid.com	9 MB
0	Failed function sub() { [native code] }. Failed
45	13

	Domain	Requested by
13	www.nexi.it	nexilogin.94-156-6-119.cprapid.com www.nexi.it
4	www.googletagmanager.com	nexilogin.94-156-6-119.cprapid.com www.googletagmanager.com
3	region1.google-analytics.com	www.googletagmanager.com
2	dpm.demdex.net	assets.adobedtm.com nexilogin.94-156-6-119.cprapid.com
1	nexipayments.tt.omtrdc.net	assets.adobedtm.com
1	www.cloudflare.com	www.nexi.it
1	www.gstatic.com	www.google.com
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	nexipayments.demdex.net	assets.adobedtm.com
1	www.google.com	nexilogin.94-156-6-119.cprapid.com
1	cm.everesttech.net	1 redirects
1	assets.adobedtm.com	nexilogin.94-156-6-119.cprapid.com
1	nexilogin.94-156-6-119.cprapid.com
0	www.nexi.ithttps Failed	nexilogin.94-156-6-119.cprapid.com
45	14

This site contains links to these domains. Also see Links.

Domain
policies.google.com
www.hotjar.com
www.adobe.com
site.adform.com
it-it.facebook.com
www.amazon.it
twitter.com
www.criteo.com
fanplayr.com
privacy.microsoft.com
vault.pactsafe.io
www.salesforce.com
www.webgains.com
www.awin.com
performoney.it
www.quantcast.com
beintoo.com
legal.yahoo.com
privacy.italiaonline.it
support.microsoft.com
support.mozilla.org
support.google.com
support.apple.com
apps.apple.com
play.google.com
appgallery.huawei.com
privati.nexi.it
www.nexi.it

Subject Issuer	Validity	Valid
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
www.nexi.it GlobalSign RSA OV SSL CA 2018	`2023-08-04` - `2024-08-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-28` - `2023-12-21`	3 months	crt.sh
www.cloudflare.com GTS CA 1P5	`2023-09-19` - `2023-12-18`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://nexilogin.94-156-6-119.cprapid.com/
Frame ID: 07CBA914B7BD9D9626B5DAB2F2491A6D
Requests: 43 HTTP requests in this frame

Frame: https://nexipayments.demdex.net/dest5.html?d_nsid=0
Frame ID: 528BE5BE57D6C58FC7F823AA10DFCD74
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Area Personaleicon/white/frecciaicon/white/freccia

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

45
Requests

60 %
HTTPS

54 %
IPv6

13
Domains

14
Subdomains

13
IPs

5
Countries

12588 kB
Transfer

13997 kB
Size

9
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Google-analytics.com

Search URL Search Domain Scan URL

URL: https://www.hotjar.com/privacy
Title: Hotjar.com

Search URL Search Domain Scan URL

URL: https://www.adobe.com/it/privacy/policy.html
Title: Adobe.target

Search URL Search Domain Scan URL

URL: https://site.adform.com/privacy-center/overview
Title: Track.adform.net

Search URL Search Domain Scan URL

URL: https://policies.google.com/technologies/ads
Title: Doubleclick.net

Search URL Search Domain Scan URL

URL: https://it-it.facebook.com/about/privacy/cookies
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.amazon.it/adprefs
Title: Amazon-adsystem.com

Search URL Search Domain Scan URL

URL: https://twitter.com/en/privacy
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.criteo.com/it/privacy/
Title: Criteo.com

Search URL Search Domain Scan URL

URL: https://fanplayr.com/legal/
Title: Fanplayr

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/it-it/privacystatement
Title: BingAds

Search URL Search Domain Scan URL

URL: https://vault.pactsafe.io/s/9ac72792-c7df-4d0d-832d-0ca873f73a64/privacy#privacy-policy
Title: Zemanta

Search URL Search Domain Scan URL

URL: https://www.salesforce.com/company/privacy/
Title: Salesforce

Search URL Search Domain Scan URL

URL: https://www.webgains.com/public/en/privacy-2/
Title: Webgains

Search URL Search Domain Scan URL

URL: https://www.awin.com/it/privacy
Title: Awin

Search URL Search Domain Scan URL

URL: https://performoney.it/cookie-policy-di-performoney-it/
Title: Performoney

Search URL Search Domain Scan URL

URL: https://www.quantcast.com/privacy/
Title: Quantcast

Search URL Search Domain Scan URL

URL: https://beintoo.com/privacy-cookie-policy
Title: Beintoo

Search URL Search Domain Scan URL

URL: https://legal.yahoo.com/ie/it/yahoo/privacy/cookies/index.html
Title: Verizon

Search URL Search Domain Scan URL

URL: http://privacy.italiaonline.it/common/cookie/privacy_tal.php
Title: Italiaonline

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/topic/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d
Title: Internet Explorer

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09#:~:text=Open%20Microsoft%20Edge%20and%20select%20Settings%20and%20more,Delete%20cookies%20every%20time%20you%20close%20the%20browser
Title: Edge

Search URL Search Domain Scan URL

URL: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US
Title: Firefox

Search URL Search Domain Scan URL

URL: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en-GB
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://support.apple.com/en-gb/HT201265
Title: Safari

Search URL Search Domain Scan URL

URL: https://apps.apple.com/it/app/nexi-pay/id518695175

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=it.icbpi.mobile&hl=it

Search URL Search Domain Scan URL

URL: https://appgallery.huawei.com/#/app/C101454369

Search URL Search Domain Scan URL

URL: https://privati.nexi.it/registration/intro
Title: REGISTRATI

Search URL Search Domain Scan URL

URL: https://www.nexi.it/content/dam/nexi/new-login-2019/informativa_privacy.pdf
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://cm.everesttech.net/cm/dd?d_uuid=29666533439834855130038382096916770502 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn

45 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request /
nexilogin.94-156-6-119.cprapid.com/ 9 MB
9 MB 133ms
38ms Document
text/html 94.156.6.119
AS_DELIS

General

Check archive.org

Show headers Download Go to

Full URL: http://nexilogin.94-156-6-119.cprapid.com/
Protocol: HTTP/1.1
Server: 94.156.6.119 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 9547564
Content-Type: text/html
Date: Wed, 18 Oct 2023 12:40:37 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Wed, 18 Oct 2023 08:04:33 GMT
Server: Apache

GET
H2 200 launch-a40afd213c32.min.js Show response
assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/ 219 KB
70 KB 133ms
44ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/launch-a40afd213c32.min.js
Requested by: Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 967861a54f0da10aabb1884796ec0215b93105794f34ed0badb55d39b18b155e

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:37 GMT
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 09:10:47 GMT
server: AkamaiNetStorage
etag: "7af4cf19af5f30b4bd5b53233801ad0c:1665738647.336069"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: http://nexilogin.94-156-6-119.cprapid.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 71870
expires: Wed, 18 Oct 2023 13:40:37 GMT

GET
H/1.1 200
OK style.css
www.nexi.it/etc/designs/nexi/clientlib-node/ 568 KB
135 KB 691ms
430ms Stylesheet
text/css 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nexi.it/etc/designs/nexi/clientlib-node/style.css

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

23ad197def9f4c983e658350fb1788aa32894df43eec7fa5d6ade80bc30cfdda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Content-Encoding: gzip
Last-Modified: Mon, 31 Jul 2023 08:05:49 GMT
ETag: "8dfd4-601c3e609f094"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: text/css
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=85

GET
H/1.1 200
OK jquery-3.5.1.min.js Show response
www.nexi.it/etc/designs/icbpi-common/libs/ 87 KB
88 KB 365ms
103ms Script
application/javascript 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nexi.it/etc/designs/icbpi-common/libs/jquery-3.5.1.min.js

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:04:37 GMT
ETag: "15d84-601c3e1bdc404"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/javascript
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=78

GET
H/1.1 200
OK logo--light-double.svg
www.nexi.it/content/dam/nexi/new-login-2019/loghi/ 1 KB
2 KB 395ms
133ms Image
image/svg+xml 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/loghi/logo--light-double.svg

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Sat, 12 Aug 2023 10:29:13 GMT
ETag: "5c4-602b74cf88948"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/svg+xml
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=51
Content-Length: 1476

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 350 KB
101 KB 282ms
85ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVCHKSD

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ed17ab0f8ecf3bb8f873fcd1bb29f574190d36368c8bbd7809804bdc295491ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103278
x-xss-protection: 0
last-modified: Wed, 18 Oct 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 18 Oct 2023 12:40:37 GMT

GET
H/1.1 200
OK app_store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 15 KB
16 KB 408ms
133ms Image
image/svg+xml 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/icons/app_store.svg

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:04:15 GMT
ETag: "3dc8-601c3e06f9d0d"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/svg+xml
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=77
Content-Length: 15816

GET
H/1.1 200
OK google_play.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 25 KB
26 KB 41ms
41ms Image
image/svg+xml 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/icons/google_play.svg

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:04:16 GMT
ETag: "62ff-601c3e07171db"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/svg+xml
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=49

GET
H/1.1 200
OK huawei-store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 22 KB
22 KB 103ms
103ms Image
image/svg+xml 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/icons/huawei-store.svg

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:04:17 GMT
ETag: "5675-601c3e085dc5d"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/svg+xml
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=77

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 371 B
1 KB 396ms
42ms XHR
application/json 52.17.168.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=6A724E255ED5F2A60A495E0E%40AdobeOrg&d_nsid=0&ts=1697632837281

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/launch-a40afd213c32.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.168.91 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-168-91.eu-west-1.compute.amazonaws.com

Software

Resource Hash

9aa959d19ca80b176a67882d4d0e93bf43755c11ff883256e808e37eec3dff18

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://nexilogin.94-156-6-119.cprapid.com/
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v052-040c0227e.edge-irl1.demdex.com 9 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: R03rkWSQTCQ=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: http://nexilogin.94-156-6-119.cprapid.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 314
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET icon-close.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-phone.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-close-white.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-phone-warning-white.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET ico-down-blue.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-blocked.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=29666533439834855130038382096916770502
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn

42 B
942 B

46ms
45ms

Image
image/gif

52.17.168.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Server

52.17.168.91 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-168-91.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v052-0be6ad7e9.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: iZqBvaT3QP0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn
Date: Wed, 18 Oct 2023 12:40:38 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK logo--dark-double.svg
www.nexi.it/content/dam/nexi/new-login-2019/loghi/ 1 KB
2 KB 51ms
50ms Image
image/svg+xml 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/loghi/logo--dark-double.svg

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:38 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 15:19:34 GMT
ETag: "5c8-601c9f540abf0"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/svg+xml
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=26

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 133ms
25ms Script
text/javascript 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b0239bfa0e93be202a3834190f526e4a15c5ed85547098ba370ec3606298cb29

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 18 Oct 2023 12:40:38 GMT

GET
H/1.1 200
OK bundle.js Show response
www.nexi.it/etc/designs/nexi/clientlib-node/ 1 MB
1 MB 220ms
220ms Script
application/javascript 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nexi.it/etc/designs/nexi/clientlib-node/bundle.js

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

9a0b01e894bd361b21153254a6090fab59a8eb4d6d97c3732934d02244bcd76f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:37 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:06:01 GMT
ETag: "10f8ef-601c3e6b6a4ea"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/javascript
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=50
Content-Length: 1112303

GET
H/1.1 200
OK content.ckscript.js Show response
www.nexi.it/cookieservice/nexi-it/ 79 KB
80 KB 101ms
100ms Script
application/javascript 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nexi.it/cookieservice/nexi-it/content.ckscript.js

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

985d09a4efadc95d6807e63c203ebac79f5d7533de4109adf07dbc6ba9d2b72e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:38 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Mon, 31 Jul 2023 08:04:45 GMT
ETag: "13da0-601c3e22db637"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/javascript
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=75

GET
H/1.1 200
OK style.css
www.nexi.it/cookieservice/nexi-it/ 21 KB
7 KB 99ms
98ms Stylesheet
text/css 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nexi.it/cookieservice/nexi-it/style.css

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

1f6bbe8591e650b3e139d0603cafb80ea3e5e76117a15c4960422b536bd419d0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:38 GMT
Content-Security-Policy: frame-ancestors 'self'
Content-Encoding: gzip
Last-Modified: Mon, 31 Jul 2023 08:05:08 GMT
ETag: "52c6-601c3e38dd8bf"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, HEAD
Content-Type: text/css
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=47

GET
H/1.1 200
OK placeholder_login_portale_privati.png
www.nexi.it/content/dam/nexi/new-login-2019/img/ 1 MB
1 MB 80ms
51ms Image
image/png 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nexi.it/content/dam/nexi/new-login-2019/img/placeholder_login_portale_privati.png

Requested by

Host: nexilogin.94-156-6-119.cprapid.com
URL: http://nexilogin.94-156-6-119.cprapid.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),

Reverse DNS

Software

Resource Hash

4e78d7ff08366ee22738a94a7c0777add9bfa2363548916d32da8387e1c81a1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Wed, 18 Oct 2023 12:40:38 GMT
Content-Security-Policy: frame-ancestors 'self'
Last-Modified: Fri, 18 Aug 2023 13:27:27 GMT
ETag: "13bef4-603327d6b4551"
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, HEAD
Content-Type: image/png
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control: max-age=300, public
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74

GET karbon-medium-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

GET karbon-regular-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

GET
H/1.1 200
OK dest5.html Show response
nexipayments.demdex.net/ Frame 528B 7 KB
3 KB 179ms
46ms Document
text/html 63.33.121.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nexipayments.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/launch-a40afd213c32.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.33.121.220 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-33-121-220.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://nexilogin.94-156-6-119.cprapid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v052-0f45644eb.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: zv9e2if2SAQ=
content-encoding: gzip
date: Wed, 18 Oct 2023 12:40:38 GMT
last-modified: Mon, 9 Oct 2023 09:52:43 GMT
vary: accept-encoding

GET icon-close.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-phone.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET icon-blocked.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ 0
0

GET karbon-semibold-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 196 KB
73 KB 42ms
40ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XXX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVCHKSD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b03f6df1af37ffbfd101cb7476400fc24cbc3b513c10bf9e30e4987341b02099

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74232
x-xss-protection: 0
last-modified: Wed, 18 Oct 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 18 Oct 2023 12:40:38 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
87 KB 44ms
44ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2EQBRC1CMY&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVCHKSD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b87d68729e6929fdb699176dfaed44b5b91ad35f16312c79e839200d9c11cf69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89213
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 18 Oct 2023 12:40:38 GMT

GET KarbonApp-Medium.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

GET KarbonApp-Regular.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

GET KarbonApp-Semibold.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ 0
0

POST
H2 200 landing
pagead2.googlesyndication.com/pagead/ 42 B
455 B 144ms
70ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/landing?gcs=G101&gcd=G101&rnd=1911149963.1697632839&url=http%3A%2F%2Fnexilogin.94-156-6-119.cprapid.com%2F&gtm=45He3ag0n81MVCHKSD

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVCHKSD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Oct 2023 12:40:38 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recaptcha__fr.js Show response
www.gstatic.com/recaptcha/releases/MydHw_zggsxIJuhSbyOmPv5R/ 464 KB
186 KB 92ms
27ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/MydHw_zggsxIJuhSbyOmPv5R/recaptcha__fr.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66f57da45ae7a69f7d639d07a31007826faf01cd2854b9866f0354406dd58d91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://nexilogin.94-156-6-119.cprapid.com/
Origin: http://nexilogin.94-156-6-119.cprapid.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 17:28:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 155519
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 189396
x-xss-protection: 0
last-modified: Mon, 09 Oct 2023 02:01:40 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 15 Oct 2024 17:28:39 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
267 B 593ms
22ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2EQBRC1CMY&gtm=45je3ag0&_p=942496426&gcs=G101&tt=external&ir=0&cid=823157708.1697632839&ul=en-us&sr=1600x1200&_s=1&dt=%2F&sid=1697632838&sct=1&seg=0&dl=http%3A%2F%2Fnexilogin.94-156-6-119.cprapid.com%2F&en=page_view&_fv=1&_nsi=1&_ss=1&epn.is_internal_traffic=0&epn.device_pixel_ratio=1&ep.navigation_type=navigate&ep.new_tab=existing&epn.redirect_count=0&epn.tab_count=1&ep.tab_id=d9414547-356c-4cb2-b6a4-181c3dab7d53&ep.container_id=GTM-MVCHKSD&epn.is_nb_customer=0&ep.connection_speed=4g&epn.cookies_bytes=227&epn.from_virtual_agent=0&epn.cookie_didomi_ready=0&ep.container_version=193
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2EQBRC1CMY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Oct 2023 12:40:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://nexilogin.94-156-6-119.cprapid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK retrieve-cookie-policy
www.nexi.it/api/services/nexi-utilities-service/prelogin/ Frame 0
0 152ms
60ms Preflight
application/json 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nexi.it/api/services/nexi-utilities-service/prelogin/retrieve-cookie-policy
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: application,cache-control,channel,client-version,content-type,cookie-origin,env,locale,pragma
Access-Control-Request-Method: POST
Origin: http://nexilogin.94-156-6-119.cprapid.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: application,cache-control,channel,client-version,content-type,cookie-origin,env,locale,pragma
Access-Control-Allow-Methods: POST
Access-Control-Allow-Origin: http://nexilogin.94-156-6-119.cprapid.com
Content-Length: 30
Content-Type: application/json
Date: Wed, 18 Oct 2023 12:40:40 GMT
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Vary: Accept-Encoding

GET
H2 200 trace Show response
www.cloudflare.com/cdn-cgi/ 322 B
458 B 85ms
22ms XHR
text/plain 2606:4700::6810:7c60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cloudflare.com/cdn-cgi/trace

Requested by

Host: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7c60 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec394c11efc3b5b3bc82788f253069c391b2d2cff700570e9fc51e14d5b92488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Referer: http://nexilogin.94-156-6-119.cprapid.com/
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 8180d9e7ec21d3dc-CDG
expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H/1.1 200
OK retrieve-cookie-policy Show response
www.nexi.it/api/services/nexi-utilities-service/prelogin/ 5 KB
6 KB 103ms
103ms XHR
application/json 185.198.118.126
NEXI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nexi.it/api/services/nexi-utilities-service/prelogin/retrieve-cookie-policy
Requested by: Host: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/bundle.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software: /
Resource Hash: f788e376e14be4b187702e7cbdb6d14710e4e84247b430fc0bf83046f21f4e88

Request headers

pragma: no-cache
accept-language: fr-FR,fr;q=0.9
Locale: it
Env: PRODUCTION
Client-Version: web
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
cache-control: no-cache
cookie-origin: http://nexilogin.94-156-6-119.cprapid.com
Referer: http://nexilogin.94-156-6-119.cprapid.com/
Application: sp
Channel: web

Response headers

Date: Wed, 18 Oct 2023 12:40:41 GMT
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Access-Control-Allow-Origin: http://nexilogin.94-156-6-119.cprapid.com
Access-Control-Expose-Headers: uniqueid
Access-Control-Allow-Credentials: true
Content-Type: application/json;charset=UTF-8
Content-Length: 4693
X-Application-Context: zuul-gateway:production:4000

POST
H/1.1 200
OK delivery Show response
nexipayments.tt.omtrdc.net/rest/v1/ 355 B
1 KB 97ms
43ms XHR
application/json 66.235.152.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

http://nexipayments.tt.omtrdc.net/rest/v1/delivery?client=nexipayments&sessionId=5e39e6b399b643a0a71e4163c8fae8ae&version=2.10.0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/launch-a40afd213c32.min.js

Protocol

HTTP/1.1

Server

66.235.152.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-113.data.adobedc.net

Software

jag /

Resource Hash

ccc5e84904640671bbe75967c03ee6fbb05bb51263671434b8b7990b6e095024

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://nexilogin.94-156-6-119.cprapid.com/
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 18 Oct 2023 12:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
transfer-encoding: chunked
x-xss-protection: 1; mode=block
x-request-id: 50d163e1-c25d-419c-a9c3-169a5499b177
referrer-policy: strict-origin-when-cross-origin
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: http://nexilogin.94-156-6-119.cprapid.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 27ms
26ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2EQBRC1CMY&gtm=45je3ag0&_p=942496426&gcs=G101&tt=external&ir=0&cid=823157708.1697632839&ul=en-us&sr=1600x1200&_eu=AEA&_s=2&dt=%2F&sid=1697632838&sct=1&seg=0&dl=http%3A%2F%2Fnexilogin.94-156-6-119.cprapid.com%2F&en=scroll&epn.is_internal_traffic=0&epn.device_pixel_ratio=1&ep.navigation_type=navigate&ep.new_tab=existing&epn.redirect_count=0&epn.tab_count=1&ep.tab_id=d9414547-356c-4cb2-b6a4-181c3dab7d53&ep.container_id=GTM-MVCHKSD&epn.is_nb_customer=0&ep.connection_speed=4g&epn.cookies_bytes=227&epn.from_virtual_agent=0&epn.cookie_didomi_ready=0&ep.container_version=193&epn.percent_scrolled=90&_et=4
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2EQBRC1CMY&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Oct 2023 12:40:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://nexilogin.94-156-6-119.cprapid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 313ms
313ms Image
text/html 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=563345725&rv=3ag0&u=AAAAAIAKAAAAAIA&h=Ag&gtm=45je3ag0&ccid=_G-XXX&cid=G-XXX&l=G-XXX.L167.S13.B10.E2103.EC10.TC1.HTC0~gtm.init.S0.V0.E7~gtm.js.S0.V0.E44.TS5gct.TI1.TE2~*.S0.V0.E1~*.S0.V0.E1~gtm.scrollDepth.S0.V0.E17~gtm.dom.S0.V0.E26~gtm.load.S0.V0.E47~gtm.scrollDepth.S0.V0~gtm.scrollDepth.S0.V0~gtm.init_consent.S1.V0.E10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://nexilogin.94-156-6-119.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 12:40:41 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 61ms
61ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2EQBRC1CMY&gtm=45je3ag0&_p=942496426&gcs=G101&tt=external&ir=0&cid=823157708.1697632839&ul=en-us&sr=1600x1200&dt=%2F&sid=1697632838&sct=1&seg=0&dl=http%3A%2F%2Fnexilogin.94-156-6-119.cprapid.com%2F&_s=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2EQBRC1CMY&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://nexilogin.94-156-6-119.cprapid.com/
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 18 Oct 2023 12:40:46 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://nexilogin.94-156-6-119.cprapid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close-white.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone-warning-white.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ico-down-blue.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-medium-webfont.woff

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-regular-webfont.woff

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg

Domain: www.nexi.ithttps
URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-semibold-webfont.woff

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Medium.ttf

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Regular.ttf

Domain: www.nexi.it
URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Semibold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-20 19:53:04	Name: demdex Value: 29666533439834855130038382096916770502
.cprapid.com/	1969-12-31 23:59:59	Name: AMCVS_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: 1
.everesttech.net/	1970-01-21 00:19:28	Name: everest_g_v2 Value: g_surferid~ZS-SRgAAAMzPVgNn
.dpm.demdex.net/	1970-01-20 19:53:04	Name: dpm Value: 29666533439834855130038382096916770502
.cprapid.com/	1970-01-21 01:09:52	Name: AMCV_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19649%7CMCMID%7C23768723556759994780675451981886300281%7CMCAAMLH-1698237637%7C6%7CMCAAMB-1698237637%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1697640037s%7CNONE%7CMCSYNCSOP%7C411-19656%7CvVersion%7C5.4.0
.cprapid.com/	1970-01-21 00:19:28	Name: _ga Value: GA1.1.823157708.1697632839
.cprapid.com/	1969-12-31 23:59:59	Name: at_check Value: true
.cprapid.com/	1970-01-21 00:19:28	Name: _ga_2EQBRC1CMY Value: GS1.1.1697632838.1.0.1697632841.0.0.0
.cprapid.com/	1970-01-21 01:09:52	Name: mbox Value: session#5e39e6b399b643a0a71e4163c8fae8ae#1697634702\|PC#5e39e6b399b643a0a71e4163c8fae8ae.37_0#1760877642

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close-white.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone-warning-white.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ico-down-blue.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38379) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-medium-webfont.woff' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-medium-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38379) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-regular-webfont.woff' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-regular-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38379) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-semibold-webfont.woff' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-semibold-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38380) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Regular.ttf' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Regular.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38380) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Medium.ttf' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Medium.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://nexilogin.94-156-6-119.cprapid.com/(Line 38380) Message: Access to font at 'https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Semibold.ttf' from origin 'http://nexilogin.94-156-6-119.cprapid.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Semibold.ttf Message: Failed to load resource: net::ERR_FAILED
deprecation	warning	URL: https://www.nexi.it/etc/designs/nexi/clientlib-node/bundle.js(Line 1) Message: Listener added for a synchronous 'DOMNodeRemoved' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
cm.everesttech.net
dpm.demdex.net
nexilogin.94-156-6-119.cprapid.com
nexipayments.demdex.net
nexipayments.tt.omtrdc.net
pagead2.googlesyndication.com
region1.google-analytics.com
www.cloudflare.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.nexi.it
www.nexi.ithttps
www.nexi.it
www.nexi.ithttps
185.198.118.126
2001:4860:4802:34::36
2606:4700::6810:7c60
2a00:1450:4001:801::2004
2a00:1450:4001:80b::2008
2a00:1450:4001:812::2002
2a00:1450:4001:829::2003
2a02:26f0:480:99e::1e80
52.17.168.91
52.212.121.189
63.33.121.220
66.235.152.113
94.156.6.119
1f6bbe8591e650b3e139d0603cafb80ea3e5e76117a15c4960422b536bd419d0
23ad197def9f4c983e658350fb1788aa32894df43eec7fa5d6ade80bc30cfdda
4e78d7ff08366ee22738a94a7c0777add9bfa2363548916d32da8387e1c81a1e
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762
66f57da45ae7a69f7d639d07a31007826faf01cd2854b9866f0354406dd58d91
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
967861a54f0da10aabb1884796ec0215b93105794f34ed0badb55d39b18b155e
985d09a4efadc95d6807e63c203ebac79f5d7533de4109adf07dbc6ba9d2b72e
9a0b01e894bd361b21153254a6090fab59a8eb4d6d97c3732934d02244bcd76f
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
9aa959d19ca80b176a67882d4d0e93bf43755c11ff883256e808e37eec3dff18
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
b0239bfa0e93be202a3834190f526e4a15c5ed85547098ba370ec3606298cb29
b03f6df1af37ffbfd101cb7476400fc24cbc3b513c10bf9e30e4987341b02099
b87d68729e6929fdb699176dfaed44b5b91ad35f16312c79e839200d9c11cf69
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
ccc5e84904640671bbe75967c03ee6fbb05bb51263671434b8b7990b6e095024
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec394c11efc3b5b3bc82788f253069c391b2d2cff700570e9fc51e14d5b92488
ed17ab0f8ecf3bb8f873fcd1bb29f574190d36368c8bbd7809804bdc295491ab
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f788e376e14be4b187702e7cbdb6d14710e4e84247b430fc0bf83046f21f4e88

nexilogin.94-156-6-119.cprapid.com Open in urlscan Pro 94.156.6.119 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

45 Requests

60 %HTTPS

54 %IPv6

13 Domains

14 Subdomains

13 IPs

5 Countries

12588 kBTransfer

13997 kBSize

9 Cookies

30 Outgoing links

Redirected requests

45 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

nexilogin.94-156-6-119.cprapid.com Open in urlscan Pro
94.156.6.119 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

45
Requests

60 %
HTTPS

54 %
IPv6

13
Domains

14
Subdomains

13
IPs

5
Countries

12588 kB
Transfer

13997 kB
Size

9
Cookies

45 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!