![](/screenshots/3037f71c-1e3c-4e4c-acf6-d8f0ae635efd.png)
nexilogin.94-156-6-119.cprapid.com
Open in
urlscan Pro
94.156.6.119
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi threat #phishing #nexipayments Search All
Submission: On October 18 via api from FR — Scanned from FR
Summary
This is the only time nexilogin.94-156-6-119.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nexi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 94.156.6.119 94.156.6.119 | 211252 (AS_DELIS) (AS_DELIS) | |
1 | 2a02:26f0:480... 2a02:26f0:480:99e::1e80 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
13 | 185.198.118.126 185.198.118.126 | 35051 (NEXI-AS) (NEXI-AS) | |
4 | 2a00:1450:400... 2a00:1450:4001:80b::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 52.17.168.91 52.17.168.91 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 52.212.121.189 52.212.121.189 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 63.33.121.220 63.33.121.220 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:7c60 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 66.235.152.113 66.235.152.113 | 16509 (AMAZON-02) (AMAZON-02) | |
45 | 13 |
ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-168-91.eu-west-1.compute.amazonaws.com
dpm.demdex.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-121-189.eu-west-1.compute.amazonaws.com
cm.everesttech.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-121-220.eu-west-1.compute.amazonaws.com
nexipayments.demdex.net |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-113.data.adobedc.net
nexipayments.tt.omtrdc.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
nexi.it
www.nexi.it |
3 MB |
4 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 56 |
261 KB |
3 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2250 |
338 B |
3 |
demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 242 nexipayments.demdex.net |
5 KB |
1 |
omtrdc.net
nexipayments.tt.omtrdc.net |
1 KB |
1 |
cloudflare.com
www.cloudflare.com — Cisco Umbrella Rank: 6224 |
458 B |
1 |
gstatic.com
www.gstatic.com |
186 KB |
1 |
googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 |
455 B |
1 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
1 KB |
1 |
everesttech.net
1 redirects
cm.everesttech.net — Cisco Umbrella Rank: 1318 |
517 B |
1 |
adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 468 |
70 KB |
1 |
cprapid.com
nexilogin.94-156-6-119.cprapid.com |
9 MB |
0 |
Failed
function sub() { [native code] }. Failed |
|
45 | 13 |
Domain | Requested by | |
---|---|---|
13 | www.nexi.it |
nexilogin.94-156-6-119.cprapid.com
www.nexi.it |
4 | www.googletagmanager.com |
nexilogin.94-156-6-119.cprapid.com
www.googletagmanager.com |
3 | region1.google-analytics.com |
www.googletagmanager.com
|
2 | dpm.demdex.net |
assets.adobedtm.com
nexilogin.94-156-6-119.cprapid.com |
1 | nexipayments.tt.omtrdc.net |
assets.adobedtm.com
|
1 | www.cloudflare.com |
www.nexi.it
|
1 | www.gstatic.com |
www.google.com
|
1 | pagead2.googlesyndication.com |
www.googletagmanager.com
|
1 | nexipayments.demdex.net |
assets.adobedtm.com
|
1 | www.google.com |
nexilogin.94-156-6-119.cprapid.com
|
1 | cm.everesttech.net | 1 redirects |
1 | assets.adobedtm.com |
nexilogin.94-156-6-119.cprapid.com
|
1 | nexilogin.94-156-6-119.cprapid.com | |
0 | www.nexi.ithttps Failed |
nexilogin.94-156-6-119.cprapid.com
|
45 | 14 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-07-11 - 2024-08-10 |
a year | crt.sh |
www.nexi.it GlobalSign RSA OV SSL CA 2018 |
2023-08-04 - 2024-08-21 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-09-26 - 2024-10-26 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
www.cloudflare.com GTS CA 1P5 |
2023-09-19 - 2023-12-18 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://nexilogin.94-156-6-119.cprapid.com/
Frame ID: 07CBA914B7BD9D9626B5DAB2F2491A6D
Requests: 43 HTTP requests in this frame
Frame:
https://nexipayments.demdex.net/dest5.html?d_nsid=0
Frame ID: 528BE5BE57D6C58FC7F823AA10DFCD74
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/3037f71c-1e3c-4e4c-acf6-d8f0ae635efd.png)
Page Title
Area Personaleicon/white/frecciaicon/white/frecciaDetected technologies
Detected patterns
- /etc/designs/
Detected patterns
- googlesyndication\.com/
Detected patterns
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
![](/vendor/wappa/icons/reCAPTCHA.png)
Detected patterns
- /recaptcha/api\.js
Page Statistics
30 Outgoing links
These are links going to different origins than the main page.
Title: Google-analytics.com
Search URL Search Domain Scan URL
Title: Hotjar.com
Search URL Search Domain Scan URL
Title: Adobe.target
Search URL Search Domain Scan URL
Title: Track.adform.net
Search URL Search Domain Scan URL
Title: Doubleclick.net
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Amazon-adsystem.com
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: Criteo.com
Search URL Search Domain Scan URL
Title: Fanplayr
Search URL Search Domain Scan URL
Title: BingAds
Search URL Search Domain Scan URL
Title: Zemanta
Search URL Search Domain Scan URL
Title: Salesforce
Search URL Search Domain Scan URL
Title: Webgains
Search URL Search Domain Scan URL
Title: Awin
Search URL Search Domain Scan URL
Title: Performoney
Search URL Search Domain Scan URL
Title: Quantcast
Search URL Search Domain Scan URL
Title: Beintoo
Search URL Search Domain Scan URL
Title: Verizon
Search URL Search Domain Scan URL
Title: Italiaonline
Search URL Search Domain Scan URL
Title: Internet Explorer
Search URL Search Domain Scan URL
Title: Edge
Search URL Search Domain Scan URL
Title: Firefox
Search URL Search Domain Scan URL
Title: Google Chrome
Search URL Search Domain Scan URL
Title: Safari
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: REGISTRATI
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://cm.everesttech.net/cm/dd?d_uuid=29666533439834855130038382096916770502 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn
45 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nexilogin.94-156-6-119.cprapid.com/ |
9 MB 9 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
launch-a40afd213c32.min.js
assets.adobedtm.com/9dd8bdfc74c3/cd37bd923e2c/ |
219 KB 70 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.nexi.it/etc/designs/nexi/clientlib-node/ |
568 KB 135 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
www.nexi.it/etc/designs/icbpi-common/libs/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo--light-double.svg
www.nexi.it/content/dam/nexi/new-login-2019/loghi/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
350 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app_store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ |
15 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_play.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ |
25 KB 26 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
huawei-store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id
dpm.demdex.net/ |
371 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-close.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-phone.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-close-white.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-phone-warning-white.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ico-down-blue.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-blocked.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=ZS-SRgAAAMzPVgNn
dpm.demdex.net/ Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo--dark-double.svg
www.nexi.it/content/dam/nexi/new-login-2019/loghi/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bundle.js
www.nexi.it/etc/designs/nexi/clientlib-node/ |
1 MB 1 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
content.ckscript.js
www.nexi.it/cookieservice/nexi-it/ |
79 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.nexi.it/cookieservice/nexi-it/ |
21 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
placeholder_login_portale_privati.png
www.nexi.it/content/dam/nexi/new-login-2019/img/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
karbon-medium-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
karbon-regular-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
nexipayments.demdex.net/ Frame 528B |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-close.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-phone.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-blocked.svg
www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
karbon-semibold-webfont.woff
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
196 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
260 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
KarbonApp-Medium.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
KarbonApp-Regular.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
KarbonApp-Semibold.ttf
www.nexi.it/etc/designs/nexi/clientlib-node/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
landing
pagead2.googlesyndication.com/pagead/ |
42 B 455 B |
Ping
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__fr.js
www.gstatic.com/recaptcha/releases/MydHw_zggsxIJuhSbyOmPv5R/ |
464 KB 186 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 267 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
retrieve-cookie-policy
www.nexi.it/api/services/nexi-utilities-service/prelogin/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trace
www.cloudflare.com/cdn-cgi/ |
322 B 458 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
retrieve-cookie-policy
www.nexi.it/api/services/nexi-utilities-service/prelogin/ |
5 KB 6 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
delivery
nexipayments.tt.omtrdc.net/rest/v1/ |
355 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a
www.googletagmanager.com/ |
0 11 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
region1.google-analytics.com/g/ |
0 17 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close-white.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone-warning-white.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/ico-down-blue.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-medium-webfont.woff
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-regular-webfont.woff
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg
- Domain
- www.nexi.ithttps
- URL
- https://www.nexi.ithttps//www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/karbon-semibold-webfont.woff
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Medium.ttf
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Regular.ttf
- Domain
- www.nexi.it
- URL
- https://www.nexi.it/etc/designs/nexi/clientlib-node/fonts/KarbonApp-Semibold.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nexi (Banking)77 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| dataLayer object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| google_tag_manager object| google_tag_data object| didomiEventListeners object| didomiOnReady function| $ function| jQuery boolean| wcmmode_disabled object| htmlBoxFunctionsArray function| verifyCallback function| login object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| onYouTubeIframeAPIReady object| recaptcha object| gaGlobal object| regeneratorRuntime function| Swiper object| sessionStores object| Modernizr object| picturefillCFG function| picturefill object| browser object| _cookieLawObj function| ownKeys function| _objectSpread function| _defineProperty function| _createForOfIteratorHelper function| _slicedToArray function| _nonIterableRest function| _unsupportedIterableToArray function| _arrayLikeToArray function| _iterableToArrayLimit function| _arrayWithHoles object| MOBILE_REGEX_ONE object| MOBILE_REGEX_TWO number| EXPIRATION_TIME string| INSTALLED_DOMAIN string| COOKIE_DOMAIN string| COOKIE_TITLE_1 string| COOKIE_TITLE_2 string| COOKIE_TITLE_3 object| COOKIE_LIST string| BANNER_TEMPLATE string| COOKIE_NAME string| API_REST_BE string| ENV string| APPLICATION string| COOKIE_POLICY_VERSION string| LANG string| COOKIE_LENGHT string| COOKIE_CONSENT string| COOKIE_ACCEPT string| COOKIE_DECLINE string| COOKIE_MONTH string| COOKIE_CONSENT_TYPE object| cookieLawObj function| loadjQuery function| inheritMethod function| startingHeight object| __target_telemetry object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| gRecaptchaCallBack function| gRecaptchaExpiredCallBack function| gRecaptchaSubmit9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.demdex.net/ | Name: demdex Value: 29666533439834855130038382096916770502 |
|
.cprapid.com/ | Name: AMCVS_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: 1 |
|
.everesttech.net/ | Name: everest_g_v2 Value: g_surferid~ZS-SRgAAAMzPVgNn |
|
.dpm.demdex.net/ | Name: dpm Value: 29666533439834855130038382096916770502 |
|
.cprapid.com/ | Name: AMCV_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19649%7CMCMID%7C23768723556759994780675451981886300281%7CMCAAMLH-1698237637%7C6%7CMCAAMB-1698237637%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1697640037s%7CNONE%7CMCSYNCSOP%7C411-19656%7CvVersion%7C5.4.0 |
|
.cprapid.com/ | Name: _ga Value: GA1.1.823157708.1697632839 |
|
.cprapid.com/ | Name: at_check Value: true |
|
.cprapid.com/ | Name: _ga_2EQBRC1CMY Value: GS1.1.1697632838.1.0.1697632841.0.0.0 |
|
.cprapid.com/ | Name: mbox Value: session#5e39e6b399b643a0a71e4163c8fae8ae#1697634702|PC#5e39e6b399b643a0a71e4163c8fae8ae.37_0#1760877642 |
22 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.adobedtm.com
cm.everesttech.net
dpm.demdex.net
nexilogin.94-156-6-119.cprapid.com
nexipayments.demdex.net
nexipayments.tt.omtrdc.net
pagead2.googlesyndication.com
region1.google-analytics.com
www.cloudflare.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.nexi.it
www.nexi.ithttps
www.nexi.it
www.nexi.ithttps
185.198.118.126
2001:4860:4802:34::36
2606:4700::6810:7c60
2a00:1450:4001:801::2004
2a00:1450:4001:80b::2008
2a00:1450:4001:812::2002
2a00:1450:4001:829::2003
2a02:26f0:480:99e::1e80
52.17.168.91
52.212.121.189
63.33.121.220
66.235.152.113
94.156.6.119
1f6bbe8591e650b3e139d0603cafb80ea3e5e76117a15c4960422b536bd419d0
23ad197def9f4c983e658350fb1788aa32894df43eec7fa5d6ade80bc30cfdda
4e78d7ff08366ee22738a94a7c0777add9bfa2363548916d32da8387e1c81a1e
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762
66f57da45ae7a69f7d639d07a31007826faf01cd2854b9866f0354406dd58d91
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
967861a54f0da10aabb1884796ec0215b93105794f34ed0badb55d39b18b155e
985d09a4efadc95d6807e63c203ebac79f5d7533de4109adf07dbc6ba9d2b72e
9a0b01e894bd361b21153254a6090fab59a8eb4d6d97c3732934d02244bcd76f
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
9aa959d19ca80b176a67882d4d0e93bf43755c11ff883256e808e37eec3dff18
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
b0239bfa0e93be202a3834190f526e4a15c5ed85547098ba370ec3606298cb29
b03f6df1af37ffbfd101cb7476400fc24cbc3b513c10bf9e30e4987341b02099
b87d68729e6929fdb699176dfaed44b5b91ad35f16312c79e839200d9c11cf69
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
ccc5e84904640671bbe75967c03ee6fbb05bb51263671434b8b7990b6e095024
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec394c11efc3b5b3bc82788f253069c391b2d2cff700570e9fc51e14d5b92488
ed17ab0f8ecf3bb8f873fcd1bb29f574190d36368c8bbd7809804bdc295491ab
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f788e376e14be4b187702e7cbdb6d14710e4e84247b430fc0bf83046f21f4e88