areaweb-onlinelta.162-0-239-179.cprapid.com Open in urlscan Pro
162.0.239.179 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://web-cl.info/ln-NEXl
Effective URL:
https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/
Submission: On October 13 via manual (October 13th 2023, 7:03:44 am UTC) from IT — Scanned from IT

Summary HTTP 2 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 162.0.239.179, located in United States and belongs to NAMECHEAP-NET, US. The main domain is areaweb-onlinelta.162-0-239-179.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 9th 2023. Valid for: 3 months.

This is the only time areaweb-onlinelta.162-0-239-179.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2a02:4780:a:1... 2a02:4780:a:1139:0:2903:ef5a:2	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1 3	162.0.239.179 162.0.239.179	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	2

2 2a02:4780:a:1139:0:2903:ef5a:2 (Manchester, United Kingdom) 2 redirects

ASN47583 (AS-HOSTINGER, CY)

web-cl.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.0.239.179 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: country-information.quarantine-pnap-vlan51.web-hosting.com

areaweb-onlinelta.162-0-239-179.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cprapid.com 1 redirects areaweb-onlinelta.162-0-239-179.cprapid.com	2 MB
2	web-cl.info 2 redirects web-cl.info	416 B
2	2

	Domain	Requested by
3	areaweb-onlinelta.162-0-239-179.cprapid.com	1 redirects areaweb-onlinelta.162-0-239-179.cprapid.com
2	web-cl.info	2 redirects
2	2

This site contains links to these domains. Also see Links.

Domain
www.nexi.it
apps.apple.com
play.google.com
appgallery.huawei.com
privati.nexi.it

Subject Issuer	Validity	Valid
areaweb-onlinelta.162-0-239-179.cprapid.com cPanel, Inc. Certification Authority	`2023-10-09` - `2024-01-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/
Frame ID: 195EC03933F54E5AA0A4D7014594A8E2
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Area Personale

Page URL History Show full URLs

https://web-cl.info/ln-NEXl HTTP 301
https://web-cl.info/ln-NEXl/ HTTP 302
https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc HTTP 301
https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Page URL

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1879 kB
Transfer

1956 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nexi.it/

Search URL Search Domain Scan URL

URL: https://www.nexi.it/accedi.html
Title: Cambia portale

Search URL Search Domain Scan URL

URL: https://apps.apple.com/it/app/nexi-pay/id518695175

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=it.icbpi.mobile&hl=it

Search URL Search Domain Scan URL

URL: https://appgallery.huawei.com/#/app/C101454369

Search URL Search Domain Scan URL

URL: https://privati.nexi.it/registration/intro
Title: REGISTRATI

Search URL Search Domain Scan URL

URL: https://www.nexi.it/content/dam/nexi/new-login-2019/informativa_privacy.pdf
Title: Privacy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://web-cl.info/ln-NEXl HTTP 301
https://web-cl.info/ln-NEXl/ HTTP 302
https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc HTTP 301
https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
14 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Redirect Chain https://web-cl.info/ln-NEXl https://web-cl.info/ln-NEXl/ https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/	2 MB 2 MB	185ms 185ms	Document text/html	162.0.239.179 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.239.179 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS country-information.quarantine-pnap-vlan51.web-hosting.com Software Apache / Resource Hash `5bbca17a5e54568f083fb887832ef4592bf46df0d70406b380780b5fa3777092` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 1841740 Content-Type text/html Date Fri, 13 Oct 2023 07:03:39 GMT Keep-Alive timeout=5, max=99 Last-Modified Thu, 18 Nov 2021 15:20:24 GMT Server Apache Redirect headers Connection Keep-Alive Content-Length 268 Content-Type text/html; charset=iso-8859-1 Date Fri, 13 Oct 2023 07:03:39 GMT Keep-Alive timeout=5, max=100 Location https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Server Apache
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	15 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	25 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	22 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	/ areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/	8 KB 8 KB	187ms 186ms	Image text/html	162.0.239.179 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Requested by Host: areaweb-onlinelta.162-0-239-179.cprapid.com URL: https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.239.179 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS country-information.quarantine-pnap-vlan51.web-hosting.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language it-IT,it;q=0.9 Referer https://areaweb-onlinelta.162-0-239-179.cprapid.com/msd-ddc/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Fri, 13 Oct 2023 07:03:40 GMT Last-Modified Thu, 18 Nov 2021 15:20:24 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1841740
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259` Request headers Referer Origin https://areaweb-onlinelta.162-0-239-179.cprapid.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6` Request headers Referer Origin https://areaweb-onlinelta.162-0-239-179.cprapid.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	898 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	935 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6` Request headers Referer Origin https://areaweb-onlinelta.162-0-239-179.cprapid.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

areaweb-onlinelta.162-0-239-179.cprapid.com
web-cl.info
162.0.239.179
2a02:4780:a:1139:0:2903:ef5a:2
0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259
5bbca17a5e54568f083fb887832ef4592bf46df0d70406b380780b5fa3777092
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c

areaweb-onlinelta.162-0-239-179.cprapid.com Open in urlscan Pro 162.0.239.179 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1879 kBTransfer

1956 kBSize

0 Cookies

7 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

areaweb-onlinelta.162-0-239-179.cprapid.com Open in urlscan Pro
162.0.239.179 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1879 kB
Transfer

1956 kB
Size

0
Cookies

2 HTTP transactions
14 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!