urlscan.io logo urlscan.io
SecurityTrails logo

config758loginvhost143127.lowhost.ru Open in urlscan Pro
195.128.123.215  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Submission: On January 27 via manual from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 20 HTTP transactions. The main IP is 195.128.123.215, located in Ul'yanovka, Russian Federation and belongs to GARANT-PARK-INTERNET, RU. The main domain is config758loginvhost143127.lowhost.ru.
This is the only time config758loginvhost143127.lowhost.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

IP Address AS Autonomous System
10 195.128.123.215 47196 (GARANT-PA...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 172.217.16.198 15169 (GOOGLE)
6 151.99.162.64 3269 (ASN-IBSNAZ)
1 13.224.194.78 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
20 6
10    195.128.123.215 (Ul'yanovka, Russian Federation)

ASN47196 (GARANT-PARK-INTERNET, RU)
config758loginvhost143127.lowhost.ru
1    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    172.217.16.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f198.1e100.net
9897221.fls.doubleclick.net
6    151.99.162.64 (Italy)

ASN3269 (ASN-IBSNAZ, IT)
PTR: host-151-99-162-64.business.telecomitalia.it
www.nexi.it
1    13.224.194.78 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-78.fra2.r.cloudfront.net
vars.hotjar.com
1    2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
Domain Requested by
10 config758loginvhost143127.lowhost.ru config758loginvhost143127.lowhost.ru
6 www.nexi.it config758loginvhost143127.lowhost.ru
2 9897221.fls.doubleclick.net 1 redirects config758loginvhost143127.lowhost.ru
1 www.google.com config758loginvhost143127.lowhost.ru
1 vars.hotjar.com config758loginvhost143127.lowhost.ru
1 fonts.googleapis.com config758loginvhost143127.lowhost.ru
20 6

This site contains no links.

Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
www.nexi.it
GlobalSign RSA OV SSL CA 2018		 2020-06-08 -
2021-07-25		 a year crt.sh
*.hotjar.com
Amazon		 2020-12-25 -
2022-01-23		 a year crt.sh
www.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh

This page contains 4 frames:

Primary Page: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Frame ID: 398EF7657928AA93CC20E93B9472F27E
Requests: 17 HTTP requests in this frame

Frame: http://9897221.fls.doubleclick.net/activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.it%2Flogin-titolari.html
Frame ID: 6BEECD99450594C856E18C81B074C687
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 3CA7C53C087F0F5DFE3129C4955FC024
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LdPdiUUAAAAABfWa8mIbptRJbXdX49uDu44M7Uw&cb=xc5v0rjiai66
Frame ID: 72D7FC78EFE08E9CF3975BF206AFB1C8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

20
Requests

45 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

2277 kB
Transfer

2279 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • http://9897221.fls.doubleclick.net/activityi;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.it%2Flogin-titolari.html HTTP 302
  • http://9897221.fls.doubleclick.net/activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.it%2Flogin-titolari.html

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/ 		302 KB
302 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
04692f9d9b4bd8688ed094dc1ce99cf3b96d358d954a9b0ff89aca8331f89e7b

Request headers

Host
config758loginvhost143127.lowhost.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx/1.16.1
Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
style.css
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/ 		18 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/style.css
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
50c8f8cf3eb1f7a201882f9edf2adfffc6e581e1b82dff0036aafd0a753e2e3c

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5fa0ddf4-47cf"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18383
styles.css
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/ 		567 KB
568 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
6b3318b8b2f4b3a58a85ffab1b3330ecc46f177dd1daf18dfe4e1844048f0855

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5fa0ddf4-8dd6b"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
580971
css
fonts.googleapis.com/ 		4 KB
740 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600&subset=latin
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0548a34e1f94e73ba30c13a14a5c4351d28230779b06f1b6f6ea3e0e148ed7f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 27 Jan 2021 15:46:03 GMT
server
ESF
date
Wed, 27 Jan 2021 15:46:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 27 Jan 2021 15:46:03 GMT
logo.svg
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/logo.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5fa0ddf4-5c4"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1476
activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.i...
9897221.fls.doubleclick.net/ Frame 6BEE
Redirect Chain
  • http://9897221.fls.doubleclick.net/activityi;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi....
  • http://9897221.fls.doubleclick.net/activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://9897221.fls.doubleclick.net/activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.it%2Flogin-titolari.html?
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
172.217.16.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s08-in-f198.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Host
9897221.fls.doubleclick.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/

Response headers

P3P
policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin
*
Cross-Origin-Resource-Policy
cross-origin
Date
Wed, 27 Jan 2021 15:46:03 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control
no-cache, must-revalidate
Strict-Transport-Security
max-age=21600
Content-Type
text/html; charset=UTF-8
Pragma
no-cache
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Server
cafe
Content-Length
404
X-XSS-Protection
0

Redirect headers

P3P
policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin
*
Cross-Origin-Resource-Policy
cross-origin
Date
Wed, 27 Jan 2021 15:46:03 GMT
Pragma
no-cache
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control
no-cache, must-revalidate
Follow-Only-When-Prerender-Shown
1
Strict-Transport-Security
max-age=21600
Location
http://9897221.fls.doubleclick.net/activityi;dc_pre=COCV-9i6vO4CFXqBUAYd3TkDEA;src=9897221;type=mc;cat=nexi_0;ord=674579496552;gtm=2wgal2;auiddc=1840360196.1604354757;u1=%2Flogin-titolari.html;u23=true;~oref=https%3A%2F%2Fwww.nexi.it%2Flogin-titolari.html?
Content-Type
text/html; charset=UTF-8
X-Content-Type-Options
nosniff
Server
cafe
Content-Length
0
X-XSS-Protection
0
app_store.svg
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/app_store.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5fa0ddf4-3dc8"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15816
google_play.svg
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/google_play.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5fa0ddf4-62ff"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
25343
icon-close.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:45 GMT
ETag
"628-5b951260a9db0-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=96
Content-Length
801
icon-phone.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		4 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:53 GMT
ETag
"fb0-5b951268cf4da-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=91
Content-Length
1620
icon-close-white.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-close-white.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:47 GMT
ETag
"637-5b9512632d690-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=95
Content-Length
810
icon-phone-warning-white.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		4 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone-warning-white.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:53 GMT
ETag
"f29-5b951268d0efb-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=100
Content-Length
1594
ico-down-blue.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		898 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/ico-down-blue.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:53 GMT
ETag
"382-5b95126843293-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=100
Content-Length
560
icon-blocked.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		935 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
151.99.162.64 , Italy, ASN3269 (ASN-IBSNAZ, IT),
Reverse DNS
host-151-99-162-64.business.telecomitalia.it
Software
/
Resource Hash
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 08:57:48 GMT
ETag
"3a7-5b951263523b6-gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=300, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Keep-Alive
timeout=5, max=100
Content-Length
530
box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 3CA7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.194.78 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-78.fra2.r.cloudfront.net
Software
/
Resource Hash

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/

Response headers

content-type
text/html
content-length
851
date
Mon, 23 Nov 2020 17:01:03 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
etag
"d594f1d4c3e5dbd6b556c60d34e0daea"
last-modified
Mon, 23 Nov 2020 15:41:01 GMT
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 172e63b20fb363ed969de28ae3937e21.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
0uOs374X3jpUShp6s4OH2KPFweVISDHjEMn4aOucDF0Gvi1mg4Ec_w==
age
5611500
bframe
www.google.com/recaptcha/api2/ Frame 72D7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LdPdiUUAAAAABfWa8mIbptRJbXdX49uDu44M7Uw&cb=xc5v0rjiai66
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-hsMVYzJAh5BX8hhu0CjN+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LdPdiUUAAAAABfWa8mIbptRJbXdX49uDu44M7Uw&cb=xc5v0rjiai66
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 27 Jan 2021 15:46:03 GMT
content-security-policy
script-src 'report-sample' 'nonce-hsMVYzJAh5BX8hhu0CjN+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1124
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
placeholder_login_portale_privati.png
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/imgs/placeholder_login_portale_privati.png
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
861a4758d8d84ee664daa9cebfccf9aa3ab671f213484cb1f5e9ce586670a89b

Request headers

Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:03 GMT
Last-Modified
Tue, 03 Nov 2020 04:36:00 GMT
Server
nginx/1.16.1
ETag
"5fa0de30-13b53f"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1291583
karbon-regular-webfont.woff
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/karbon-regular-webfont.woff
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6

Request headers

Origin
http://config758loginvhost143127.lowhost.ru
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:04 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"5ef4-5b32c62bc6500"
Content-Type
application/font-woff
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
24308
karbon-medium-webfont.woff
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/karbon-medium-webfont.woff
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259

Request headers

Origin
http://config758loginvhost143127.lowhost.ru
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:04 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"617c-5b32c62bc6500"
Content-Type
application/font-woff
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
24956
karbon-semibold-webfont.woff
config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/fonts/karbon-semibold-webfont.woff
Requested by
Host: config758loginvhost143127.lowhost.ru
URL: http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
Protocol
HTTP/1.1
Server
195.128.123.215 Ul'yanovka, Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6

Request headers

Origin
http://config758loginvhost143127.lowhost.ru
Referer
http://config758loginvhost143127.lowhost.ru/customia/Area-Cliente/informazioni/web/cs/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 27 Jan 2021 15:46:04 GMT
Last-Modified
Tue, 03 Nov 2020 04:35:00 GMT
Server
nginx/1.16.1
ETag
"61c8-5b32c62bc6500"
Content-Type
application/font-woff
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
25032

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUlFCZWpC9U1S2GEw9xldUNVvgKY0ITa89ZToP2bALijbszJ1Gs23PPoEhKM

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9897221.fls.doubleclick.net
config758loginvhost143127.lowhost.ru
fonts.googleapis.com
vars.hotjar.com
www.google.com
www.nexi.it
13.224.194.78
151.99.162.64
172.217.16.198
195.128.123.215
2a00:1450:4001:812::2004
2a00:1450:4001:812::200a
04692f9d9b4bd8688ed094dc1ce99cf3b96d358d954a9b0ff89aca8331f89e7b
0548a34e1f94e73ba30c13a14a5c4351d28230779b06f1b6f6ea3e0e148ed7f9
0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259
50c8f8cf3eb1f7a201882f9edf2adfffc6e581e1b82dff0036aafd0a753e2e3c
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
6b3318b8b2f4b3a58a85ffab1b3330ecc46f177dd1daf18dfe4e1844048f0855
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
861a4758d8d84ee664daa9cebfccf9aa3ab671f213484cb1f5e9ce586670a89b
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c