![](/screenshots/4ee0ff1e-7fd7-4244-963f-88e195891978.png)
confermadate.info
Open in
urlscan Pro
172.105.90.92
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi threat phishing nexipayments Search All
Submission: On June 11 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by R11 on June 11th 2024. Valid for: 3 months.
This is the only time confermadate.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nexi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.105.90.92 172.105.90.92 | 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud) | |
3 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 185.198.118.43 185.198.118.43 | 35051 (NEXI-AS) (NEXI-AS) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2016 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:81d::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
27 | 9 |
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: fra1.hostarmada.net
confermadate.info |
ASN15169 (GOOGLE, US)
play-lh.googleusercontent.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
nexi.it
business.nexi.it |
82 KB |
3 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1268 |
43 KB |
2 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2406 |
291 B |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 78 |
181 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 461 |
93 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 260 |
352 KB |
1 |
googleusercontent.com
play-lh.googleusercontent.com — Cisco Umbrella Rank: 519 |
8 KB |
1 |
confermadate.info
confermadate.info |
5 KB |
27 | 8 |
Domain | Requested by | |
---|---|---|
5 | business.nexi.it |
confermadate.info
business.nexi.it |
3 | maxcdn.bootstrapcdn.com |
confermadate.info
|
2 | region1.google-analytics.com |
www.googletagmanager.com
|
2 | www.googletagmanager.com |
confermadate.info
www.googletagmanager.com |
2 | ajax.googleapis.com |
confermadate.info
|
2 | cdnjs.cloudflare.com |
confermadate.info
|
1 | play-lh.googleusercontent.com |
confermadate.info
|
1 | confermadate.info | |
27 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
business.nexi.it |
www.nexi.it |
Subject Issuer | Validity | Valid | |
---|---|---|---|
confermadate.info R11 |
2024-06-11 - 2024-09-09 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
business.nexi.it GlobalSign RSA OV SSL CA 2018 |
2023-06-06 - 2024-07-07 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
edgestatic.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
*.google-analytics.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://confermadate.info/
Frame ID: 3E173E3A0EB130404F6B8DB4157DE2F9
Requests: 27 HTTP requests in this frame
Screenshot
![](/screenshots/4ee0ff1e-7fd7-4244-963f-88e195891978.png)
Page Title
Nexi Business - LoginDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Contatta il Servizio Clienti
Search URL Search Domain Scan URL
Title: Recupera password
Search URL Search Domain Scan URL
Title: Trasparenza
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
confermadate.info/ |
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ |
26 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/ |
120 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cas.css
business.nexi.it/cas/themes/icbpi/css/ |
67 KB 67 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
zxcvbn.js
cdnjs.cloudflare.com/ajax/libs/zxcvbn/4.3.0/ |
802 KB 351 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
ajax.googleapis.com/ajax/libs/jqueryui/1.11.4/ |
235 KB 64 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.cookie.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/ |
36 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rt4AqIZ9_MNrRzyJHthKJGw3tP_nk7h-_5gjUbZ1kFokghjDO2V-9obbIO2g3G5OKPU=s180-rw
play-lh.googleusercontent.com/ |
7 KB 8 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
228 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye.svg
business.nexi.it/cas/themes/icbpi/images/ |
7 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NexiLogoBlue.svg
business.nexi.it/cas/themes/icbpi/images/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Regular.woff2
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Medium.woff2
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Semibold.woff2
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
close-white.svg
business.nexi.it/cas/themes/icbpi/images/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
303 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 246 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Semibold.woff
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Medium.woff
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Regular.woff
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Semibold.ttf
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Medium.ttf
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Karbon-Regular.ttf
business.nexi.it/cas/themes/icbpi/fonts/Karbon/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 45 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
business.nexi.it/cas/themes/icbpi/images/ |
1 KB 2 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Regular.woff2
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Medium.woff2
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Semibold.woff2
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Semibold.woff
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Medium.woff
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Regular.woff
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Semibold.ttf
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Medium.ttf
- Domain
- business.nexi.it
- URL
- https://business.nexi.it/cas/themes/icbpi/fonts/Karbon/Karbon-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nexi (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| initGA function| zxcvbn function| $ function| jQuery object| dataLayer function| togglePassword function| LoginError boolean| isNative object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.confermadate.info/ | Name: _ga Value: GA1.1.1629752726.1718119989 |
|
.confermadate.info/ | Name: _ga_2EQBRC1CMY Value: GS1.1.1718119989.1.0.1718119989.0.0.0 |
18 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
business.nexi.it
cdnjs.cloudflare.com
confermadate.info
maxcdn.bootstrapcdn.com
play-lh.googleusercontent.com
region1.google-analytics.com
www.googletagmanager.com
business.nexi.it
104.17.24.14
104.18.10.207
172.105.90.92
185.198.118.43
2001:4860:4802:34::36
2a00:1450:4001:812::2016
2a00:1450:4001:81c::200a
2a00:1450:4001:81d::2008
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1e9c18798cf396d787713937cd41bdbafa8d4dfe3a8172ab2b4a8a0d96314af1
23a2bb27702931578737c0c46c9c746a429393bf93fe292c57bb4551d06bc906
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
3bbf209d40b62cce8c4976e7a5ef232bb286d558122a1fbf7091479c296597c7
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
65ed35fd0b6fef076e7a0af5b7bb5ddab00e6d2ab6c82e88d4182cb55b9ad4cc
7d532c8ba8d80288bd8769a75eed99086d51f758e900bf5f93f89e05182e8037
8b3312e73f8b2a5191f9565dac20a57b75ac57092112fba9472402a8dc82f083
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
b0dc3cf0b100689cca6efe82da6d48f73f37ea405c47e9105d797a6fe12a523e
c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c
c7100f11a9a03494ad2d9b75e7277902669a4e6ef56f48e5fcf5944d39ee8443
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f09165b8f97719f6b18fabf0791d8b706e08faca757a8ead40ab99910b853570
fadd78e0514f7f66fe828f5e8739486a17985cba022ac7bb13682c87e08b7624