urlscan.io logo urlscan.io
SecurityTrails logo

www.nexiservice.xyz Open in urlscan Pro
212.224.107.10  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nexiservice.xyz/
Effective URL: https://www.nexiservice.xyz/
Submission Tags: @ecarlesi threat phishing nexipayments Search All
Submission: On June 29 via api from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 25 HTTP transactions. The main IP is 212.224.107.10, located in Germany and belongs to DE-FIRSTCOLO firstcolo.net, DE. The main domain is www.nexiservice.xyz.
TLS certificate: Issued by R11 on June 29th 2024. Valid for: 3 months.
This is the only time www.nexiservice.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2 212.224.107.10 44066 (DE-FIRSTC...)
16 185.198.118.126 35051 (NEXI-AS)
25 3
Apex Domain
Subdomains		 Transfer
16 nexi.it
www.nexi.it
566 KB
2 nexiservice.xyz
nexiservice.xyz
www.nexiservice.xyz
46 KB
25 2
Domain Requested by
16 www.nexi.it www.nexiservice.xyz
www.nexi.it
1 www.nexiservice.xyz
1 nexiservice.xyz 1 redirects
25 3

This site contains links to these domains. Also see Links.

Domain
apps.apple.com
play.google.com
appgallery.huawei.com
privati.nexi.it
www.nexi.it
Subject Issuer Validity Valid
nexiservice.xyz
R11		 2024-06-29 -
2024-09-27		 3 months crt.sh
www.nexi.it
GlobalSign RSA OV SSL CA 2018		 2023-08-04 -
2024-08-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.nexiservice.xyz/
Frame ID: DA5D46657C65BE53A313CEBEB85589B1
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Area Personale

Page URL History Show full URLs

  1. https://nexiservice.xyz/ HTTP 301
    https://www.nexiservice.xyz/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/

Page Statistics

25
Requests

68 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

612 kB
Transfer

1160 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nexiservice.xyz/ HTTP 301
    https://www.nexiservice.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.nexiservice.xyz/
Redirect Chain
  • https://nexiservice.xyz/
  • https://www.nexiservice.xyz/
325 KB
46 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.nexiservice.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.224.107.10 , Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS
win.ultahost.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c79f39f0a15add7aa1508b429a248bb2ce7c49008f74569cc45d1d40af995a72

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
br
content-length
46803
content-type
text/html; charset=UTF-8
date
Sat, 29 Jun 2024 17:14:19 GMT
server
Microsoft-IIS/10.0
vary
Accept-Encoding
x-powered-by
ASP.NET
x-powered-by-plesk
PleskWin

Redirect headers

content-length
151
content-type
text/html; charset=UTF-8
date
Sat, 29 Jun 2024 17:14:19 GMT
location
https://www.nexiservice.xyz/
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
x-powered-by-plesk
PleskWin
clientlib-site.min.css
www.nexi.it/etc.clientlibs/nexinew/clientlibs/ 		289 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site.min.css
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
a463d7ba0746379c5637c7bde2b988eb8966123424ee92c01081652ebaeb45f4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 28 May 2024 09:37:26 GMT
ETag
"482bc-6198061bc2b0b-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
text/css
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=57
Content-Length
45646
nexi-logo-white.svg
www.nexi.it/content/dam/nexinew/icone/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexinew/icone/nexi-logo-white.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
4c399d83f036f296ac9cdc6cbb47af8f77b8892218b7c0ae7c26b292f4eddd08
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 28 May 2024 09:37:28 GMT
ETag
"72c-6198061de70b9-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
772
login_pt.jpg
www.nexi.it/content/dam/nexinew/login/ 		425 KB
426 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexinew/login/login_pt.jpg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
36bb0d74373b6d4d97b8d028fdf5b72e6bcd42b757d17b9b2801205c53200d83
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Last-Modified
Tue, 28 May 2024 09:37:38 GMT
ETag
"6a3fc-6198062768ed4"
X-Frame-Options
SAMEORIGIN
Vary
Origin
Content-Type
image/jpeg
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=18
Content-Length
435196
NexiPay.svg
www.nexi.it/content/dam/mos/bar-e-ristoranti/icon/ 		9 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/mos/bar-e-ristoranti/icon/NexiPay.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
a8d50480799b7d6b5aa37d2eba6ac1fe64dbaf2749cc6f3101efa839760eb3cb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Fri, 07 Jun 2024 10:09:13 GMT
ETag
"2337-61a49fdca7de6-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, HEAD
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=75
Content-Length
3309
app_store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 		15 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/new-login-2019/icons/app_store.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:40 GMT
ETag
"3dc8-616cad6a562c3-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
6270
google_play.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 		25 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/new-login-2019/icons/google_play.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:24 GMT
ETag
"62ff-616cad5abb784-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=56
Content-Length
18729
huawei-store.svg
www.nexi.it/content/dam/nexi/new-login-2019/icons/ 		22 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/new-login-2019/icons/huawei-store.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:10:59 GMT
ETag
"5675-616cad42ce35d-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
14036
icon-close.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-close.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:10:59 GMT
ETag
"628-616cad42cd68b-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
789
icon-phone.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:24 GMT
ETag
"fb0-616cad5a95436-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
1520
icon-close-white.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-close-white.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:00 GMT
ETag
"637-616cad4452221-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
805
icon-phone-warning-white.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-phone-warning-white.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:12:02 GMT
ETag
"f29-616cad7efc2e8-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=55
Content-Length
1500
ico-down-blue.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		898 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/ico-down-blue.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:40 GMT
ETag
"382-616cad6a6f51d-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
535
icon-blocked.svg
www.nexi.it/content/dam/nexi/img/icone/svg/ 		935 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexi/img/icone/svg/icon-blocked.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 23 Apr 2024 22:11:21 GMT
ETag
"3a7-616cad57f44d9-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=72
Content-Length
489
nexi-logo-dark.svg
www.nexi.it/content/dam/nexinew/icone/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nexi.it/content/dam/nexinew/icone/nexi-logo-dark.svg
Requested by
Host: www.nexiservice.xyz
URL: https://www.nexiservice.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
2bef6e7b4bd23a7009ddf29a2896bbdc7e25a365b501b2c34b5fd42917e12337
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
br
Last-Modified
Tue, 28 May 2024 09:37:28 GMT
ETag
"8fa-6198061dfce10-br"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding,Origin
Content-Type
image/svg+xml
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
892
KarbonApp.woff2
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
KarbonAppMedium.woff2
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
KarbonAppSemibold.woff2
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
nexinew.ttf
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/ 		0
0
KarbonApp.woff
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
KarbonAppSemibold.woff
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
KarbonAppMedium.woff
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/ 		0
0
nexinew.woff
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/ 		0
0
favicon.png
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ 		801 B
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/favicon.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
e5c0e42bb6a3f3a244f8724587feb409c48a467a098e94c708bbb58117d41369
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Last-Modified
Tue, 28 May 2024 09:37:33 GMT
ETag
"321-619806220d3ee"
X-Frame-Options
SAMEORIGIN
Vary
Origin
Content-Type
image/png
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=91
Content-Length
801
favicon.ico
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ 		34 KB
34 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.198.118.126 , Italy, ASN35051 (NEXI-AS, IT),
Reverse DNS
Software
/
Resource Hash
ddcb12028caf567e0f9d6af1adc7e51df78b7c800f99eab2608c11ca47f9b77e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.nexiservice.xyz/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 29 Jun 2024 17:14:20 GMT
Content-Security-Policy
frame-ancestors 'self'
Last-Modified
Tue, 28 May 2024 09:37:26 GMT
ETag
"86be-6198061bf3ab8"
X-Frame-Options
SAMEORIGIN
Vary
Origin
Content-Type
image/vnd.microsoft.icon
P3P
policyref="/w3c/p3p.xml", CP="IDC DSP COR NID DEVi OUR BUS INT"
Cache-Control
max-age=8380800, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=15
Content-Length
34494

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff2
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff2
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff2
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.ttf
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff
Domain
www.nexi.it
URL
https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

17 Console Messages

Source Level URL
Text
recommendation warning URL: https://www.nexiservice.xyz/
Message:
[DOM] Found 2 elements with non-unique id #user-name: (More info: https://goo.gl/9p2vKq) %o %o
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff2' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff2' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff2' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.ttf' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonApp.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppSemibold.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/karbon/KarbonAppMedium.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://www.nexiservice.xyz/
Message:
Access to font at 'https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.woff' from origin 'https://www.nexiservice.xyz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/fonts/nexinew/nexinew.woff
Message:
Failed to load resource: net::ERR_FAILED