www.nexi-termini-e-condizioni.com Open in urlscan Pro
111.90.149.160 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.nexi-termini-e-condizioni.com/
Effective URL:
https://www.nexi-termini-e-condizioni.com/accedi.php
Submission: On December 17 via automatic, source certstream-suspicious (December 17th 2022, 6:26:31 am UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 111.90.149.160, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is www.nexi-termini-e-condizioni.com.
TLS certificate: Issued by R3 on December 17th 2022. Valid for: 3 months.

This is the only time www.nexi-termini-e-condizioni.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	111.90.149.160 111.90.149.160		45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
9	1

10 111.90.149.160 (Malaysia) 1 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

www.nexi-termini-e-condizioni.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	nexi-termini-e-condizioni.com 1 redirects www.nexi-termini-e-condizioni.com	155 KB
9	1

	Domain	Requested by
10	www.nexi-termini-e-condizioni.com	1 redirects www.nexi-termini-e-condizioni.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
nexi-termini-e-condizioni.com R3	`2022-12-17` - `2023-03-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.nexi-termini-e-condizioni.com/accedi.php
Frame ID: 914C7D001052A64A936BE4ADF95D54AE
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NexiPay

Page URL History Show full URLs

https://www.nexi-termini-e-condizioni.com/ HTTP 302
https://www.nexi-termini-e-condizioni.com/accedi.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

155 kB
Transfer

262 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.nexi-termini-e-condizioni.com/ HTTP 302
https://www.nexi-termini-e-condizioni.com/accedi.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request accedi.php Show response www.nexi-termini-e-condizioni.com/ Redirect Chain https://www.nexi-termini-e-condizioni.com/ https://www.nexi-termini-e-condizioni.com/accedi.php	41 KB 13 KB	161ms 161ms	Document text/html	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/accedi.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `d2e14707d2790e726bf2d867b1888113b01e282838a351bfaded49f0b7ca64dc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 12944 content-type text/html; charset=UTF-8 date Sat, 17 Dec 2022 06:26:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Sat, 17 Dec 2022 06:26:25 GMT location accedi.php server nginx
GET H2	200	main.css www.nexi-termini-e-condizioni.com/nxi_filez/css/	24 KB 6 KB	306ms 306ms	Stylesheet text/css	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/accedi.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `6efec2153bf19e48400a637caa70bb072ab18fa2d4a0fbbb75fcfa7fa20b815f` Request headers accept-language de-DE,de;q=0.9 Referer https://www.nexi-termini-e-condizioni.com/accedi.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT content-encoding gzip last-modified Wed, 28 Sep 2022 16:17:12 GMT server nginx etag W/"63347388-5e9a" vary Accept-Encoding content-type text/css cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	logo.png www.nexi-termini-e-condizioni.com/nxi_filez/img/	29 KB 29 KB	307ms 307ms	Image image/png	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/img/logo.png Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/accedi.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `77ac0f5c53cf673bbd41b876a6c483b0ab347eb0098aa5e9cfe53923bd3bde2d` Request headers accept-language de-DE,de;q=0.9 Referer https://www.nexi-termini-e-condizioni.com/accedi.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT last-modified Wed, 28 Sep 2022 14:51:30 GMT server nginx etag "63345f72-7430" content-type image/png cache-control max-age=315360000 accept-ranges bytes content-length 29744 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery.js Show response www.nexi-termini-e-condizioni.com/nxi_filez/js/	87 KB 30 KB	444ms 443ms	Script application/javascript	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/js/jquery.js Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/accedi.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b` Request headers accept-language de-DE,de;q=0.9 Referer https://www.nexi-termini-e-condizioni.com/accedi.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT content-encoding gzip last-modified Fri, 08 Jul 2022 11:54:40 GMT server nginx etag W/"62c81b00-15d9f" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	eye.svg www.nexi-termini-e-condizioni.com/nxi_filez/img/	7 KB 2 KB	458ms 458ms	Image image/svg+xml	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/img/eye.svg Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `8949f4d59d3cd113a92c382a3bac23b5d407a7613120119c10dadfbfbe90c55b` Request headers accept-language de-DE,de;q=0.9 Referer https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT content-encoding gzip last-modified Wed, 28 Sep 2022 14:43:02 GMT server nginx etag W/"63345d76-1bfa" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	nexi-logo-dark.svg www.nexi-termini-e-condizioni.com/nxi_filez/img/	2 KB 1 KB	458ms 457ms	Image image/svg+xml	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/img/nexi-logo-dark.svg Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `4ce28d912b3d8b3e7852af4222918fada1cf5002b4b09fcf66966420cf0706da` Request headers accept-language de-DE,de;q=0.9 Referer https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT content-encoding gzip last-modified Wed, 28 Sep 2022 14:38:38 GMT server nginx etag W/"63345c6e-8cf" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	Karbon-Regular.woff www.nexi-termini-e-condizioni.com/nxi_filez/fonts/	24 KB 24 KB	458ms 457ms	Font font/woff	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/fonts/Karbon-Regular.woff Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6` Request headers Referer https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Origin https://www.nexi-termini-e-condizioni.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT last-modified Wed, 28 Sep 2022 14:24:20 GMT server nginx etag "63345914-5ef4" content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 24308 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	Karbon-Medium.woff www.nexi-termini-e-condizioni.com/nxi_filez/fonts/	24 KB 25 KB	458ms 457ms	Font font/woff	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/fonts/Karbon-Medium.woff Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259` Request headers Referer https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Origin https://www.nexi-termini-e-condizioni.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT last-modified Wed, 28 Sep 2022 14:24:16 GMT server nginx etag "63345910-617c" content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 24956 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	Karbon-Semibold.woff www.nexi-termini-e-condizioni.com/nxi_filez/fonts/	24 KB 25 KB	458ms 458ms	Font font/woff	111.90.149.160 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://www.nexi-termini-e-condizioni.com/nxi_filez/fonts/Karbon-Semibold.woff Requested by Host: www.nexi-termini-e-condizioni.com URL: https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.90.149.160 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS server1.kamon.la Software nginx / Resource Hash `0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6` Request headers Referer https://www.nexi-termini-e-condizioni.com/nxi_filez/css/main.css Origin https://www.nexi-termini-e-condizioni.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 06:26:26 GMT last-modified Wed, 28 Sep 2022 14:24:26 GMT server nginx etag "6334591a-61c8" content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 25032 expires Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nexi-termini-e-condizioni.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: dpf4plicdrmj9l589lgud1romk

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.nexi-termini-e-condizioni.com
111.90.149.160
0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6
4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259
4ce28d912b3d8b3e7852af4222918fada1cf5002b4b09fcf66966420cf0706da
6efec2153bf19e48400a637caa70bb072ab18fa2d4a0fbbb75fcfa7fa20b815f
77ac0f5c53cf673bbd41b876a6c483b0ab347eb0098aa5e9cfe53923bd3bde2d
8949f4d59d3cd113a92c382a3bac23b5d407a7613120119c10dadfbfbe90c55b
ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
d2e14707d2790e726bf2d867b1888113b01e282838a351bfaded49f0b7ca64dc

www.nexi-termini-e-condizioni.com Open in urlscan Pro 111.90.149.160 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

155 kBTransfer

262 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

www.nexi-termini-e-condizioni.com Open in urlscan Pro
111.90.149.160 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

155 kB
Transfer

262 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!