nexi.104-194-156-95.cprapid.com
Open in
urlscan Pro
104.194.156.95
Malicious Activity!
Public Scan
Effective URL: https://nexi.104-194-156-95.cprapid.com/
Submission Tags: @ecarlesi threat #phishing #nexipayments Search All
Submission: On November 03 via api from CA — Scanned from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 3rd 2023. Valid for: 3 months.
This is the only time nexi.104-194-156-95.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nexi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 23 | 104.194.156.95 104.194.156.95 | 14956 (ROUTERHOS...) (ROUTERHOSTING) | |
2 | 54.157.15.93 54.157.15.93 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2600:1408:c40... 2600:1408:c400:195::1e80 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 1 | 52.203.187.67 52.203.187.67 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 63.140.38.160 63.140.38.160 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 185.198.117.126 185.198.117.126 | 35051 (NEXI-AS) (NEXI-AS) | |
1 | 54.145.94.64 54.145.94.64 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 63.140.38.100 63.140.38.100 | 14618 (AMAZON-AES) (AMAZON-AES) | |
29 | 7 |
ASN14956 (ROUTERHOSTING, US)
PTR: 104.194.156.95.static.quadranet.com
nexi.104-194-156-95.cprapid.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-15-93.compute-1.amazonaws.com
dpm.demdex.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-187-67.compute-1.amazonaws.com
cm.everesttech.net |
ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-160.data.adobedc.net
nexipayments.tt.omtrdc.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-94-64.compute-1.amazonaws.com
nexipayments.demdex.net |
ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-100.data.adobedc.net
nexipayments.sc.omtrdc.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
cprapid.com
1 redirects
nexi.104-194-156-95.cprapid.com |
2 MB |
3 |
demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 228 nexipayments.demdex.net |
5 KB |
2 |
omtrdc.net
nexipayments.tt.omtrdc.net nexipayments.sc.omtrdc.net |
1 KB |
1 |
nexi.it
www.nexi.it |
423 KB |
1 |
everesttech.net
1 redirects
cm.everesttech.net — Cisco Umbrella Rank: 1275 |
517 B |
1 |
adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 466 |
12 KB |
29 | 6 |
Domain | Requested by | |
---|---|---|
23 | nexi.104-194-156-95.cprapid.com |
1 redirects
nexi.104-194-156-95.cprapid.com
|
2 | dpm.demdex.net |
nexi.104-194-156-95.cprapid.com
|
1 | nexipayments.sc.omtrdc.net |
nexi.104-194-156-95.cprapid.com
|
1 | nexipayments.demdex.net |
nexi.104-194-156-95.cprapid.com
|
1 | www.nexi.it |
nexi.104-194-156-95.cprapid.com
|
1 | nexipayments.tt.omtrdc.net |
nexi.104-194-156-95.cprapid.com
|
1 | cm.everesttech.net | 1 redirects |
1 | assets.adobedtm.com |
nexi.104-194-156-95.cprapid.com
|
29 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nexi.it |
apps.apple.com |
play.google.com |
appgallery.huawei.com |
privati.nexi.it |
Subject Issuer | Validity | Valid | |
---|---|---|---|
nexi.104-194-156-95.cprapid.com cPanel, Inc. Certification Authority |
2023-11-03 - 2024-02-01 |
3 months | crt.sh |
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-09-26 - 2024-10-26 |
a year | crt.sh |
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-07-11 - 2024-08-10 |
a year | crt.sh |
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1 |
2023-08-22 - 2024-09-21 |
a year | crt.sh |
www.nexi.it GlobalSign RSA OV SSL CA 2018 |
2023-08-04 - 2024-08-21 |
a year | crt.sh |
*.sc.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1 |
2023-02-10 - 2024-03-08 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://nexi.104-194-156-95.cprapid.com/
Frame ID: 08E4E88857BEB729AEB3BDE96874794A
Requests: 24 HTTP requests in this frame
Frame:
https://nexipayments.demdex.net/dest5.html?d_nsid=0
Frame ID: 263C4B8FD22EEFFCDC827531BFDCED05
Requests: 1 HTTP requests in this frame
Frame:
https://nexi.104-194-156-95.cprapid.com/Area%20Personale_files/box-a1ae2079824d1c48aa9ce06efb256f18.html
Frame ID: 6B13B924E7F45BC4A2D8EEAEA4E69F81
Requests: 1 HTTP requests in this frame
Frame:
https://nexi.104-194-156-95.cprapid.com/Area%20Personale_files/bframe.html
Frame ID: C436070513CFCA777CAD52FBA2C1B835
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Area PersonalePage URL History Show full URLs
-
http://nexi.104-194-156-95.cprapid.com/
HTTP 301
https://nexi.104-194-156-95.cprapid.com/ Page URL
Detected technologies
Google Tag Manager (Tag Managers) ExpandDetected patterns
- <!-- (?:End )?Google Tag Manager -->
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Cambia portale
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Non sei tu?
Search URL Search Domain Scan URL
Title: Hai dimenticato le credenziali?
Search URL Search Domain Scan URL
Title: REGISTRATI
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://nexi.104-194-156-95.cprapid.com/
HTTP 301
https://nexi.104-194-156-95.cprapid.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://cm.everesttech.net/cm/dd?d_uuid=58274378819073657603457654234298828599 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZUThZwAAAKy5PQN_
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nexi.104-194-156-95.cprapid.com/ Redirect Chain
|
298 KB 299 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
launch-a40afd213c32.min.js.download
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
228 KB 228 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
537 KB 537 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js.download
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
87 KB 88 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style(1).css
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stylepop.css
nexi.104-194-156-95.cprapid.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo--light-double.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app_store.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
15 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_play.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
25 KB 25 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
huawei-store.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo--dark-double.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id
dpm.demdex.net/ |
371 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AppMeasurement.min.js
assets.adobedtm.com/extensions/EP40e3bec801244c59a61bf06eb622a63c/ |
33 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=ZUThZwAAAKy5PQN_
dpm.demdex.net/ Redirect Chain
|
42 B 940 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
delivery
nexipayments.tt.omtrdc.net/rest/v1/ |
355 B 859 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_pt_background_02.jpg
www.nexi.it/content/dam/nexi/portale-titolari/pagine-login/portale-titolari/ |
422 KB 423 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karbon-medium-webfont.woff
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karbon-regular-webfont.woff
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
nexipayments.demdex.net/ Frame 263C |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_play.svg
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ |
25 KB 25 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
box-a1ae2079824d1c48aa9ce06efb256f18.html
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ Frame 6B13 |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bframe.html
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ Frame C436 |
8 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karbon-semibold-webfont.woff
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonApp-Medium.ttf
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonApp-Regular.ttf
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonApp-Semibold.ttf
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles__ltr.css
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ Frame C436 |
51 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recaptcha__it.js.download
nexi.104-194-156-95.cprapid.com/Area%20Personale_files/ Frame C436 |
345 KB 345 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s6367513993776
nexipayments.sc.omtrdc.net/b/ss/nexipayments.production/1/JS-2.22.1-LBWB/ |
43 B 344 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nexi (Banking)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| documentPictureInPicture object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| $ function| jQuery function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| s object| s_i_nexipayments.production9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nexi.104-194-156-95.cprapid.com/ | Name: COOKIE_KEY Value: 169901296616 |
|
.cprapid.com/ | Name: at_check Value: true |
|
.demdex.net/ | Name: demdex Value: 58274378819073657603457654234298828599 |
|
.cprapid.com/ | Name: AMCVS_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: 1 |
|
.cprapid.com/ | Name: mbox Value: session#90f925e3b80a4758b632a40a05c00a8b#1699014828|PC#90f925e3b80a4758b632a40a05c00a8b.34_0#1762257768 |
|
.everesttech.net/ | Name: everest_g_v2 Value: g_surferid~ZUThZwAAAKy5PQN_ |
|
.cprapid.com/ | Name: s_cc Value: true |
|
.dpm.demdex.net/ | Name: dpm Value: 58274378819073657603457654234298828599 |
|
.cprapid.com/ | Name: AMCV_6A724E255ED5F2A60A495E0E%40AdobeOrg Value: -1124106680%7CMCIDTS%7C19665%7CMCMID%7C64155935128190671992750570839616129416%7CMCAAMLH-1699617767%7C7%7CMCAAMB-1699617767%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1699020167s%7CNONE%7CMCSYNCSOP%7C411-19672%7CvVersion%7C5.2.0 |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.adobedtm.com
cm.everesttech.net
dpm.demdex.net
nexi.104-194-156-95.cprapid.com
nexipayments.demdex.net
nexipayments.sc.omtrdc.net
nexipayments.tt.omtrdc.net
www.nexi.it
104.194.156.95
185.198.117.126
2600:1408:c400:195::1e80
52.203.187.67
54.145.94.64
54.157.15.93
63.140.38.100
63.140.38.160
0814a79883b4070863f8185270ea202fbb53791a439b221fd73afb146b0ded5d
0a6860b639d3f65209ac59599c26f7027aef515187c186b306a2e07c2c32e338
398d767976e72087c0753d1d76d94ac97da979091251c2709d178965fe777e7e
509bf9e83d3ca5add614196c02c8e0ce59731d3d1a10552c944b74d86019d866
5a9832e8fbf9271704a38054b70a3623cc10a16404d01d23133ea1708c470f28
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
86dbb95c983a9c81e1806afa854b9713ec33ee7e279712e6eee946c6b2e8f92d
8a328eaf97de4600f72891d5658426d62b7afff1cc12667968e8db621a38322c
92c5b25edbc4647c55be848b92ea22fd4618cc3252a2364025262e18a7430f84
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
a39f6fbdbc2bdac48833a34ff6114274f1690831e2ee53168e8f871e139ed5e7
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
c96d6c44d50646e4096806c2f0ba110954d52f55150d7b34d0d7ba6872486266
dc50ef7f80147b0a2407f5a560125db8b36c799d5a5a32b17d83fea8f03492e5
e23d948465486170b59683bfa6dbb7913be2420d5e1448f98faae185d7f9fca4
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629