URL: https://nitromovil.com.elserver.com/
Submission Tags: phishingrod
Submission: On March 17 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 7 HTTP transactions. The main IP is 181.88.192.13, located in Rosario, Argentina and belongs to Telecom Argentina S.A., AR. The main domain is nitromovil.com.elserver.com.
TLS certificate: Issued by R3 on January 1st 2024. Valid for: 3 months.
This is the only time nitromovil.com.elserver.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 181.88.192.13 7303 (Telecom A...)
7 2
Domain Requested by
2 nitromovil.com.elserver.com nitromovil.com.elserver.com
0 ajax.googleapis.com Failed nitromovil.com.elserver.com
0 maxcdn.bootstrapcdn.com Failed nitromovil.com.elserver.com
0 fonts.googleapis.com Failed nitromovil.com.elserver.com
7 4

This site contains no links.

Subject Issuer Validity Valid
nitromovil.com.elserver.com
R3
2024-01-01 -
2024-03-31
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nitromovil.com.elserver.com/
Frame ID: 29595E7A0534C9F393B5116979AC8895
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Sitio no configurado

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

2
IPs

1
Countries

101 kB
Transfer

100 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
nitromovil.com.elserver.com/
3 KB
3 KB
Document
General
Full URL
https://nitromovil.com.elserver.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
181.88.192.13 Rosario, Argentina, ASN7303 (Telecom Argentina S.A., AR),
Reverse DNS
host13.181-88-192.telecom.net.ar
Software
FlowBalancer /
Resource Hash
826a32e3d7aa22dc86564ce042ba725b295da2f7864cde0f62e6aae52739db63

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-type
text/html
date
Sun, 17 Mar 2024 07:17:44 GMT
server
FlowBalancer
css
fonts.googleapis.com/
0
0

bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/
0
0

font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/
0
0

jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.0/
0
0

bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/
0
0

back1.jpg
nitromovil.com.elserver.com/
98 KB
98 KB
Image
General
Full URL
https://nitromovil.com.elserver.com/back1.jpg
Requested by
Host: nitromovil.com.elserver.com
URL: https://nitromovil.com.elserver.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
181.88.192.13 Rosario, Argentina, ASN7303 (Telecom Argentina S.A., AR),
Reverse DNS
host13.181-88-192.telecom.net.ar
Software
FlowBalancer /
Resource Hash
931a91365e97f59339e7b06434f659d37777c38041a171a26436ebda97a3b15b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://nitromovil.com.elserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 17 Mar 2024 07:17:44 GMT
last-modified
Thu, 18 Sep 2014 23:06:15 GMT
server
FlowBalancer
etag
"541b6567-18669"
x-cache-status
BYPASS
content-type
image/jpeg
accept-ranges
bytes
content-length
99945

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=PT+Sans:400,400italic,700
Domain
maxcdn.bootstrapcdn.com
URL
http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css
Domain
maxcdn.bootstrapcdn.com
URL
http://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css
Domain
ajax.googleapis.com
URL
http://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js
Domain
maxcdn.bootstrapcdn.com
URL
http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

6 Console Messages

Source Level URL
Text
network error URL: https://nitromovil.com.elserver.com/
Message:
Failed to load resource: the server responded with a status of 523 ()
security error URL: https://nitromovil.com.elserver.com/(Line 12)
Message:
Mixed Content: The page at 'https://nitromovil.com.elserver.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=PT+Sans:400,400italic,700'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://nitromovil.com.elserver.com/(Line 15)
Message:
Mixed Content: The page at 'https://nitromovil.com.elserver.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://nitromovil.com.elserver.com/(Line 18)
Message:
Mixed Content: The page at 'https://nitromovil.com.elserver.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://nitromovil.com.elserver.com/
Message:
Mixed Content: The page at 'https://nitromovil.com.elserver.com/' was loaded over HTTPS, but requested an insecure script 'http://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://nitromovil.com.elserver.com/
Message:
Mixed Content: The page at 'https://nitromovil.com.elserver.com/' was loaded over HTTPS, but requested an insecure script 'http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js'. This request has been blocked; the content must be served over HTTPS.