sicurezza-nexi-psd2.63-250-47-242.cprapid.com Open in urlscan Pro
63.250.47.242 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com/lD/
Submission: On October 30 via api (October 30th 2023, 9:42:05 pm UTC) from US — Scanned from US

Summary HTTP 1 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 63.250.47.242, located in United States and belongs to NAMECHEAP-NET, US. The main domain is sicurezza-nexi-psd2.63-250-47-242.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 30th 2023. Valid for: 3 months.

This is the only time sicurezza-nexi-psd2.63-250-47-242.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nexi (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1	63.250.47.242 63.250.47.242		22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2

1 63.250.47.242 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: bad-investment.quarantine-pnap-vlan51.web-hosting.com

sicurezza-nexi-psd2.63-250-47-242.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	cprapid.com sicurezza-nexi-psd2.63-250-47-242.cprapid.com	2 MB
1	1

	Domain	Requested by
1	sicurezza-nexi-psd2.63-250-47-242.cprapid.com
1	1

This site contains links to these domains. Also see Links.

Domain
www.nexi.it
apps.apple.com
play.google.com
appgallery.huawei.com
privati.nexi.it

Subject Issuer	Validity	Valid
sicurezza-nexi-psd2.63-250-47-242.cprapid.com cPanel, Inc. Certification Authority	`2023-10-30` - `2024-01-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com/lD/
Frame ID: F1ECEEBA23A535531538003E27BB3A8A
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Area Personale

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1871 kB
Transfer

1948 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nexi.it/

Search URL Search Domain Scan URL

URL: https://www.nexi.it/accedi.html
Title: Cambia portale

Search URL Search Domain Scan URL

URL: https://apps.apple.com/it/app/nexi-pay/id518695175

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=it.icbpi.mobile&hl=it

Search URL Search Domain Scan URL

URL: https://appgallery.huawei.com/#/app/C101454369

Search URL Search Domain Scan URL

URL: https://privati.nexi.it/registration/intro
Title: REGISTRATI

Search URL Search Domain Scan URL

URL: https://www.nexi.it/content/dam/nexi/new-login-2019/informativa_privacy.pdf
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
14 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sicurezza-nexi-psd2.63-250-47-242.cprapid.com/lD/	2 MB 2 MB	616ms 93ms	Document text/html	63.250.47.242 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com/lD/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 63.250.47.242 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS bad-investment.quarantine-pnap-vlan51.web-hosting.com Software Apache / Resource Hash `5bbca17a5e54568f083fb887832ef4592bf46df0d70406b380780b5fa3777092` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 1841740 Content-Type text/html Date Mon, 30 Oct 2023 21:42:00 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 18 Nov 2021 15:20:24 GMT Server Apache
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	15 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	25 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	22 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259` Request headers Referer Origin https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6` Request headers Referer Origin https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	898 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	935 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	24 KB 24 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6` Request headers Referer Origin https://sicurezza-nexi-psd2.63-250-47-242.cprapid.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| documentPictureInPicture function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sicurezza-nexi-psd2.63-250-47-242.cprapid.com
63.250.47.242
0696904b24ea3bdaf9ee857ded71391ccd44d40b84334571a5c5e71f93b4a0c6
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
4061275193aa1a5245941f7768b307219fc0f86f44dc1cf4d293168b93a72259
5bbca17a5e54568f083fb887832ef4592bf46df0d70406b380780b5fa3777092
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
64e35e6e3e1969550eda7af80ded7e8e7ffdc15dd6a2bfdc4ed9bf1cb82cc762
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
ade827343407a2a81168acb91cabc1ed7d83de7010966dd1b7f06f4e0344b9e6
c37a1253313f01ecf7b8d5ac83025a8059d161d955ecbe5254c99d4edf6989fc
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c

sicurezza-nexi-psd2.63-250-47-242.cprapid.com Open in urlscan Pro 63.250.47.242 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1871 kBTransfer

1948 kBSize

0 Cookies

7 Outgoing links

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

sicurezza-nexi-psd2.63-250-47-242.cprapid.com Open in urlscan Pro
63.250.47.242 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1871 kB
Transfer

1948 kB
Size

0
Cookies

1 HTTP transactions
14 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!