urlscan.io logo urlscan.io
SecurityTrails logo

nimi-group.com Open in urlscan Pro
45.63.99.67  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://tarjetassantander.chocek.com/
Effective URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Submission: On October 25 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 45.63.99.67, located in London, United Kingdom and belongs to AS-CHOOPA, US. The main domain is nimi-group.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 13th 2021. Valid for: a year.
This is the only time nimi-group.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 202.169.196.37 18199 (LINKTELEC...)
7 45.63.99.67 20473 (AS-CHOOPA)
7 2
Apex Domain
Subdomains		 Transfer
7 nimi-group.com
nimi-group.com
445 KB
1 chocek.com
tarjetassantander.chocek.com
324 B
7 2
Domain Requested by
7 nimi-group.com nimi-group.com
1 tarjetassantander.chocek.com 1 redirects
7 2

This site contains no links.

Subject Issuer Validity Valid
nimi-group.com
Sectigo RSA Domain Validation Secure Server CA		 2021-06-13 -
2022-07-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Frame ID: 6FBB6D0A41477B7B356A0F1BC6078453
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bienvenido a nuestra pagina

Page URL History Show full URLs

  1. https://tarjetassantander.chocek.com/ HTTP 301
    https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=2441... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

495 kB
Transfer

493 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tarjetassantander.chocek.com/ HTTP 301
    https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set home.php
nimi-group.com/wp-content/*/santawa3ramoha/particulares/
Redirect Chain
  • https://tarjetassantander.chocek.com/
  • https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
b3b6aff6334de123112c0f0a48c0d3e16872f1aa50e3995a6ccc902b6c31081c

Request headers

Host
nimi-group.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Date
Mon, 25 Oct 2021 16:03:24 GMT
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache

Redirect headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Server
Apache
Location
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Content-Length
319
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
style.css
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/ 		22 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/style.css
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
4a3ef8ddedacc4d90434553b9f3b83abc2a19cfdc32ec175dd302265785ee26e

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-5819"
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22553
Expires
Wed, 24 Nov 2021 16:03:24 GMT
normalize.css
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/ 		274 KB
275 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/normalize.css
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
93c3131e836d8fd636608abf98b8f63afe8f5953d1f8374bd0ce464acda3dac1

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-449e0"
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
281056
Expires
Wed, 24 Nov 2021 16:03:24 GMT
lg.svg
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/lg.svg
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
d8a1150c9d307b48c2c8481a3c534f2ebf147598a4f8abcf7811097327ff2154

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-106b"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4203
stifham.svg
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/stifham.svg
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
f578be5ab22ef9e3d5e63bf490d7862a2fdec4c459495cfefa4f8747732dcd89

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-6a3"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1699
box.svg
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/ 		774 B
1009 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/box.svg
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
afb25233666b221dd353b71c1e0c89f6daf3654eaa2df617e7b05cd8ead1a558

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/home.php?web=succes&local=_&id=24410873
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-306"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
774
bg1.jpg
nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/ 		138 KB
138 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/img/bg1.jpg
Requested by
Host: nimi-group.com
URL: https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.63.99.67 London, United Kingdom, ASN20473 (AS-CHOOPA, US),
Reverse DNS
www.nimi-group.com
Software
nginx /
Resource Hash
5727bc5d5d6c55a37f6cfb16cf058b023c6bd7ae0d786e1abb1b01133c90e4ee

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/style.css
Cookie
PHPSESSID=vm46vr9vnnh9ripduf1eufok24
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://nimi-group.com/wp-content/*/santawa3ramoha/particulares/layout/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 25 Oct 2021 16:03:24 GMT
Last-Modified
Fri, 28 Dec 2018 23:28:30 GMT
Server
nginx
ETag
"5c26b19e-2271b"
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
141083
Expires
Wed, 24 Nov 2021 16:03:24 GMT
truncated
/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
30653592a2c98c1fd17f1c76ba7be5f8a41575d118262c98a1162fc0cf6279e7

Request headers

Referer
Origin
https://nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a6730cd5a916013a4efaa2441f429ac9e33d54785db5641e2f94625cad540fd4

Request headers

Referer
Origin
https://nimi-group.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

1 Cookies

Domain/Path Name / Value
nimi-group.com/ Name: PHPSESSID
Value: vm46vr9vnnh9ripduf1eufok24