nexxus-es.com
Open in
urlscan Pro
71.6.165.217
Malicious Activity!
Public Scan
URL:
http://nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/
Submission: On February 28 via automatic, source phishtank
Submission: On February 28 via automatic, source phishtank
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 71.6.165.217, located in
San Diego, United States and
belongs to CARINET - CariNet, Inc., US.
The main domain is nexxus-es.com.
This is the only time nexxus-es.com was scanned on urlscan.io!
This is the only time nexxus-es.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online) Generic (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 71.6.165.217 71.6.165.217 | 10439 (CARINET) (CARINET - CariNet) | |
| 1 | 2a00:1450:400... 2a00:1450:400f:808::2003 | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
| 10 | 2 |
9
71.6.165.217
(San Diego, United States)
ASN10439 (CARINET - CariNet, Inc., US)
PTR: host.fatuch.com
ASN10439 (CARINET - CariNet, Inc., US)
PTR: host.fatuch.com
| nexxus-es.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
nexxus-es.com
nexxus-es.com |
72 KB |
| 1 |
gstatic.com
ssl.gstatic.com |
10 KB |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | nexxus-es.com |
nexxus-es.com
|
| 1 | ssl.gstatic.com |
nexxus-es.com
|
| 10 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.google.com Google Internet Authority G2 |
2017-02-01 - 2017-04-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/
Frame ID: 18293.1
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_2x.png
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
avatar_2x.png
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
yahoo.jpg
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gmail.jpg
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hotmail.jpg
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aol.jpg
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
other.jpg
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
13 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_strip_2x.png
ssl.gstatic.com/accounts/ui/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
nexxus-es.com/mes/data_analysis/microsoft_documentations_0938475/sent_secured_documents_01/index_files/ |
417 B 417 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online) Generic (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexxus-es.com
ssl.gstatic.com
2a00:1450:400f:808::2003
71.6.165.217
178767ce97ec8c27c19e88741932c683be12183204026aa9976bbf0a61e3569d
476a4d978eb0383ecae26b0e0b53ea98a60f2f804f105c8493c0ab1fd6efe871
567758ab630b2a23334b6ee1efb3cb85305c2c32b8cf06ee084e0005e17a5e8b
63ca8df4a524b99d0abb544ab32d8ce548639c59a041ea6520505721654b3ba2
739883765831e9363144b24fa667753c2a871688b5460cd89d56587ca4cfcacc
93fbe5513637cd77f50456e747b01bea7b6ff677fe71371100ff87f24ef3427f
ace2d10c962f4ce20e60ba6161aba55b244c008cd1bf80f50211462de2f3458d
b2d3305551055e5d28aea38f218ee6ff6006afb8c80cc4f206a206bcb758df7c
da580356cbbd8d4018836fca4463780b52d36b50fa85f16fbe42fba73eba3e89
e08b1ddaaaeb242dcfe4ad22711e84fd9248496cf8152190c5ab0698be731d8e