urlscan.io logo urlscan.io
SecurityTrails logo

litera.city Open in urlscan Pro
191.6.223.182  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://alyxia.akania.net/HLOO
Effective URL: https://litera.city/ServerPlan/dominio-serverplan/auth/payment.php?credential
Submission: On January 09 via manual from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 191.6.223.182, located in Brazil and belongs to Cyberweb Networks Ltda, BR. The main domain is litera.city.
TLS certificate: Issued by R3 on December 14th 2022. Valid for: 3 months.
This is the only time litera.city was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Sella (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 74.208.236.75 8560 (IONOS-AS ...)
1 3 191.6.223.182 28299 (Cyberweb ...)
2 2
Apex Domain
Subdomains		 Transfer
3 litera.city
litera.city
87 KB
2 akania.net
alyxia.akania.net
505 B
2 2
Domain Requested by
3 litera.city 1 redirects litera.city
2 alyxia.akania.net 2 redirects
2 2

This site contains links to these domains. Also see Links.

Domain
www.axerve.com
windows.microsoft.com
www.mozilla.org
www.google.com
Subject Issuer Validity Valid
litera.city
R3		 2022-12-14 -
2023-03-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://litera.city/ServerPlan/dominio-serverplan/auth/payment.php?credential
Frame ID: 7235396A4FE136457EDA13398B78BBCF
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Pagina di pagamento Carta di Credito

Page URL History Show full URLs

  1. http://alyxia.akania.net/HLOO HTTP 301
    http://alyxia.akania.net/HLOO/ HTTP 302
    https://litera.city/ServerPlan/dominio-serverplan/?95aa5362 HTTP 302
    https://litera.city/ServerPlan/dominio-serverplan/auth/index.php Page URL
  2. https://litera.city/ServerPlan/dominio-serverplan/auth/payment.php?credential Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

87 kB
Transfer

279 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://alyxia.akania.net/HLOO HTTP 301
    http://alyxia.akania.net/HLOO/ HTTP 302
    https://litera.city/ServerPlan/dominio-serverplan/?95aa5362 HTTP 302
    https://litera.city/ServerPlan/dominio-serverplan/auth/index.php Page URL
  2. https://litera.city/ServerPlan/dominio-serverplan/auth/payment.php?credential Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://alyxia.akania.net/HLOO HTTP 301
  • http://alyxia.akania.net/HLOO/ HTTP 302
  • https://litera.city/ServerPlan/dominio-serverplan/?95aa5362 HTTP 302
  • https://litera.city/ServerPlan/dominio-serverplan/auth/index.php

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.php
litera.city/ServerPlan/dominio-serverplan/auth/
Redirect Chain
  • http://alyxia.akania.net/HLOO
  • http://alyxia.akania.net/HLOO/
  • https://litera.city/ServerPlan/dominio-serverplan/?95aa5362
  • https://litera.city/ServerPlan/dominio-serverplan/auth/index.php
85 B
148 B 		Document
General
Check archive.org
Download Go to
Full URL
https://litera.city/ServerPlan/dominio-serverplan/auth/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
191.6.223.182 , Brazil, ASN28299 (Cyberweb Networks Ltda, BR),
Reverse DNS
web10f76.kinghost.net
Software
Apache /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 09 Jan 2023 18:08:15 GMT
server
Apache
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 09 Jan 2023 18:08:14 GMT
location
auth/index.php
server
Apache
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
Primary Request payment.php
litera.city/ServerPlan/dominio-serverplan/auth/ 		213 KB
87 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://litera.city/ServerPlan/dominio-serverplan/auth/payment.php?credential
Requested by
Host: litera.city
URL: https://litera.city/ServerPlan/dominio-serverplan/auth/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
191.6.223.182 , Brazil, ASN28299 (Cyberweb Networks Ltda, BR),
Reverse DNS
web10f76.kinghost.net
Software
Apache /
Resource Hash
bf10c41adc130f740381decd29d1fa5c668394ee37982b86e764bd54b92df26b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://litera.city/ServerPlan/dominio-serverplan/auth/index.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 09 Jan 2023 18:08:17 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b7df3f607e2704502e16154beb52a35346a937ab5ccd276ccb288f0c5a7aad66

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		734 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ce6b7eda6a7632d90307cf3ddc6b6ee6e9fbe72b9c4705eb7d09f1a8947d87a9

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
91caf859e5329dd051899cdc2079c20e80910faa8cfb014ae2cf1929709bd177

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		713 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b83f24c7f46c5665a54597796874c36897871aeb068ffd74625435959639523f

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		921 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf49aa5bf94408f59571025051a2c80418bf4dea8a678e3e51166f8a05572ca5

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2636af573737550dcd43977d9ee28c43af40035fa71c13daba02785b84804095

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5bdb393ff03cce80e7b04dafc21c321e3ca9b007e2925a1e61c9c538ede20ba1

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3c225c768c2909432fbffb2ae01adecaf540583a3b8459778514f6eb35786e95

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
48a634ec86442c2b6c2e90e15d28c4f14982e3f7fd5923b90d8f98f31308d0b2

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bc3289eb5aebdf6b1f90952df4cbd6e0f9bb9c4e76192f3bcd6c5c93c9b699cf

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9f6e55763d1421d1199c2a5c1d41855fb5a34776b28609e6fa21341e83bd1f46

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
05909d841b444cc8a49c2e64526eaf3a2154188e44d46653d83dee59b7c3a4fd

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		21 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c4b9c868b1ed130ac17d8afdcb56a16be855bfc281b1b40e4d4b7c03c721c907

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4df601b501eaebe852e2a73e6e4f2d57734de4f911efec464e5c53c927d9a050

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d5bf9a21f728b5e69e5450fe9be4d67e9fc0f163fa8982188ab752a734703acb

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c25d8f442355fa74379f4423f9a58edcdeb91b3f2e72b471637b07353874525

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0a89dea042072616d9789fc8d8e8dd89d59ca856452a661dda90218f5f0f2aa9

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		503 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2e12d483eec4394eca7c9517bd68ce7f37a4e2854f7246a3150fc31367cb2ae2

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Sella (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| validate

1 Cookies

Domain/Path Name / Value
litera.city/ Name: PHPSESSID
Value: b204aa2d896c7ebf66420c0d5ac11672

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alyxia.akania.net
litera.city
191.6.223.182
74.208.236.75
05909d841b444cc8a49c2e64526eaf3a2154188e44d46653d83dee59b7c3a4fd
0a89dea042072616d9789fc8d8e8dd89d59ca856452a661dda90218f5f0f2aa9
1c25d8f442355fa74379f4423f9a58edcdeb91b3f2e72b471637b07353874525
2636af573737550dcd43977d9ee28c43af40035fa71c13daba02785b84804095
2e12d483eec4394eca7c9517bd68ce7f37a4e2854f7246a3150fc31367cb2ae2
3c225c768c2909432fbffb2ae01adecaf540583a3b8459778514f6eb35786e95
48a634ec86442c2b6c2e90e15d28c4f14982e3f7fd5923b90d8f98f31308d0b2
4df601b501eaebe852e2a73e6e4f2d57734de4f911efec464e5c53c927d9a050
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5bdb393ff03cce80e7b04dafc21c321e3ca9b007e2925a1e61c9c538ede20ba1
91caf859e5329dd051899cdc2079c20e80910faa8cfb014ae2cf1929709bd177
9f6e55763d1421d1199c2a5c1d41855fb5a34776b28609e6fa21341e83bd1f46
b7df3f607e2704502e16154beb52a35346a937ab5ccd276ccb288f0c5a7aad66
b83f24c7f46c5665a54597796874c36897871aeb068ffd74625435959639523f
bc3289eb5aebdf6b1f90952df4cbd6e0f9bb9c4e76192f3bcd6c5c93c9b699cf
bf10c41adc130f740381decd29d1fa5c668394ee37982b86e764bd54b92df26b
c4b9c868b1ed130ac17d8afdcb56a16be855bfc281b1b40e4d4b7c03c721c907
ce6b7eda6a7632d90307cf3ddc6b6ee6e9fbe72b9c4705eb7d09f1a8947d87a9
cf49aa5bf94408f59571025051a2c80418bf4dea8a678e3e51166f8a05572ca5
d5bf9a21f728b5e69e5450fe9be4d67e9fc0f163fa8982188ab752a734703acb