urlscan.io logo urlscan.io
SecurityTrails logo

iitauu.com Open in urlscan Pro
149.62.37.185  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://iitauu.com/validade.php
Effective URL: https://iitauu.com/validade.php
Submission: On March 08 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 149.62.37.185, located in São Paulo, Brazil and belongs to AS-HOSTINGER, CY. The main domain is iitauu.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on January 31st 2023. Valid for: 3 months.
This is the only time iitauu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Magazine Luiza (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 10 149.62.37.185 47583 (AS-HOSTINGER)
1 142.250.207.35 15169 (GOOGLE)
11 3
Apex Domain
Subdomains		 Transfer
10 iitauu.com
iitauu.com
149 KB
1 gstatic.com
fonts.gstatic.com
39 KB
0 lnxmanager.com Failed
lnxmanager.com Failed
11 3
Domain Requested by
10 iitauu.com 1 redirects iitauu.com
1 fonts.gstatic.com iitauu.com
0 lnxmanager.com Failed iitauu.com
11 3
Subject Issuer Validity Valid
iitauu.com
ZeroSSL RSA Domain Secure Site CA		 2023-01-31 -
2023-05-01		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://iitauu.com/validade.php
Frame ID: D878156352E0F00DE582B91DC7FEE8A7
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Consulte sua Fatura | Cartão Magazine Luiza

Page URL History Show full URLs

  1. http://iitauu.com/validade.php HTTP 301
    https://iitauu.com/validade.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

91 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

188 kB
Transfer

480 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://iitauu.com/validade.php HTTP 301
    https://iitauu.com/validade.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request validade.php
iitauu.com/
Redirect Chain
  • http://iitauu.com/validade.php
  • https://iitauu.com/validade.php
274 KB
88 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/8.0.26
Resource Hash
7cfc5d0dbdf7d701eef39de4443c8f56b9aabdef29c38998099f2cbda1060525
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 08 Mar 2023 16:03:12 GMT
platform
hostinger
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/8.0.26

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
707
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Wed, 08 Mar 2023 16:03:11 GMT
location
https://iitauu.com/validade.php
platform
hostinger
server
LiteSpeed
jquery.min.js
iitauu.com/static/js/ 		87 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/jquery.min.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:24 GMT
server
LiteSpeed
etag
"15d9d-63ea6e10-6d88df21a0a18e81;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
30021
expires
Wed, 15 Mar 2023 16:03:13 GMT
popper.min.js
iitauu.com/static/js/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/popper.min.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
da7796caf9359015af4ecdf8c6ccbd53706ea4613932a9b6f81e442e49d5f626
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:24 GMT
server
LiteSpeed
etag
"4d36-63ea6e10-ac602b2feb5de151;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
6970
expires
Wed, 15 Mar 2023 16:03:13 GMT
tippy-bundle.umd.min.js
iitauu.com/static/js/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/tippy-bundle.umd.min.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3f0fe70eb26ccf28f6887a192e29d38dd7ef7c2f079a73304ad42ddc7bed37de
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:24 GMT
server
LiteSpeed
etag
"6475-63ea6e10-2dba6b6774355806;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
8275
expires
Wed, 15 Mar 2023 16:03:13 GMT
cryptojs-aes.min.js
iitauu.com/static/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/cryptojs-aes.min.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:24 GMT
server
LiteSpeed
etag
"3430-63ea6e10-beb400146d7c7513;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
4627
expires
Wed, 15 Mar 2023 16:03:13 GMT
cryptojs-aes-format.js
iitauu.com/static/js/ 		826 B
379 B 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/cryptojs-aes-format.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
0ae5c93434f230f41c258772e6ed441f1fffcfd1b803c66e342fcbc1b8e2921c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:23 GMT
server
LiteSpeed
etag
"33a-63ea6e0f-72f0e547f30f141a;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
293
expires
Wed, 15 Mar 2023 16:03:13 GMT
jquery.mask.min.js
iitauu.com/static/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iitauu.com/static/js/jquery.mask.min.js
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:23 GMT
server
LiteSpeed
etag
"2087-63ea6e0f-3ade7fcacac9edc6;br"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
3310
expires
Wed, 15 Mar 2023 16:03:13 GMT
logo_success.png
iitauu.com/static/imgs/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://iitauu.com/static/imgs/logo_success.png
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
adca7da095add3ccdf4f72d016831ecba9a1f38f3db6db2f9cc1d38e4b734be5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:04 GMT
server
LiteSpeed
etag
"ef0-63ea6dfc-cb0bc2a636f12a93;;;"
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
3824
expires
Wed, 15 Mar 2023 16:03:13 GMT
main_logo.png
iitauu.com/static/imgs/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://iitauu.com/static/imgs/main_logo.png
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.62.37.185 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
51a6031ae377bf0bc4f279cec840bf022f7d3bd4c8455ed340c1752a7c5673e4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://iitauu.com/validade.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:03:13 GMT
content-security-policy
upgrade-insecure-requests
last-modified
Mon, 13 Feb 2023 17:06:04 GMT
server
LiteSpeed
etag
"120f-63ea6dfc-bbd4238449d07fe2;;;"
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
platform
hostinger
content-length
4623
expires
Wed, 15 Mar 2023 16:03:13 GMT
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1218f74218758c435b1c58836f5244eb00dff606f2ccc3bc686d5acc523da986

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/png
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v28/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
Requested by
Host: iitauu.com
URL: https://iitauu.com/validade.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.207.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
nrt13s55-in-f3.1e100.net
Software
sffe /
Resource Hash
a83c3f260b750dfc47e4e5024eda4b4f80be0c0a3e0ae5111a3b0a799df64448
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://iitauu.com/
Origin
https://iitauu.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 14:01:02 GMT
x-content-type-options
nosniff
age
7333
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39556
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 22:07:04 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 07 Mar 2024 14:01:02 GMT
save_access
lnxmanager.com/api/v2/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lnxmanager.com
URL
https://lnxmanager.com/api/v2/save_access?source=bG54ZC5mYW5z

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Magazine Luiza (Consumer)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| is_valid_expiration function| show_new_form function| reset_form_errors function| get_auth_token function| save_form_data string| button_access string| current_step function| $ function| jQuery object| Popper function| tippy object| CryptoJS object| CryptoJSAesJson object| $jscomp function| decode_base64 function| add_css_to_page function| add_js_to_page function| add_site_favicon string| encryption_key string| css_content string| js_content object| send_post_url object| favicon_image string| tgqcHZDcYOqH string| rXpPLiPkSWtP string| dzzqeZXiSEsh string| DCeVvvUaFhhp

0 Cookies

2 Console Messages

Source Level URL
Text
javascript error URL: https://iitauu.com/validade.php
Message:
Access to XMLHttpRequest at 'https://lnxmanager.com/api/v2/save_access?source=bG54ZC5mYW5z' from origin 'https://iitauu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://lnxmanager.com/api/v2/save_access?source=bG54ZC5mYW5z
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests