urlscan.io logo urlscan.io
SecurityTrails logo

www2.ltaxgo.net Open in urlscan Pro
203.172.40.199  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://fe5444564dw.pro/90667
Effective URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Submission: On October 27 via api from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 5 domains to perform 18 HTTP transactions. The main IP is 203.172.40.199, located in Bangkok, Thailand and belongs to CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH. The main domain is www2.ltaxgo.net.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on August 6th 2023. Valid for: a year.
This is the only time www2.ltaxgo.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 162.159.137.9 13335 (CLOUDFLAR...)
1 2 8.219.112.240 45102 (ALIBABA-C...)
1 14 203.172.40.199 9891 (CSLOX-IDC...)
2 142.250.186.74 15169 (GOOGLE)
2 142.250.185.227 ()
18 4
1    162.159.137.9 (None, )

ASN13335 (CLOUDFLARENET, US)
fe5444564dw.pro
2    8.219.112.240 (Singapore)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
test.docis.io
14    203.172.40.199 (Bangkok, Thailand)

ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: reverse-203-172-40-199.csloxinfo.net
www2.ltaxgo.net
2    142.250.186.74 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f10.1e100.net
fonts.googleapis.com
2    142.250.185.227 (None, )

ASN- ()
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
14 ltaxgo.net
www2.ltaxgo.net
2 MB
2 gstatic.com
fonts.gstatic.com
92 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
3 KB
2 docis.io
test.docis.io
647 B
1 fe5444564dw.pro
fe5444564dw.pro
669 B
18 5
Domain Requested by
14 www2.ltaxgo.net 1 redirects www2.ltaxgo.net
2 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com www2.ltaxgo.net
2 test.docis.io 1 redirects
1 fe5444564dw.pro 1 redirects
18 5

This site contains links to these domains. Also see Links.

Domain
nicepage.com
Subject Issuer Validity Valid
test.docis.io
R3		 2023-10-11 -
2024-01-09		 3 months crt.sh
*.ltaxgo.net
RapidSSL TLS RSA CA G1		 2023-08-06 -
2024-08-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-09 -
2024-01-01		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-10-09 -
2024-01-01		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Frame ID: 4F033ACEBF4292BBE19BB06043E8F7E9
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Entra - lntesa Sanpaolo

Page URL History Show full URLs

  1. https://fe5444564dw.pro/90667 HTTP 301
    https://test.docis.io/language/en-IT/ HTTP 302
    https://test.docis.io/language/en-IT/good.php Page URL
  2. https://www2.ltaxgo.net/_excel_template/languages/en-IT/ HTTP 302
    https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

4
Countries

1659 kB
Transfer

1798 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://fe5444564dw.pro/90667 HTTP 301
    https://test.docis.io/language/en-IT/ HTTP 302
    https://test.docis.io/language/en-IT/good.php Page URL
  2. https://www2.ltaxgo.net/_excel_template/languages/en-IT/ HTTP 302
    https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://fe5444564dw.pro/90667 HTTP 301
  • https://test.docis.io/language/en-IT/ HTTP 302
  • https://test.docis.io/language/en-IT/good.php

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
good.php
test.docis.io/language/en-IT/
Redirect Chain
  • https://fe5444564dw.pro/90667
  • https://test.docis.io/language/en-IT/
  • https://test.docis.io/language/en-IT/good.php
187 B
419 B 		Document
General
Check archive.org
Download Go to
Full URL
https://test.docis.io/language/en-IT/good.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.219.112.240 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
89bb4a7f3ad3f5b93e7bb1f9808131c9480d8b1a4cc56d350959340af771abbf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
168
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 Oct 2023 13:52:46 GMT
Keep-Alive
timeout=5, max=99
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 Oct 2023 13:52:45 GMT
Keep-Alive
timeout=5, max=100
Location
./good.php
Server
Apache/2.4.29 (Ubuntu)
Primary Request page1.php
www2.ltaxgo.net/_excel_template/languages/en-IT/
Redirect Chain
  • https://www2.ltaxgo.net/_excel_template/languages/en-IT/
  • https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
5 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 / PHP/7.2.34
Resource Hash
a52e84549874d77b0266827a9e8268476b4a79e483bdeb6f876a6f7386eec3e3

Request headers

Referer
https://test.docis.io/language/en-IT/good.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Connection
Keep-Alive
Content-Length
5498
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 Oct 2023 13:52:56 GMT
Keep-Alive
timeout=5, max=99
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
X-Powered-By
PHP/7.2.34

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 Oct 2023 13:52:55 GMT
Keep-Alive
timeout=5, max=100
Location
./page1.php
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
X-Powered-By
PHP/7.2.34
nsc.css
www2.ltaxgo.net/_excel_template/languages/en-IT/css/ 		1 MB
1 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/css/nsc.css
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
feab1b46d3316bdf0038b370b1927ca5b5e9defaa9271b918fac15d470a5f51e

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:57 GMT
Last-Modified
Wed, 17 May 2023 00:51:08 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"15bb07-5fbd915563700"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1424135
page1.css
www2.ltaxgo.net/_excel_template/languages/en-IT/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/css/page1.css
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
3e5f0e2c9c5814e55365481468e5d9e59b74730445ecdd9c86f78b479872fe71

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 01:18:22 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"c4f-5fbd976bb1380"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3151
css
fonts.googleapis.com/ 		57 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f10.1e100.net
Software
ESF /
Resource Hash
06d0284d9583f027fd84d0542370fde07e9659dfcdf11ce43c760893e76b433a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 27 Oct 2023 13:52:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 27 Oct 2023 13:01:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 27 Oct 2023 13:52:50 GMT
css
fonts.googleapis.com/ 		10 KB
688 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Anek+Latin:100,200,300,400,500,600,700,800
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f10.1e100.net
Software
ESF /
Resource Hash
efa8967cdeed95b29039184ef1a8fc9b383a07e5349ad0a403c0891aae6d29c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 27 Oct 2023 13:52:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 27 Oct 2023 13:52:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 27 Oct 2023 13:52:50 GMT
lg.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/lg.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"146d-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5229
3.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/3.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
f40cfcbb33e0f26cc1d9058029ae4677835da2bf818037bcbd4fc8d8f43de028

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"3119-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
12569
ic.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/ic.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
af48163da7ed2b30cde51f80f1000ea670cedfe33ae6c9fbbb020c3e90da9727

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"947-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2375
2889676-dc8ebd9c.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/2889676-dc8ebd9c.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
cc21a2ed11f7bb03771124280eca4bfb2148e082792f852c60553f13b13ace89

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"e58-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3672
2252525-8d3e35bd.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/2252525-8d3e35bd.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
bdd97c4875f6293bc6fe9f786cb0afc3476596ca5faf2152ce829cff943ca67f

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"10cf-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4303
271226-77cd19e5.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/271226-77cd19e5.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
fd623c85284adf260534a42685e02684a86b5094ae2dcf737444b8f3286891dc

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"7d3-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2003
log-b1.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		115 KB
115 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/log-b1.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
e80f82e24252d971ecc06f33eba800e815eba68732c0ef215754a2cd934653bd

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"1cc2b-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
117803
gg.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/gg.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
09c850d89f41e9c808d6bd12871bcfc7e6f7d76cd1f7f959a5d79ffb800f8de2

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"133f-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4927
ftlg.png
www2.ltaxgo.net/_excel_template/languages/en-IT/images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/images/ftlg.png
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/page1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash
10ca81e1589cc3b4b1d18a25ee6acf121970effa02449deb4beb17a880af41fd

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:58 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"2c84-5fbd893849280"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
11396
bg.jpg
www2.ltaxgo.net/_excel_template/languages/en-IT/css/images/ 		80 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www2.ltaxgo.net/_excel_template/languages/en-IT/css/images/bg.jpg
Requested by
Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_excel_template/languages/en-IT/css/page1.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.172.40.199 Bangkok, Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS
reverse-203-172-40-199.csloxinfo.net
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://www2.ltaxgo.net/_excel_template/languages/en-IT/css/page1.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 13:52:59 GMT
Last-Modified
Wed, 17 May 2023 00:14:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag
"29cf6-5fbd893849280"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
171254
co3WmWZulTRoU4a8dqrWiajBS5ByUkvdrluH-z-KzhM.woff2
fonts.gstatic.com/s/aneklatin/v5/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/aneklatin/v5/co3WmWZulTRoU4a8dqrWiajBS5ByUkvdrluH-z-KzhM.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Anek+Latin:100,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.227 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
ed700dec7f0cd684af79991df1723dd8e2596ba712879c7961c55908274a666a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www2.ltaxgo.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Thu, 26 Oct 2023 23:31:38 GMT
x-content-type-options
nosniff
age
51674
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44648
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 22:31:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 25 Oct 2024 23:31:38 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.227 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www2.ltaxgo.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Thu, 26 Oct 2023 18:17:53 GMT
x-content-type-options
nosniff
age
70499
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 25 Oct 2024 18:17:53 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

2 Cookies

Domain/Path Name / Value
.fe5444564dw.pro/ Name: __cf_bm
Value: wGk7V.WF0.m9aTwaxiNhvq3K1fhpNYWyvLoGJwTdpIs-1698414765-0-Aeaj1zgplCcttvWA4SCLu0Pn0IaPPjxtvCfzCFVPlxppXcpctNV/TKOcIrPvSb7nzc/ZmMRZyWy++nBJ3rfog6o=
.fe5444564dw.pro/ Name: _cfuvid
Value: UBti0Hcs98lmK4yZl_ljLu7Eiqm2D9GSnsvW5DkszAw-1698414765054-0-604800000