lta-pannellonline-com.66-29-134-36.cprapid.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 66.29.134.36, located in United States and belongs to NAMECHEAP-NET, US. The main domain is lta-pannellonline-com.66-29-134-36.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 20th 2023. Valid for: 3 months.

This is the only time lta-pannellonline-com.66-29-134-36.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: HYPE S.P.A. (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	62.72.37.84 62.72.37.84	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2 6	66.29.134.36 66.29.134.36	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	192.229.221.25 192.229.221.25	15133 (EDGECAST) (EDGECAST)
6	3

2 62.72.37.84 (United Kingdom) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

web-lo.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 66.29.134.36 (United States) 2 redirects

ASN22612 (NAMECHEAP-NET, US)

lta-pannellonline-com.66-29-134-36.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.25 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cprapid.com 2 redirects lta-pannellonline-com.66-29-134-36.cprapid.com	296 KB
2	web-lo.info 1 redirects web-lo.info	477 B
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 2603	25 KB
6	3

	Domain	Requested by
6	lta-pannellonline-com.66-29-134-36.cprapid.com	2 redirects lta-pannellonline-com.66-29-134-36.cprapid.com
2	web-lo.info	1 redirects
1	www.paypalobjects.com	lta-pannellonline-com.66-29-134-36.cprapid.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
web-lo.info R3	`2023-08-30` - `2023-11-28`	3 months	crt.sh
lta-pannellonline-com.66-29-134-36.cprapid.com cPanel, Inc. Certification Authority	`2023-09-20` - `2023-12-19`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-08-19` - `2023-12-10`	4 months	crt.sh

This page contains 1 frames:

Primary Page: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Frame ID: 54A9D314639EAC7DF685E7CF70CDD668
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HYPE - Login

Page URL History Show full URLs

https://web-lo.info/clHype-lD HTTP 301
https://web-lo.info/clHype-lD/ Page URL
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/ HTTP 302
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/checkclient.php?&sessionid=690719e5d5ccdf31797d8da7fc250778 HTTP 302
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

paypalobjects\.com

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

321 kB
Transfer

319 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://web-lo.info/clHype-lD HTTP 301
https://web-lo.info/clHype-lD/ Page URL
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/ HTTP 302
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/checkclient.php?&sessionid=690719e5d5ccdf31797d8da7fc250778 HTTP 302
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://web-lo.info/clHype-lD HTTP 301
https://web-lo.info/clHype-lD/

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
web-lo.info/clHype-lD/
Redirect Chain

https://web-lo.info/clHype-lD
https://web-lo.info/clHype-lD/

114 B
199 B

52ms
52ms

Document
text/html

62.72.37.84
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://web-lo.info/clHype-lD/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

62.72.37.84 , United Kingdom, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

853da16fad9024dce03ae6e1b010a169c119088ff595437ef2a3f7e1b5ca4615

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
content-length: 114
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Fri, 22 Sep 2023 16:20:59 GMT
etag: "72-650d9cd2-29af45d1efece3a1;;;"
last-modified: Fri, 22 Sep 2023 13:55:30 GMT
platform: hostinger
server: LiteSpeed

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 707
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Fri, 22 Sep 2023 16:20:59 GMT
location: https://web-lo.info/clHype-lD/
platform: hostinger
server: LiteSpeed

GET
H/1.1

200
OK

Primary Request index.php Show response
lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/
Redirect Chain

https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/checkclient.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778

3 KB
4 KB

252ms
247ms

Document
text/html

66.29.134.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.29.134.36 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: ad5a2e95782fa9617bb9ef1d3549b65fffae4d91c474c6e5ebbee18e7483670c

Request headers

Referer: https://web-lo.info/clHype-lD/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: it-IT,it;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Sep 2023 16:21:00 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Sep 2023 16:21:00 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Location: it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK bootstrap.min.css
lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/ 152 KB
152 KB 192ms
191ms Stylesheet
text/css 66.29.134.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/bootstrap.min.css
Requested by: Host: lta-pannellonline-com.66-29-134-36.cprapid.com
URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.29.134.36 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 22 Sep 2023 16:21:00 GMT
Last-Modified: Fri, 04 Nov 2022 00:31:54 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 155758

GET
H/1.1 200
OK contextualLoginElementalUI.css
lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/ 127 KB
128 KB 380ms
292ms Stylesheet
text/css 66.29.134.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/contextualLoginElementalUI.css
Requested by: Host: lta-pannellonline-com.66-29-134-36.cprapid.com
URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.29.134.36 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 6dfb480b9ae23fb98eb18186b46fea0e5182c36c7f38b02be3d3e5ddca0ea69e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 22 Sep 2023 16:21:00 GMT
Last-Modified: Thu, 03 Nov 2022 14:54:30 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 130393

GET
H/1.1 200
OK logo.png
lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/ 12 KB
12 KB 186ms
186ms Image
image/png 66.29.134.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/logo.png
Requested by: Host: lta-pannellonline-com.66-29-134-36.cprapid.com
URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 66.29.134.36 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 5057a1d0d11d09d6e02e2f7240bd5aff9c9914556d74b77bcb8006a05873d198

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/index.php?&sessionid=690719e5d5ccdf31797d8da7fc250778
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 22 Sep 2023 16:21:01 GMT
Last-Modified: Thu, 03 Nov 2022 14:38:36 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 11809

GET
H2 200 PayPalSansBig-Regular.woff2
www.paypalobjects.com/paypal-ui/fonts/ 25 KB
25 KB 160ms
46ms Font
application/font-woff2 192.229.221.25
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/paypal-ui/fonts/PayPalSansBig-Regular.woff2

Requested by

Host: lta-pannellonline-com.66-29-134-36.cprapid.com
URL: https://lta-pannellonline-com.66-29-134-36.cprapid.com/ssa-asd/it/contextualLoginElementalUI.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.221.25 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (mil/6C73) /

Resource Hash

1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://lta-pannellonline-com.66-29-134-36.cprapid.com/
Origin: https://lta-pannellonline-com.66-29-134-36.cprapid.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Fri, 22 Sep 2023 16:21:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: HIT
paypal-debug-id: 5afdb95f0696d
dc: ccg11-origin-www-1.paypal.com
content-length: 25368
last-modified: Sat, 13 Feb 2021 00:27:06 GMT
server: ECAcc (mil/6C73)
traceparent: 00-00000000000000000005afdb95f0696d-b74492ffeae800a7-01
etag: "60271cda-6318"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Fri, 22 Sep 2023 17:21:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: HYPE S.P.A. (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lta-pannellonline-com.66-29-134-36.cprapid.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8429rdqdjqsqoptdgcr3gjoeb2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lta-pannellonline-com.66-29-134-36.cprapid.com
web-lo.info
www.paypalobjects.com
192.229.221.25
62.72.37.84
66.29.134.36
1f70ff447ed799a34f4c3ae37ef1f49ed4af71123ba2c2aefe354565354284be
5057a1d0d11d09d6e02e2f7240bd5aff9c9914556d74b77bcb8006a05873d198
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6dfb480b9ae23fb98eb18186b46fea0e5182c36c7f38b02be3d3e5ddca0ea69e
853da16fad9024dce03ae6e1b010a169c119088ff595437ef2a3f7e1b5ca4615
ad5a2e95782fa9617bb9ef1d3549b65fffae4d91c474c6e5ebbee18e7483670c

lta-pannellonline-com.66-29-134-36.cprapid.com Open in urlscan Pro 66.29.134.36 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

321 kBTransfer

319 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

lta-pannellonline-com.66-29-134-36.cprapid.com Open in urlscan Pro
66.29.134.36 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

321 kB
Transfer

319 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!