Security Scan Report: www.litoerre.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 19 IPs in 3 countries across 12 domains to perform 67 HTTP transactions. The main domain is litoerre.com and was registered 17 years ago.

Submitted URL: https://www.litoerre.com

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Genuine Italian print shop whose site has been compromised: it injects the ClickFix/EtherHiding blockchain loader with a fake 'Human Verification' prompt. Do not interact; report the compromise to the owner.

Risk Factors (4)
Legitimate Italian printing firm's site is compromised and serving an injected ClickFix / EtherHiding loader
EtherHiding abuse: malicious next-stage address resolved from a Polygon smart contract, evading static blocklists
Obfuscated script hides known-bad hosts (1rpc.io, polygon.drpc.org, polygon.gateway.tenderly.co) from casual inspection
Critical exploit-kit and malware command-and-control IDS signatures on the live capture
Domain age information unavailable

Details

Page Title

Litoerre grafica e stampa digitale e offset Novara Milano

Scan Type

public

Domain Name Analysis

The domain 'www.litoerre.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'www'. The core label 'litoerre' covers 8 characters holding four vowels versus 4 consonants. Breaking it apart gives 3 words: lito, er, re. Median word length comes out to 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.litoerre.com

Page Load Overview

3.86s
Total Load Time
3.2 MB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it-IT
Text Length:5,880 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical68% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
68%
corporate
25%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1389.46.107.13Arezzo, Tuscany, Italy
AS31034Aruba S.p.A.
3150.136.141.142Oracle · CLOUDAshburn, Virginia, United States
AS31898Oracle Corporation
3192.178.183.95Google · CDNUnited States
AS15169Google LLC
399.84.152.117Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
399.84.152.69Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
3159.69.51.30Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
3178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
3104.26.4.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.250.154.94Google · CDNUnited States
AS15169Google LLC
335.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
6719--

Detected Technologies10

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C595F8370314937AB6D4C9C19224B51B62F9EA27B478246DFB426DEFBC1D89350B8933

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:/e2OqkWMe2OqkWMe2OqkWMe2OqkWMe2OqkWMe2OqkWMe2OqkWMe2OqkWMe2OqkWA:Dnz0xvAy9Z+L+9peL0rh4XxHK4w

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1887966:BgKFoAQIggsUNVjnWMZHCyQYj0lBQd1sTBwMBRBAIIRlAQCEPRAEo5oKBBEwsAFLmsAEA/VDFAQEkkEAEAB2Ksqg6pGMjhhI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffff000000030303
Perceptual Hash:a4daa5ba8be45b44
Difference Hash:202191e5791f86e7
Wavelet Hash:ffff010101074333
Color Hash:#6d1f93

Scan History

Scan history not available

Unable to load historical scan data