gumter.ci Open in urlscan Pro
75.119.133.125 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://techzara.org/solar
Effective URL:
https://gumter.ci/mps/
Submission: On February 26 via api (February 26th 2024, 8:35:14 am UTC) from EE — Scanned from IT

Summary HTTP 2 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 75.119.133.125, located in Düsseldorf, Germany and belongs to CONTABO, DE. The main domain is gumter.ci.
TLS certificate: Issued by R3 on January 5th 2024. Valid for: 3 months.

This is the only time gumter.ci was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Monte dei Paschi (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	138.197.65.170 138.197.65.170	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	75.119.133.125 75.119.133.125	51167 (CONTABO) (CONTABO)
2	3

2 138.197.65.170 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: techzara.org

techzara.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 75.119.133.125 (Düsseldorf, Germany)

ASN51167 (CONTABO, DE)
PTR: host.jeberge.com

gumter.ci	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	techzara.org 1 redirects techzara.org	719 B
1	gumter.ci gumter.ci	76 KB
2	2

	Domain	Requested by
2	techzara.org	1 redirects
1	gumter.ci
2	2

This site contains links to these domains. Also see Links.

Domain
aziendaonline.mps.it
www.carteaziende.mps.it
www.mps.it
intranet.gruppomps.it
wof.mps.it

Subject Issuer	Validity	Valid
techzara.org R3	`2024-01-10` - `2024-04-09`	3 months	crt.sh
gumter.ci R3	`2024-01-05` - `2024-04-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gumter.ci/mps/
Frame ID: CA7B438286D2FEB932FD2AA794616984
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banca MPS

Page URL History Show full URLs

https://techzara.org/solar HTTP 301
https://techzara.org/solar/ Page URL
https://gumter.ci/mps/ Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

77 kB
Transfer

98 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://aziendaonline.mps.it/
Title: PASKEY AZIENDAONLINE Corporate banking

Search URL Search Domain Scan URL

URL: https://aziendaonline.mps.it/tesorerie
Title: PASKEY TESORERIA ONLINE E TRIBUNALI ONLINE Enti e istituzioni

Search URL Search Domain Scan URL

URL: https://www.carteaziende.mps.it/portal/server.pt
Title: PORTALE CARTA MONTEPASCHI AZIENDE Carte di credito aziendali

Search URL Search Domain Scan URL

URL: https://www.mps.it/sicurezza/Pagine/default.aspx
Title: CONSIGLI UTILI

Search URL Search Domain Scan URL

URL: https://www.mps.it/persone/altri-servizi-carte/protezione-acquisti-online-3d-secure.html
Title: PROTEZIONE ACQUISTI ONLINE CON 3D SECURE

Search URL Search Domain Scan URL

URL: https://intranet.gruppomps.it/intranet/mps_portaleagenti/Pagine/default.aspx
Title: AREA AGENTI

Search URL Search Domain Scan URL

URL: https://wof.mps.it/
Title: WOF - Web Online Factoring

Search URL Search Domain Scan URL

URL: https://www.mps.it/informazioni-legali/Pagine/default.aspx
Title: Banca Monte dei Paschi di Siena S.p.A. GRUPPO IVA MPS - Partita IVA 01483500524

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://techzara.org/solar HTTP 301
https://techzara.org/solar/ Page URL
https://gumter.ci/mps/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://techzara.org/solar HTTP 301
https://techzara.org/solar/

2 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response techzara.org/solar/ Redirect Chain https://techzara.org/solar https://techzara.org/solar/	71 B 455 B	123ms 123ms	Document text/html	138.197.65.170 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://techzara.org/solar/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 138.197.65.170 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS techzara.org Software Apache/2.4.29 (Ubuntu) / Resource Hash `7e9e70284cd83a8d0fc5e084989d98e4a1616b054c156579a70f90a09d529363` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 accept-language it-IT,it;q=0.9 Response headers Accept-Ranges bytes Access-Control-Allow-Origin * Connection Keep-Alive Content-Encoding gzip Content-Length 89 Content-Type text/html Date Mon, 26 Feb 2024 08:35:08 GMT ETag "47-6123022646940-gzip" Keep-Alive timeout=5, max=99 Last-Modified Sun, 25 Feb 2024 07:56:45 GMT Server Apache/2.4.29 (Ubuntu) Vary Accept-Encoding Redirect headers Connection Keep-Alive Content-Length 314 Content-Type text/html; charset=iso-8859-1 Date Mon, 26 Feb 2024 08:35:08 GMT Keep-Alive timeout=5, max=100 Location https://techzara.org/solar/ Server Apache/2.4.29 (Ubuntu)
GET H/1.1	200 OK	Primary Request / Show response gumter.ci/mps/	76 KB 76 KB	261ms 164ms	Document text/html	75.119.133.125 CONTABO
General Check archive.org Show headers Download Go to Full URL https://gumter.ci/mps/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 75.119.133.125 Düsseldorf, Germany, ASN51167 (CONTABO, DE), Reverse DNS host.jeberge.com Software Apache / Resource Hash `d1aa15f827d7172116a552163ea6f19738eeaa7cca815e842ddbb764c64f91cc` Request headers Referer https://techzara.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 accept-language it-IT,it;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 26 Feb 2024 08:35:09 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET DATA	200 OK	truncated /	11 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0a0c6433b58c72136375414d6f7a6a511932eeaac396f7c0991a2b953fa2eaaa` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d46dda2fab1d8fe763cec3ef41291116c4df2667bdb89448b37fbc342249924a` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	999 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9c9b26055379437522e81d6ad02ec43de51199f7ee3ad2fb8a7f6ab3a44efccf` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0723be3bac2e41d6d7aa267af24f45a7240d74ead82a130765f83fc6fbf19723` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `11fda756daabdaa65f100e3296fe54d09440bfe68fb8f0b162230d3f9e91eb05` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	946 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `85e61a4c5a8e573ee32eacc27bcf252692440a103548ead79ed85cb7d3765924` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Monte dei Paschi (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gumter.ci
techzara.org
138.197.65.170
75.119.133.125
0723be3bac2e41d6d7aa267af24f45a7240d74ead82a130765f83fc6fbf19723
0a0c6433b58c72136375414d6f7a6a511932eeaac396f7c0991a2b953fa2eaaa
11fda756daabdaa65f100e3296fe54d09440bfe68fb8f0b162230d3f9e91eb05
7e9e70284cd83a8d0fc5e084989d98e4a1616b054c156579a70f90a09d529363
85e61a4c5a8e573ee32eacc27bcf252692440a103548ead79ed85cb7d3765924
9c9b26055379437522e81d6ad02ec43de51199f7ee3ad2fb8a7f6ab3a44efccf
d1aa15f827d7172116a552163ea6f19738eeaa7cca815e842ddbb764c64f91cc
d46dda2fab1d8fe763cec3ef41291116c4df2667bdb89448b37fbc342249924a

gumter.ci Open in urlscan Pro 75.119.133.125 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

77 kBTransfer

98 kBSize

0 Cookies

8 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

gumter.ci Open in urlscan Pro
75.119.133.125 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

77 kB
Transfer

98 kB
Size

0
Cookies

2 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!