gsamra.com Open in urlscan Pro
209.59.190.124 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gsamra.com/csa47/
Submission: On April 18 via manual (April 18th 2023, 7:51:51 am UTC) from DE — Scanned from DE

Summary HTTP 15 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 209.59.190.124, located in United States and belongs to LIQUIDWEB, US. The main domain is gsamra.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 13th 2023. Valid for: 3 months.

This is the only time gsamra.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	209.59.190.124 209.59.190.124	32244 (LIQUIDWEB) (LIQUIDWEB)
10	212.149.50.15 212.149.50.15	16365 (COMMERZBA...) (COMMERZBANK DE-60261 Frankfurt)
15	3

5 209.59.190.124 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: alt4-dory.exacthosting.com

gsamra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 212.149.50.15 (Frankfurt am Main, Germany)

ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE)
PTR: kunden.commerzbank.de

kunden.commerzbank.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	commerzbank.de kunden.commerzbank.de — Cisco Umbrella Rank: 394814	383 KB
5	gsamra.com gsamra.com	474 KB
15	2

	Domain	Requested by
10	kunden.commerzbank.de	gsamra.com
5	gsamra.com	gsamra.com kunden.commerzbank.de
15	2

This site contains links to these domains. Also see Links.

Domain
kunden.commerzbank.de
www.commerzbank.de

Subject Issuer	Validity	Valid
gsamra.com cPanel, Inc. Certification Authority	`2023-03-13` - `2023-06-11`	3 months	crt.sh
kunden.commerzbank.de GlobalSign Extended Validation CA - SHA256 - G3	`2022-12-21` - `2024-01-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://gsamra.com/csa47/
Frame ID: 23A74AE64F170DF440AD08BB59099BC8
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmeldung zum Digital Banking - Commerzbank

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

891 kB
Transfer

1645 kB
Size

7
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://kunden.commerzbank.de/banking/landingpage/

Search URL Search Domain Scan URL

URL: https://www.commerzbank.de/de/hauptnavigation/home/home.html
Title: Group

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/portal/en/englisch/english.html
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/start/

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/banking/landingpage/?pk
Title: Private & Business Clients

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/banking/landingpage/?gk

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/lp/login
Title: Anmeldung

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/banking/financeoverview/
Title: Finanzübersicht

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/banking/account/transactionoverview/
Title: Umsatzübersicht

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/portal/de/footer1/agb/agb.html
Title: AGB

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/portal/de/footer1/preisekonditionen/preisekonditionen.html
Title: Preise & Konditionen

Search URL Search Domain Scan URL

URL: https://www.commerzbank.de/hinweise/impressum/
Title: Impressum

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/portal/de/footer1/recht/rechtliche_hinweise.html
Title: Rechtliche Hinweise

Search URL Search Domain Scan URL

URL: https://kunden.commerzbank.de/portal/de/footer1/datenschutzhinweise/Datenschutzhinweise.html
Title: Datenschutzhinweise

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
gsamra.com/csa47/ 15 KB
16 KB 902ms
543ms Document
text/html 209.59.190.124
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://gsamra.com/csa47/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.190.124 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: alt4-dory.exacthosting.com
Software: Apache /
Resource Hash: 7f6891d6a1eb26979fbc55c0c11ebcd86f3bb0916afc12aadc9dcfe2b9b32bc1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 18 Apr 2023 07:51:45 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=2, max=500
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200 ruxitagentjs_ICA27NVfqrux_10259230221142207.js Show response
kunden.commerzbank.de/banking/dynatrace/ 222 KB
85 KB 80ms
45ms Script
text/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/banking/dynatrace/ruxitagentjs_ICA27NVfqrux_10259230221142207.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

fcac0584d499c6043e09c4550453ed5428f9f7a5181271d66df95b6e8c63b4f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 03 Mar 2010 07:01:40 GMT
Server: Apache
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=31536000, immutable, private
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
content-length: 86099
expires: Wed, 17 Apr 2024 07:51:46 GMT

GET
H/1.1 200
OK main.css
gsamra.com/csa47/images/ 457 KB
457 KB 197ms
140ms Stylesheet
text/css 209.59.190.124
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://gsamra.com/csa47/images/main.css
Requested by: Host: gsamra.com
URL: https://gsamra.com/csa47/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.190.124 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: alt4-dory.exacthosting.com
Software: Apache /
Resource Hash: 5d4ea7a769566deb234d8175977f4cbe2222e839fd06eaf3ce46c6a5be32da06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/csa47/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:46 GMT
Last-Modified: Fri, 31 Mar 2023 22:44:18 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=499
Content-Length: 468154

GET
H/1.1 200 cms.css
kunden.commerzbank.de/portal/media/system/38.176.19/css/ 200 KB
88 KB 93ms
60ms Stylesheet
text/css 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/css/cms.css

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

18502a76a13c8dd95fbcf1775e4b6178680fb394b229fafcef1b5eb43a821b10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: d937fd160e8f48bb8812531f8b8b96dafd29abb262caec38174ea4f34ade2283
Transfer-Encoding: chunked
Connection: Keep-Alive
x-xss-protection: 1; mode=block
last-modified: Wed, 04 Jan 2023 10:56:16 GMT
Server: Apache
etag: "-136495325-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: text/css
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=100
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 jquery_1_12_4.js Show response
kunden.commerzbank.de/portal/media/system/38.176.19/js/ 95 KB
34 KB 103ms
69ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/js/jquery_1_12_4.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: 17d087eaa6b3de6569529918621a60d7b28e4dc3c6ba0add900266b4ca03039c
Connection: Keep-Alive
Content-Length: 33760
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:17:49 GMT
Server: Apache
etag: "-1982691847-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=100
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 jquery_ui_1_12_1.js Show response
kunden.commerzbank.de/portal/media/system/38.176.19/js/ 248 KB
67 KB 114ms
78ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/js/jquery_ui_1_12_1.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: b2c04a76daaf7829429ffb1c2d95838253a0076d3782e6423cf6f95a6582cfc5
Transfer-Encoding: chunked
Connection: Keep-Alive
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:17:49 GMT
Server: Apache
etag: "-1536096480-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=100
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 lib_head.js Show response
kunden.commerzbank.de/portal/media/system/38.176.19/js/ 42 KB
12 KB 92ms
54ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/js/lib_head.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

8aa8c539b7372deed1fbab206a6fd97d0eafb1b5f687f68d9355e3ef695d11b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: 971583fdcffb640f4f825ad076dc56c6e72014f26fb9548704c1fd98f228b1fb
Connection: Keep-Alive
Content-Length: 11887
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:22:58 GMT
Server: Apache
etag: "-321040864-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=100
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 lib_smartbanner.js Show response
kunden.commerzbank.de/portal/media/system/js/ 7 KB
2 KB 96ms
54ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/js/lib_smartbanner.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

4b48ccbcd85f7545fccc4bdaa6828fe91d37c6ef709d4667ea58451adf888537

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: 9ce1f25425443e79b2e336ded3d1302c331c369d9db68cab9b3e21b2ad72f26e
Connection: Keep-Alive
Content-Length: 1596
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:22:58 GMT
Server: Apache
etag: "543926292-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=100
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 lupe.png
kunden.commerzbank.de/portal/media/system/images/ 1 KB
2 KB 80ms
80ms Image
image/png 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunden.commerzbank.de/portal/media/system/images/lupe.png

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

ff61b5346eb152cdaa59aa8a7b5238707cac667e4d3bbea2e66862b1b1b94358

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
com-coba-cif-csrf-protection: 35c543aa1da70e08da4c5865cd53c1facd7f3d8723f9cae6d858d3f0d3e55b8c
Connection: Keep-Alive
content-length: 1308
x-xss-protection: 1; mode=block
last-modified: Tue, 22 Nov 2022 09:06:08 GMT
Server: Apache
etag: "2056581121"
x-frame-options: DENY
content-type: image/png
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=97
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 logo_big_svg.svg
kunden.commerzbank.de/portal/media/system/images/ 10 KB
3 KB 42ms
42ms Image
image/svg+xml 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunden.commerzbank.de/portal/media/system/images/logo_big_svg.svg

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: ef551640a0f85256f270a767beb25d94d291e51d3af916a7887fb3375888213f
Connection: Keep-Alive
Content-Length: 2841
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:17:44 GMT
Server: Apache
etag: "-2129430624-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: image/svg+xml
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=96
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 lib_main.js Show response
kunden.commerzbank.de/portal/media/system/38.176.19/js/ 288 KB
82 KB 122ms
122ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/js/lib_main.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

cb4e5a4a25b095758e702317af5145988042cd4a5fb43866b8cdc6ddbd2da809

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: f8cd32bf22cdb55fb9bf8289d57c7f64da5af52e2109d68fce937184130e0583
Transfer-Encoding: chunked
Connection: Keep-Alive
x-xss-protection: 1; mode=block
last-modified: Thu, 02 Feb 2023 13:31:32 GMT
Server: Apache
etag: "1900273465-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=99
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
H/1.1 200 lib_cms.js Show response
kunden.commerzbank.de/portal/media/system/38.176.19/js/ 24 KB
7 KB 54ms
54ms Script
application/javascript 212.149.50.15
COMMERZBANK DE-60...

General

Check archive.org

Show headers Download Go to

Full URL

https://kunden.commerzbank.de/portal/media/system/38.176.19/js/lib_cms.js

Requested by

Host: gsamra.com
URL: https://gsamra.com/csa47/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

212.149.50.15 Frankfurt am Main, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),

Reverse DNS

kunden.commerzbank.de

Software

Apache /

Resource Hash

c8e683962d559a6bd04c714014c2f11b5dec89c371c6231923cab3a1c77f20c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
Content-Encoding: gzip
com-coba-cif-csrf-protection: 6a3e42001de825ae42a1fb426e840a5b9d585cb1746fb7b25558da0284afac94
Connection: Keep-Alive
Content-Length: 6982
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 05:17:55 GMT
Server: Apache
etag: "1032703758-gzip"
x-frame-options: DENY
Vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
content-language: de-DE
cache-control: private
Keep-Alive: timeout=15, max=98
expires: Tue, 18 Apr 2023 07:56:46 GMT

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75

Request headers

Referer
Origin: https://gsamra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88f9247ef9ead1e10ed09369827fb9a34242c5bf454713ac1831ab3c732192e0

Request headers

Referer
Origin: https://gsamra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
H/1.1 404
Not Found ico_fehler_png.png
gsamra.com/portal/media/system/images/ 315 B
315 B 112ms
112ms Image
text/html 209.59.190.124
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gsamra.com/portal/media/system/images/ico_fehler_png.png
Requested by: Host: gsamra.com
URL: https://gsamra.com/csa47/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.190.124 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: alt4-dory.exacthosting.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gsamra.com/csa47/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 07:51:46 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=498
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683 Show response
gsamra.com/banking/dynatrace/ 315 B
516 B 150ms
112ms XHR
text/html 209.59.190.124
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://gsamra.com/banking/dynatrace/rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683?type=js3&sn=v_4_srv_-2D86_sn_RJ5D0J0TDL4LADC65A5L7CUD3JPSAF8D&svrid=-86&flavor=post&vi=ACRRSETHMDMHDMGVKFNSIHMIAEUMTNCP-0&modifiedSince=1680274279046&rf=https%3A%2F%2Fgsamra.com%2Fcsa47%2F&bp=3&app=53cd4acc1b85e003&crc=3834285141&en=vsme09c4&end=1
Requested by: Host: kunden.commerzbank.de
URL: https://kunden.commerzbank.de/banking/dynatrace/ruxitagentjs_ICA27NVfqrux_10259230221142207.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.190.124 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: alt4-dory.exacthosting.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://gsamra.com/csa47/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 18 Apr 2023 07:51:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=500
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683 Show response
gsamra.com/banking/dynatrace/ 315 B
516 B 112ms
112ms XHR
text/html 209.59.190.124
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://gsamra.com/banking/dynatrace/rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683?type=js3&sn=v_4_srv_-2D86_sn_RJ5D0J0TDL4LADC65A5L7CUD3JPSAF8D&svrid=-86&flavor=post&vi=ACRRSETHMDMHDMGVKFNSIHMIAEUMTNCP-0&modifiedSince=1680274279046&rf=https%3A%2F%2Fgsamra.com%2Fcsa47%2F&bp=3&app=53cd4acc1b85e003&crc=671622663&en=vsme09c4&end=1
Requested by: Host: kunden.commerzbank.de
URL: https://kunden.commerzbank.de/banking/dynatrace/ruxitagentjs_ICA27NVfqrux_10259230221142207.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.190.124 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: alt4-dory.exacthosting.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://gsamra.com/csa47/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 18 Apr 2023 07:51:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=499
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gsamra.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 165c1d5863a83aedacabd8baab873f0b
.gsamra.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D86_sn_RJ5D0J0TDL4LADC65A5L7CUD3JPSAF8D
.gsamra.com/	1970-01-20 20:46:04	Name: rxVisitor Value: 1681804306099E2H8V96KPEVUN0EAUQA54A8GI3HH2DGM
.gsamra.com/	1969-12-31 23:59:59	Name: dtLatC Value: 180
.gsamra.com/	1969-12-31 23:59:59	Name: dtSa Value: -
.gsamra.com/	1969-12-31 23:59:59	Name: rxvt Value: 1681806106731\|1681804306100
.gsamra.com/	1969-12-31 23:59:59	Name: dtPC Value: -86$4306095_113h-vACRRSETHMDMHDMGVKFNSIHMIAEUMTNCP-0e0

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gsamra.com/portal/media/system/images/ico_fehler_png.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://gsamra.com/banking/dynatrace/rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683?type=js3&sn=v_4_srv_-2D86_sn_RJ5D0J0TDL4LADC65A5L7CUD3JPSAF8D&svrid=-86&flavor=post&vi=ACRRSETHMDMHDMGVKFNSIHMIAEUMTNCP-0&modifiedSince=1680274279046&rf=https%3A%2F%2Fgsamra.com%2Fcsa47%2F&bp=3&app=53cd4acc1b85e003&crc=3834285141&en=vsme09c4&end=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://gsamra.com/banking/dynatrace/rb_5a7f65a5-eb55-46f1-baff-f05ff70d4683?type=js3&sn=v_4_srv_-2D86_sn_RJ5D0J0TDL4LADC65A5L7CUD3JPSAF8D&svrid=-86&flavor=post&vi=ACRRSETHMDMHDMGVKFNSIHMIAEUMTNCP-0&modifiedSince=1680274279046&rf=https%3A%2F%2Fgsamra.com%2Fcsa47%2F&bp=3&app=53cd4acc1b85e003&crc=671622663&en=vsme09c4&end=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gsamra.com
kunden.commerzbank.de
209.59.190.124
212.149.50.15
18502a76a13c8dd95fbcf1775e4b6178680fb394b229fafcef1b5eb43a821b10
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da
4b48ccbcd85f7545fccc4bdaa6828fe91d37c6ef709d4667ea58451adf888537
5d4ea7a769566deb234d8175977f4cbe2222e839fd06eaf3ce46c6a5be32da06
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7f6891d6a1eb26979fbc55c0c11ebcd86f3bb0916afc12aadc9dcfe2b9b32bc1
88f9247ef9ead1e10ed09369827fb9a34242c5bf454713ac1831ab3c732192e0
8aa8c539b7372deed1fbab206a6fd97d0eafb1b5f687f68d9355e3ef695d11b2
8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75
c8e683962d559a6bd04c714014c2f11b5dec89c371c6231923cab3a1c77f20c2
cb4e5a4a25b095758e702317af5145988042cd4a5fb43866b8cdc6ddbd2da809
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
fcac0584d499c6043e09c4550453ed5428f9f7a5181271d66df95b6e8c63b4f4
ff61b5346eb152cdaa59aa8a7b5238707cac667e4d3bbea2e66862b1b1b94358

gsamra.com Open in urlscan Pro 209.59.190.124 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

891 kBTransfer

1645 kBSize

7 Cookies

14 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

7 Cookies

3 Console Messages

Indicators

gsamra.com Open in urlscan Pro
209.59.190.124 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

891 kB
Transfer

1645 kB
Size

7
Cookies

15 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!