comerica.nm-i.com Open in urlscan Pro
172.67.192.4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://comerica.nm-i.com/login
Submission: On July 11 via api (July 11th 2024, 12:47:19 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 172.67.192.4, located in United States and belongs to CLOUDFLARENET, US. The main domain is comerica.nm-i.com.
TLS certificate: Issued by WE1 on July 4th 2024. Valid for: 3 months.

This is the only time comerica.nm-i.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Comerica (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	172.67.192.4 172.67.192.4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.20.156.202 23.20.156.202	14618 (AMAZON-AES) (AMAZON-AES)
13	3

10 172.67.192.4 (United States)

ASN13335 (CLOUDFLARENET, US)

comerica.nm-i.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.20.156.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-156-202.compute-1.amazonaws.com

images.e-platform.biz.wf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	nm-i.com comerica.nm-i.com	1 MB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 331	12 KB
1	biz.wf images.e-platform.biz.wf	83 KB
13	3

	Domain	Requested by
10	comerica.nm-i.com	comerica.nm-i.com
2	cdnjs.cloudflare.com	comerica.nm-i.com
1	images.e-platform.biz.wf	comerica.nm-i.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
nm-i.com WE1	`2024-07-04` - `2024-10-02`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
www.tel.api.goquick.biz.wf R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://comerica.nm-i.com/login
Frame ID: 24400A1C393047B2E45741C29A53C7BA
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1577 kB
Transfer

4387 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login Show response
comerica.nm-i.com/ 9 KB
2 KB 548ms
220ms Document
text/html 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91f312e42a743c4880099d9f89ab2c15dad5d2a01d6a23b6841466353d78c5ca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a18e6a23f2c436a-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 11 Jul 2024 12:47:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T9NOcrPKcUmXf%2Fp22Fph02HwHhBp8WXss6%2FF%2BvmxXyNvRlsLW4KLkV1GMvqItKKzkDD7QlqdoCyKW8qGT7zZWJuTbyeF3m2Bph697vBmFLCNEaWxEUyFat0dpGXaoY5C%2Fw%2BimQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 dashlite.css
comerica.nm-i.com/theme/dash/assets/css/ 756 KB
120 KB 31ms
28ms Stylesheet
text/css 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f16d85cd4f3bf9e3cf9f64e3114076c9e3ac8ba108473c819ace6a445ba3652

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:28:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hn1mSsFifcimRmNtpcx%2BEig71OcMaqxNGzm2N%2FGiyJOjLHb13uX5yLxzSPH4OhZcQcnkpEC1IFm2wKNb4MuIP4swUk0xh8YU%2Fi8xl2XjD2t%2FoFO35mmJPOjlmz6UcN5lX9OC4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a18e6a3a874436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 custom.css
comerica.nm-i.com/theme/dash/ 2 KB
1 KB 24ms
21ms Stylesheet
text/css 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/custom.css
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4c0fbe0a00aaaa052b5fae4a62ad09368758c96df6a6dbd35469cbe1453c80d

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 29 Jun 2021 12:15:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A5CUD5bB6Ri1BW6auIJh8Sn%2BDd%2FcoP0P5oragIn0iOgmzdo0u2B1Pr6CGAfkcQ49kXVYZpMfF1AASsjvqPSSy9OfNDdhx2%2FKnM8E1vsDh2rdySl3fGjyiZaZTETDEk5algLnfw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a18e6a3a875436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 intlTelInput.css
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/ 25 KB
2 KB 352ms
24ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 64590
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1970
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f902e0e-62a6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ln5nslQE1jILPs9OS99mYBd3o2LDqVJGQ7ZoR9BLvbHjZ37NBo6QKeXsQJr2YKHHAKD50djeGscqD5iHupwSbcqILPbOiYAINS8gcKe7Srm%2BGdc81yjfEiQsZEh%2BRtz41k3i7LXj"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a18e6a5baad425c-EWR
expires: Tue, 01 Jul 2025 12:47:14 GMT

GET
H2 200 theme.css
comerica.nm-i.com/theme/dash/assets/css/ 175 B
473 B 23ms
21ms Stylesheet
text/css 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/css/theme.css?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d0f050edd4accdb98ca99f3d93c108591db894d8baacaede986882ce973019

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cyo3QCxnmBlnQzTe2MgR9U%2FJBsW3noIK%2FIlcur8ql52PowOXCnXL50QBXfYDAZHSGFqGWl6rUuo1noLq5RoS2hSmZn3RjMAs1kcwir43sf0%2B9lBQgm3tOOS49Gk7QiRqoQscfw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a18e6a3a876436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 intlTelInput.min.js Show response
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/ 29 KB
9 KB 349ms
21ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/intlTelInput.min.js

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64cb11eb2a5237cbe1e05ccf25acefeed578f32d1a6923d58de35c8a0145e8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1962599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8889
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f902e0e-72d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=neJXUKzr5VvDSoSmuMsje%2B8C8eZY9hWOmISYbl2Vx%2FF85kBaNosf5R%2Bv6soUxzSbynQAkekg0bp0khn9JYIf64E5ZNvJYCtj8NCFhJgOqQLd67faBVxxE6W7%2Bzq8omvEXqJbXpkT"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a18e6a5baaf425c-EWR
expires: Tue, 01 Jul 2025 12:47:14 GMT

GET
H/1.1 200
OK 20157627836e725ca8-f621-42e9-a92b-654609847e3d.png
images.e-platform.biz.wf/ 82 KB
83 KB 222ms
20ms Image
image/png 23.20.156.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.e-platform.biz.wf/20157627836e725ca8-f621-42e9-a92b-654609847e3d.png

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

23.20.156.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-20-156-202.compute-1.amazonaws.com

Software

Apache /

Resource Hash

048a8c6dc345ca8890aea344989d89ad8841efa7846a3a3d572b6a2a33824aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 12:47:14 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 20 Sep 2021 06:25:09 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 84337

GET
H2 200 custom.js Show response
comerica.nm-i.com/theme/dash/ 1 B
322 B 67ms
66ms Script
text/javascript 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/custom.js?1656658638
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
cf-cache-status: MISS
last-modified: Sat, 12 Jun 2021 05:03:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YHsy5UMbxBTlaqIXtuSe8bA4wsOXgsmXrZ6SomqKkrpIOCplkQhSY%2BD3ljTdl%2BK9bZ5hJ2bSAs08TjgMukIvJf9Q8V1cudGT00WdjpzkCv6lb5fl3wQYq91ten%2Fp4JMvWCVNMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a18e6a3a877436a-EWR
alt-svc: h3=":443"; ma=86400
content-length: 1

GET
H2 200 bundle.js Show response
comerica.nm-i.com/theme/dash/assets/js/ 3 MB
1 MB 31ms
30ms Script
text/javascript 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/js/bundle.js?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60e48bd04fb48c634809043ec70cc74417f5ceeebb681f9be7b85be1ae01dd1d

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4177
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AuXGn8sgZZZtwC1EkZld0wg0FR2qGmYmvMy0pL4TWhF5kXohRbGaEsZ9gJlNAvtQWEJnqAoLQ%2FZk7pMTr7y6M0Z33my5dVolOV7kTl9azlLLXc24ViEpiEsOczN7%2B7fOOw%2BQww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 8a18e6a438f8436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 scripts.js Show response
comerica.nm-i.com/theme/dash/assets/js/ 28 KB
7 KB 20ms
20ms Script
text/javascript 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/js/scripts.js?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 983c10ac7366f5247a353fae0d94b8c39dda428f561022e458cc54db946b03ae

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4177
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aOdiBlfaAquXT8SEZEMrod869bBdJmTaDAGJjobrEtL7k4fqqeggwwDLCcxA3yx%2B76pwFF%2FWxJvERnM70LKPWwPhFdpTdrfPESCcpvmII6j6qlfM%2BAdmXx9eQh5n4Te3%2FwtGTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 8a18e6a549ef436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 Nunito-Bold.woff2
comerica.nm-i.com/theme/dash/assets/fonts/ 43 KB
43 KB 19ms
19ms Font
font/woff2 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/fonts/Nunito-Bold.woff2
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbac27a12c4dbc1f1605db29f666da787ba3d0a16b6668526906d94a53307a0c

Request headers

Referer: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Origin: https://comerica.nm-i.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:15 GMT
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=egArssp1YR4P6bQEzSNn5cCxOWvvgx09%2Fa4Sb05Wg%2B6AyKoc52PF3TLcxXgaDLUojyeTfDWjxGX8B%2FsTK6vpnyLrII4oIQ2iNAOfAeugM9Af3v58ipEa8Mb47Oz3%2FQexXcPMeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a18e6a6cb98436a-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43608

GET
H2 200 Nioicon.ttf
comerica.nm-i.com/theme/dash/assets/fonts/ 300 KB
135 KB 27ms
27ms Font
font/ttf 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/fonts/Nioicon.ttf
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea4876d8402170e85b78be6f5860cb57d69f3cdac226919db880c752d6fccf1e

Request headers

Referer: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Origin: https://comerica.nm-i.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:15 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcgkze8rdOAlcjQbfOlmVolDXsnD1mBb%2F8Vz96w33P6lMxG0SB%2BoZqO2DRDzIQ86FgLoj%2F6fYq5kcxz%2FHeO9sqXQiPHmO7cw28c45S9l5LS5DTnddQkX6uv8LZ8S%2F3XxPkg2wQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/ttf
cache-control: max-age=14400
cf-ray: 8a18e6a6cb9a436a-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 favicon.png
comerica.nm-i.com/theme/dash/images/ 5 KB
5 KB 28ms
27ms Other
image/png 172.67.192.4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/images/favicon.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f304b4addd87825b76107a296fb2e23748f9c8d0bea0b95747b442b538b819b0

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 12:47:15 GMT
cf-cache-status: HIT
last-modified: Thu, 29 Apr 2021 14:22:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4178
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GvlBKGNdvB64yD5QhRx8FNwYkas5oFcFG%2BfSUTFLpA4SCXEQJvInwMrNH0k%2Fn%2FGObaG0%2Bjr6IZhfLXbS6w1lbx2TxXl%2FsdtyqfKwPElRT%2FT80QdWyz1ZT4CaCmkz9%2Ban3XMIrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a18e6a72c00436a-EWR
alt-svc: h3=":443"; ma=86400
content-length: 5000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Comerica (Banking)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			comerica.nm-i.com/	1969-12-31 23:59:59	Name: 951816eb59fc5847a7c93a3c68acb6ac Value: 8db9450464580f6ec1631be7a2226dcd

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://comerica.nm-i.com/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
comerica.nm-i.com
images.e-platform.biz.wf
104.17.24.14
172.67.192.4
23.20.156.202
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
048a8c6dc345ca8890aea344989d89ad8841efa7846a3a3d572b6a2a33824aea
10d0f050edd4accdb98ca99f3d93c108591db894d8baacaede986882ce973019
60e48bd04fb48c634809043ec70cc74417f5ceeebb681f9be7b85be1ae01dd1d
64cb11eb2a5237cbe1e05ccf25acefeed578f32d1a6923d58de35c8a0145e8cd
91f312e42a743c4880099d9f89ab2c15dad5d2a01d6a23b6841466353d78c5ca
983c10ac7366f5247a353fae0d94b8c39dda428f561022e458cc54db946b03ae
9f16d85cd4f3bf9e3cf9f64e3114076c9e3ac8ba108473c819ace6a445ba3652
a4c0fbe0a00aaaa052b5fae4a62ad09368758c96df6a6dbd35469cbe1453c80d
ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491
bbac27a12c4dbc1f1605db29f666da787ba3d0a16b6668526906d94a53307a0c
ea4876d8402170e85b78be6f5860cb57d69f3cdac226919db880c752d6fccf1e
f304b4addd87825b76107a296fb2e23748f9c8d0bea0b95747b442b538b819b0

comerica.nm-i.com Open in urlscan Pro 172.67.192.4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1577 kBTransfer

4387 kBSize

1 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

comerica.nm-i.com Open in urlscan Pro
172.67.192.4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1577 kB
Transfer

4387 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!