urlscan.io logo urlscan.io
SecurityTrails logo

commerzbank.de-ptan.info Open in urlscan Pro
2606:4700:3034::ac43:a867  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://commerzbank.de-ptan.info/commerzbank/tan
Effective URL: https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Submission: On September 27 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3034::ac43:a867, located in United States and belongs to CLOUDFLARENET, US. The main domain is commerzbank.de-ptan.info.
TLS certificate: Issued by GTS CA 1P5 on September 25th 2023. Valid for: 3 months.
This is the only time commerzbank.de-ptan.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 5 2606:4700:303... 13335 (CLOUDFLAR...)
1 212.149.50.15 16365 (COMMERZBA...)
5 3
Apex Domain
Subdomains		 Transfer
5 de-ptan.info
commerzbank.de-ptan.info
272 KB
1 commerzbank.de
kunden.commerzbank.de — Cisco Umbrella Rank: 347464
3 KB
5 2
Domain Requested by
5 commerzbank.de-ptan.info 1 redirects commerzbank.de-ptan.info
1 kunden.commerzbank.de commerzbank.de-ptan.info
5 2
Subject Issuer Validity Valid
de-ptan.info
GTS CA 1P5		 2023-09-25 -
2023-12-24		 3 months crt.sh
kunden.commerzbank.de
GlobalSign Extended Validation CA - SHA256 - G3		 2022-12-21 -
2024-01-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Frame ID: 8227868B059B64507BC50638BB0F2D1F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Anmeldung zum Digital Banking - Commerzbank

Page URL History Show full URLs

  1. http://commerzbank.de-ptan.info/commerzbank/tan HTTP 301
    https://commerzbank.de-ptan.info/commerzbank/tan Page URL
  2. https://commerzbank.de-ptan.info/commerzbank/inloggen/tan Page URL

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

348 kB
Transfer

1044 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://commerzbank.de-ptan.info/commerzbank/tan HTTP 301
    https://commerzbank.de-ptan.info/commerzbank/tan Page URL
  2. https://commerzbank.de-ptan.info/commerzbank/inloggen/tan Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://commerzbank.de-ptan.info/commerzbank/tan HTTP 301
  • https://commerzbank.de-ptan.info/commerzbank/tan

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
tan
commerzbank.de-ptan.info/commerzbank/
Redirect Chain
  • http://commerzbank.de-ptan.info/commerzbank/tan
  • https://commerzbank.de-ptan.info/commerzbank/tan
730 B
860 B 		Document
General
Check archive.org
Download Go to
Full URL
https://commerzbank.de-ptan.info/commerzbank/tan
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:a867 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
80d3a036f9fe229e-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 27 Sep 2023 12:07:21 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n65sbAJXyhnXleDFAa92tnKy%2FHvY22C%2B3MPQ1%2BAX6qK%2FfNnd3I8rzjcZng6WjLPaKh%2BzmQyKuJOoEZ7iumMTmwLkg11DtIhqjCglNfiSxhbkBSM9%2FnQxFXfvwzNuqHN0GQm%2BzhX81yNci5GEYtlxNVgA1pJDEEY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

CF-RAY
80d3a0366d591ed2-AMS
Cache-Control
max-age=3600
Connection
keep-alive
Date
Wed, 27 Sep 2023 12:07:21 GMT
Expires
Wed, 27 Sep 2023 13:07:21 GMT
Location
https://commerzbank.de-ptan.info/commerzbank/tan
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MnwX7WLHaljhEvjNqMFIDPA9s1TDroo4kTezloOUqIK2uMzN6NAWmSX3r%2FXBlmF%2FvZoP09xzTNUjan05%2F07g9g%2BLwbUwPJJcPLMo68scRt45eQk8qsKxejva0gsw%2BYCWlBRkJqtHQUhqYQ1oPl1Qmfm2TaTAZjA%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
Primary Request tan
commerzbank.de-ptan.info/commerzbank/inloggen/ 		946 KB
269 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:a867 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
157dcaf317ff7adfe1d16a7a9633947c5721a3769ab8dc6ffc83b7becccea952

Request headers

Referer
https://commerzbank.de-ptan.info/commerzbank/tan
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
80d3a0391d9c229e-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 27 Sep 2023 12:07:21 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sifJLS1l9ZkyJpPS2OkfprTaQSDxwetq9x5j042qQuAhR6v4SEiVBJTLbK7uN1R6PQq5%2FXowJooVlGqhJ6nzgq0FZfpQKQvjjJMt7iEb0qHZffv82AVLvj15Vdi%2BbB2YNY5lq0pHTTfkN2eA04SUe07JOPRyxx8%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
truncated
/ 		10 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
logo_big_svg.svg
kunden.commerzbank.de/portal/media/system/images/ 		10 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kunden.commerzbank.de/portal/media/system/images/logo_big_svg.svg
Requested by
Host: commerzbank.de-ptan.info
URL: https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
212.149.50.15 Hattersheim, Germany, ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE),
Reverse DNS
kunden.commerzbank.de
Software
Apache /
Resource Hash
2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://commerzbank.de-ptan.info/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date
Wed, 27 Sep 2023 12:07:21 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
Content-Encoding
gzip
com-coba-cif-csrf-protection
0c5e77885d89e459eb78cc370fef045717cd9cd51eab89ca1f5864a1d9faa596
Connection
Keep-Alive
Content-Length
2841
x-xss-protection
1; mode=block
last-modified
Fri, 28 Jul 2023 07:55:03 GMT
Server
Apache
etag
"1754409650-gzip"
x-frame-options
DENY
Vary
Accept-Encoding
content-type
image/svg+xml
content-language
de-DE
cache-control
private
Keep-Alive
timeout=15, max=100
expires
Wed, 27 Sep 2023 12:12:22 GMT
truncated
/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75

Request headers

Referer
Origin
https://commerzbank.de-ptan.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
application/x-font-woff
truncated
/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
88f9247ef9ead1e10ed09369827fb9a34242c5bf454713ac1831ab3c732192e0

Request headers

Referer
Origin
https://commerzbank.de-ptan.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
application/x-font-woff
truncated
/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b52db98725cfebc3ea28099617bd8ec31fe8fb5cf63d8d30d1c375fd64c19876

Request headers

Referer
Origin
https://commerzbank.de-ptan.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
font/woff
login.js
commerzbank.de-ptan.info/js/commerzbank/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://commerzbank.de-ptan.info/js/commerzbank/login.js
Requested by
Host: commerzbank.de-ptan.info
URL: https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:a867 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad48a1dba4adf4bafc4cd9d1566f1d80a5f8383e5f848c0ed1c405006918adff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 27 Sep 2023 12:07:22 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Thu, 08 Jun 2023 18:06:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1048-5fda21e27b000-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOhhVUpKbax3cSnJzmOPdFdvvhNJ1sVgaXZFDDwavOZx201GfpxbXMgB%2BJ%2Bl1oN6UzZwvmCVXyVn23WkuogX2NejM6ijX4R18D31pVdR3az7%2FQ%2FzL2fwKwNQKR6bib1AGCqWIl9IzR%2F5E6SSrYcvS6QtgeHfOnA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
80d3a03b0d2e2a4d-CDG
alt-svc
h3=":443"; ma=86400
online
commerzbank.de-ptan.info/user/ 		1 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://commerzbank.de-ptan.info/user/online
Requested by
Host: commerzbank.de-ptan.info
URL: https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:a867 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://commerzbank.de-ptan.info/commerzbank/inloggen/tan
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarycRRbUdpaIBYzBvAc

Response headers

pragma
no-cache
date
Wed, 27 Sep 2023 12:07:25 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dR%2Bir%2FPf1gMIttamoRh%2FWWSE4c66yDXQuXQTn9Rv4NaO0wTh3H27uMgEbTq2BVfNe2uigWgi08xOxRPHaraGmkjvsrRui4TAPXx4nQbRtQC7ij3%2FKNmxDKks3IWbspXsKevajyeMm7QORSTjTj9nnJFR5qoe2wY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
80d3a04dca812a4d-CDG
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| savepage_ShadowLoader object| dt

1 Cookies

Domain/Path Name / Value
commerzbank.de-ptan.info/ Name: PHPSESSID
Value: p806vg7jkiriutjrjpqitonbj1