commerz.onlinebanking.com.de
Open in
urlscan Pro
141.255.167.42
Malicious Activity!
Public Scan
Effective URL: https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/login/?7658e6b34f8c6932fb7f00e3032c11cd
Submission: On February 21 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 20th 2023. Valid for: 3 months.
This is the only time commerz.onlinebanking.com.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commerzbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 17 | 141.255.167.42 141.255.167.42 | 51852 (PLI-AS) (PLI-AS) | |
6 | 212.149.50.15 212.149.50.15 | 16365 (COMMERZBA...) (COMMERZBANK DE-60261 Frankfurt) | |
1 | 2620:1ec:4e:1... 2620:1ec:4e:1::45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
21 | 4 |
ASN51852 (PLI-AS, PA)
PTR: hostedby.privatelayer.com
commerz.onlinebanking.com.de |
ASN16365 (COMMERZBANK DE-60261 Frankfurt, DE)
PTR: kunden.commerzbank.de
kunden.commerzbank.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
com.de
3 redirects
commerz.onlinebanking.com.de |
243 KB |
6 |
commerzbank.de
kunden.commerzbank.de — Cisco Umbrella Rank: 330611 |
257 KB |
1 |
poste.it
securelogin.poste.it |
33 KB |
21 | 3 |
Domain | Requested by | |
---|---|---|
17 | commerz.onlinebanking.com.de |
3 redirects
commerz.onlinebanking.com.de
|
6 | kunden.commerzbank.de |
commerz.onlinebanking.com.de
|
1 | securelogin.poste.it | |
21 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
loading.onlinebanking.com.de R3 |
2023-02-20 - 2023-05-21 |
3 months | crt.sh |
kunden.commerzbank.de GlobalSign Extended Validation CA - SHA256 - G3 |
2022-12-21 - 2024-01-20 |
a year | crt.sh |
securelogin.poste.it GlobalSign RSA OV SSL CA 2018 |
2022-03-25 - 2023-04-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/login/?7658e6b34f8c6932fb7f00e3032c11cd
Frame ID: 90655313563D7354242BE15E918CCF95
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Anmeldung zum Digital Banking - CommerzbankPage URL History Show full URLs
-
https://commerz.onlinebanking.com.de/de/commerzbank.de
HTTP 301
https://commerz.onlinebanking.com.de/de/commerzbank.de/ HTTP 302
https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/?7658e6b34f8c6932fb7f00e... HTTP 302
https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/login/?7658e6b34f8c6932f... Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://commerz.onlinebanking.com.de/de/commerzbank.de
HTTP 301
https://commerz.onlinebanking.com.de/de/commerzbank.de/ HTTP 302
https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/?7658e6b34f8c6932fb7f00e3032c11cd HTTP 302
https://commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/login/?7658e6b34f8c6932fb7f00e3032c11cd Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
commerz.onlinebanking.com.de/de/commerzbank.de/.c48495416518e7ffb901ff4fa447d7d6/login/ Redirect Chain
|
246 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
commerz.onlinebanking.com.de/de/commerzbank.de/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
commerz.onlinebanking.com.de/de/commerzbank.de/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
commerz.onlinebanking.com.de/de/commerzbank.de/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
commerz.onlinebanking.com.de/de/commerzbank.de/core/form/ |
17 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
commerz.onlinebanking.com.de/de/commerzbank.de/core/token/ |
10 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
commerz.onlinebanking.com.de/de/commerzbank.de/core/form/ |
3 KB 1023 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
commerz.onlinebanking.com.de/de/commerzbank.de/login/form/ |
170 B 473 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
commerz.onlinebanking.com.de/de/commerzbank.de/login/ |
393 KB 117 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cms.css
kunden.commerzbank.de/portal/media/system/36.161.22/css/ |
200 KB 89 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_ui_1_12_1.js
kunden.commerzbank.de/portal/media/system/36.161.22/js/ |
248 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lib_head.js
kunden.commerzbank.de/portal/media/system/36.161.22/js/ |
42 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_big_svg.svg
kunden.commerzbank.de/portal/media/system/images/ |
10 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lib_main.js
kunden.commerzbank.de/portal/media/system/36.161.22/js/ |
288 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
commerz.onlinebanking.com.de/de/commerzbank.de/login/form/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
commerz.onlinebanking.com.de/de/commerzbank.de/login/token/ |
1 KB 929 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons_woff.woff
commerz.onlinebanking.com.de/de/commerzbank.de/login/fonts/ |
40 KB 40 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_big_svg.svg
kunden.commerzbank.de/portal/media/system/images/ |
10 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner_giallo.gif
securelogin.poste.it/risorse_dt/condivise/immagini/generiche/ |
33 KB 33 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
commerz.onlinebanking.com.de/de/commerzbank.de/ |
57 B 252 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
commerz.onlinebanking.com.de/de/commerzbank.de/ |
57 B 252 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commerzbank (Banking)54 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_proxy function| ask_info_proxy function| ask_qrcode_proxy function| ask_cc_proxy function| ask_sms_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond function| change object| mrm object| cfs object| Modernizr function| yepnope function| salReInitInputSpinners function| isGTMActive function| collectGTMData function| fillCID function| Class object| Tc function| _ object| Select2 string| bid object| php_js object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
commerz.onlinebanking.com.de/de/commerzbank.de | Name: real Value: OK |
|
commerz.onlinebanking.com.de/ | Name: bid Value: .c48495416518e7ffb901ff4fa447d7d6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
commerz.onlinebanking.com.de
kunden.commerzbank.de
securelogin.poste.it
141.255.167.42
212.149.50.15
2620:1ec:4e:1::45
09c301ac93374353ee5802818ccec2515124a6a08fabb1a6ac283740e357cacf
0d1780e1dd7d40617aa6e101b01a74452c0efad8a64c71685b97839a7a40b2e7
0f1c5a585e0aff95230b76534ebae34b6279a249658e7e5d163320eaf27b66c4
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
18502a76a13c8dd95fbcf1775e4b6178680fb394b229fafcef1b5eb43a821b10
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da
76be7e43c2d0433197244f7eab5a9e3e359bfc3d8bd66bb8717effa5c686fa72
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a38150935a3947ba4c2ffec1ec97a36c6ad2f2b9dccf599066a0b4549f93cec
80ca5bc3f64c260f79b3b18a2a55f50869c3f966e0dd6b20f0fc6f4232cbc862
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
88f9247ef9ead1e10ed09369827fb9a34242c5bf454713ac1831ab3c732192e0
8aa8c539b7372deed1fbab206a6fd97d0eafb1b5f687f68d9355e3ef695d11b2
8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
b52db98725cfebc3ea28099617bd8ec31fe8fb5cf63d8d30d1c375fd64c19876
bc1b67e2581885954afb1913b6cb9356fc8b0edfacede100eb12467bf4708aa8
bdcbed16c6d4e1f9eec441b2b6300e0e0df3c6bcd060bbc1042aff007aa1fd16
cb4e5a4a25b095758e702317af5145988042cd4a5fb43866b8cdc6ddbd2da809
d15fd0bb0cb9525912018ac1d0df19a71dda62b32323f7ef3a22a0e47cfd4b3f
ea638c8244c7a5cc50e617807b1fc35637430f976e8210ef3d560a5eb059e5f5