comdirect.de-73afc.sbs

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 2606:4700:3032::6815:359a, located in United States and belongs to CLOUDFLARENET, US. The main domain is comdirect.de-73afc.sbs.
TLS certificate: Issued by WE1 on November 4th 2024. Valid for: 3 months.

This is the only time comdirect.de-73afc.sbs was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2	2606:4700:303... 2606:4700:3032::6815:359a		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2

2 2606:4700:3032::6815:359a (United States)

ASN13335 (CLOUDFLARENET, US)

comdirect.de-73afc.sbs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	de-73afc.sbs comdirect.de-73afc.sbs	75 KB
2	1

	Domain	Requested by
2	comdirect.de-73afc.sbs	comdirect.de-73afc.sbs
2	1

This site contains links to these domains. Also see Links.

Domain
www.comdirect.de
kunde.comdirect.de
magazin.comdirect.de
jobs.commerzbank.com
community.comdirect.de
www.facebook.com
twitter.com
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
de-73afc.sbs WE1	`2024-11-04` - `2025-02-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://comdirect.de-73afc.sbs/comdi/login.php
Frame ID: 06FD9588F7B6FA36A2928CCDABD0C87A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage | comdirect.de

Page URL History Show full URLs

https://comdirect.de-73afc.sbs/ Page URL
https://comdirect.de-73afc.sbs/comdi/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

105 kB
Transfer

273 kB
Size

1
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.comdirect.de/

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/

Search URL Search Domain Scan URL

URL: http://www.comdirect.de/pbl/https/member/ssomanager/personalization/forgottenlogindata/OverviewVP.do
Title: Zugangsdaten vergessen? Zugang gesperrt?

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-kontakt.html
Title: Kontakt

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/ueberuns/de/unternehmen/index.html
Title: Über uns

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/ueberuns/de/presse/presse.html
Title: Presse

Search URL Search Domain Scan URL

URL: https://magazin.comdirect.de/
Title: Magazin

Search URL Search Domain Scan URL

URL: https://jobs.commerzbank.com/index.php?ac=search_result&search_criterion_physical_location%5B%5D=551&search_criterion_physical_location%5B%5D=3
Title: Karriere

Search URL Search Domain Scan URL

URL: https://community.comdirect.de/
Title: Community

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/apps.html
Title: Apps

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/kundenwerbung.html
Title: Kunden werben Kunden

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-sicherheit-datenschutz.html
Title: Datenschutz

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-sicherheit.html
Title: Sicherheit

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-nutzungsbedingungen.html
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/pbl/ePdfTracker.do?ePageId=cori6762
Title: AGB

Search URL Search Domain Scan URL

URL: https://www.facebook.com/comdirect
Title: Social Icon Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/comdirect
Title: Social Icon Plattform X

Search URL Search Domain Scan URL

URL: https://www.youtube.com/comdirect
Title: Social Icon YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/comdirect/?hl=de
Title: Social Icon Instagram

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://comdirect.de-73afc.sbs/ Page URL
https://comdirect.de-73afc.sbs/comdi/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	/ comdirect.de-73afc.sbs/	190 B 919 B	887ms 867ms	Document text/html	2606:4700:3032::6815:359a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://comdirect.de-73afc.sbs/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:359a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 8e3720a7bb2b1cc7-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Sat, 16 Nov 2024 11:26:42 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RwdUKTbXMcljgFUW5wERAK%2B6L9ktew%2Fg76yXraj4fwPKsxu%2FiGNZYwqWN1djaIkR%2FHPIF9wHhcVQe2938zXhSZdng4ZG9YlF61xQNktUb8dt8w3rNDTqRL6%2BCnfPwXjIamPwKT58xiLkzFI%2FUvtsDRakoP2i"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=6196&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4143&recv_bytes=4431&delivery_rate=877&cwnd=12000&unsent_bytes=0&cid=d3ba5088a41207d7&ts=872&x=1" cfHdrFlush;dur=0 vary Accept-Encoding
GET H3	200	Primary Request login.php Show response comdirect.de-73afc.sbs/comdi/	243 KB 75 KB	548ms 548ms	Document text/html	2606:4700:3032::6815:359a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://comdirect.de-73afc.sbs/comdi/login.php Requested by Host: comdirect.de-73afc.sbs URL: https://comdirect.de-73afc.sbs/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:359a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0d4bccd5f6c446e7fa3ff58c98c0be060ec3d4e0cb6f52ba9e0912d630311de6` Request headers Referer https://comdirect.de-73afc.sbs/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 8e3720ad48ff1cc7-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Sat, 16 Nov 2024 11:26:43 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fUDLTP06HnQ5nD%2BKfJogh8%2Fz7ImGQrQmkBE2dHwwDNthbrrXx9Tzx%2F8QBz8iQsO1RCq4yf4yw8yzl2jfTloFyREd5YY12vzSwKKNAqszb5PFG%2B1ELFu%2F3Dy2k7DPzpn1qKHyCSDkEHNXh5ZJx5sbX4Q%2Fnuq"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=6191&sent=14&recv=12&lost=0&retrans=0&sent_bytes=5133&recv_bytes=4916&delivery_rate=156868&cwnd=12000&unsent_bytes=0&cid=d3ba5088a41207d7&ts=1439&x=1" cfHdrFlush;dur=0 vary Accept-Encoding
GET DATA	200 OK	truncated /	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://comdirect.de-73afc.sbs Referer Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://comdirect.de-73afc.sbs Referer Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	235 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			comdirect.de-73afc.sbs/	1969-12-31 23:59:59	Name: PHPSESSID Value: 554eco6hcnaud151a82339peen

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

comdirect.de-73afc.sbs
2606:4700:3032::6815:359a
0d4bccd5f6c446e7fa3ff58c98c0be060ec3d4e0cb6f52ba9e0912d630311de6
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773

comdirect.de-73afc.sbs Open in urlscan Pro 2606:4700:3032::6815:359a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

105 kBTransfer

273 kBSize

1 Cookies

20 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

comdirect.de-73afc.sbs Open in urlscan Pro
2606:4700:3032::6815:359a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

105 kB
Transfer

273 kB
Size

1
Cookies

2 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!