commerzbank.701627.com Open in urlscan Pro
2606:4700:3036::6815:3f8b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://commerzbank.701627.com/op/index1.php
Effective URL:
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/
Submission: On July 25 via manual (July 25th 2023, 9:13:46 am UTC) from DE — Scanned from DE

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3036::6815:3f8b, located in United States and belongs to CLOUDFLARENET, US. The main domain is commerzbank.701627.com.
TLS certificate: Issued by GTS CA 1P5 on July 6th 2023. Valid for: 3 months.

This is the only time commerzbank.701627.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OP Financial Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 15	2606:4700:303... 2606:4700:3036::6815:3f8b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3035::ac43:9211	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.75.116.193 146.75.116.193	54113 (FASTLY) (FASTLY)
14	3

15 2606:4700:3036::6815:3f8b (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

commerzbank.701627.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:9211 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

commerzbank.701627.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	701627.com 3 redirects commerzbank.701627.com	506 KB
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 7183	196 KB
14	2

	Domain	Requested by
16	commerzbank.701627.com	3 redirects commerzbank.701627.com
1	i.imgur.com
14	2

This site contains links to these domains. Also see Links.

Domain
vero-fin.com

Subject Issuer	Validity	Valid
701627.com GTS CA 1P5	`2023-07-06` - `2023-10-04`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-13` - `2024-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/
Frame ID: 2AA68CC4CAA5E10B8A750AA5597FEADA
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OP Tunnistuspalvelu

Page URL History Show full URLs

https://commerzbank.701627.com/op/index1.php Page URL
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9 HTTP 301
http://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/ HTTP 301
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/ HTTP 302
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

914 kB
Transfer

1632 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://vero-fin.com/b1/a1#opidentityprovider-container
Title: Siirry suoraan sisältöön

Search URL Search Domain Scan URL

URL: https://vero-fin.com/b1/a1
Title: FI

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://commerzbank.701627.com/op/index1.php Page URL
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9 HTTP 301
http://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/ HTTP 301
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/ HTTP 302
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 index1.php Show response
commerzbank.701627.com/op/ 663 B
857 B 301ms
92ms Document
text/html 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/index1.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d450009484b02feb813e2edf47f2d74af8a0f1a4b3124bdd95022b68fef8af96

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ec349cf58dbbbdd-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 25 Jul 2023 09:13:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y31xU%2FkRyUVsp2R8li%2FQJBnkmlmaeCVgJn2GQLyjTLF2pdeJCJahYS7d1q5jdNyHzObCuYcn%2BbnXLEyfG%2FiMM0psgaZMDv7Od5x9ivx1hxmKHlV2atgOw9nQUxV0bFmt7GOTHwyDy7rx4K80SbnZaoLvvEJO"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3

200

Primary Request / Show response
commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/
Redirect Chain

https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9?
http://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/?
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/?
https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?

1 MB
448 KB

271ms
270ms

Document
text/html

2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c990b121326bdfa8688a1da5eba97e25a9c1672129214b6049d9109bbaf6c3b4

Request headers

Referer: https://commerzbank.701627.com/op/index1.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7ec349d7bdc82c7d-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 25 Jul 2023 09:13:42 GMT
expires: 0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bHwEyNJ7PZHduyMPT0OmYDD2HVAvISSVdYU3x2C8sWkXiV7HAwqR6aUOONc%2BDzkZBcf%2BtKKNRRuniyIKSr%2Bn2oru%2BHCxW7HSQ2JZAXngIqJuUu5MT6zvQqmIZzB504mUbazYcZXmvhcuLt%2F7jSRcfHD2vbhu"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ec349d73d292c7d-FRA
content-type: text/html; charset=UTF-8
date: Tue, 25 Jul 2023 09:13:42 GMT
location: login/?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C0y3fihiztLtMxq3jx8IZ5xE%2BZ7fHsigMakfVPLePFFT6%2FDsqCcfsthbYKgWvyfbvUr0vF2hXs0ZwXstRgmPRkq%2FJ71SRymVs%2BmWgWqd0AaivMYc3s7kAmCdlvFq4VE0YwIGL0%2FOytiVDkzVtgcJkkjOavYO"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 jquery.min.js Show response
commerzbank.701627.com/op/bower_components/jquery/dist/ 85 KB
31 KB 143ms
140ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/bower_components/jquery/dist/jquery.min.js
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 05 Jun 2017 06:55:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"15283-55130fba92680-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PeLNFJKWnD5C5umMGNRTLrl2hOgbMhu5OnghaCgciNVDyIA2m3ZnsSidWaH1fYw1yZgvzUcNWbQsb6m0jgom1MIuo%2FlIx80D8tGRGEdljCkbgaCMkoYFPIUb%2BVvcomcQpUV3OXn9nrk%2FVVaJrpSVTlbebwpD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349d968022c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 ua-parser.min.js Show response
commerzbank.701627.com/op/bower_components/ua-parser-js/dist/ 17 KB
7 KB 144ms
140ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/bower_components/ua-parser-js/dist/ua-parser.min.js
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 12 Oct 2017 11:16:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"4298-55b57ababd200-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Drz25Gbif3528ix4bWE8kVnZjIjHHF6f%2BECOGajc%2B4u5j%2BVfEtoMG7MxEGgowotq6Jxt9W4zKoSlFjHT8i%2FyHMT2eBcV9h5AxGTRFm6qc5VHxdE1Xsh90H1OhdrU7bUPrgKc26%2BGpIvemWnWhfubKmr7Kiy6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349d968052c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 font-awesome.min.css
commerzbank.701627.com/op/bower_components/font-awesome/css/ 30 KB
7 KB 144ms
141ms Stylesheet
text/css 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/bower_components/font-awesome/css/font-awesome.min.css
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 09 Apr 2017 07:29:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"7918-54cb6d15f5d00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xDhQV9Oba%2FxgYl3Q%2FuWbXAiNV%2BY8SvaO3zNunRCOWsRFpPP9z6otlm0b7YnHJJFwNOvL4czxY%2FKxSX9UkfTsN6Q7HON4E2hFdmmZL%2Btm0FBA9QTPqxpX7v9MW%2BRnOVqU6MsqORh2MOLncdAwC9JrdQqJ7wyP"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7ec349d968072c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 core_form.js Show response
commerzbank.701627.com/op/core/form/ 17 KB
5 KB 146ms
143ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/core/form/core_form.js
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 438bc6292e635fd8dad402df697165c30775ef0874a9037e448f2d6ad8267750

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 20 Nov 2022 22:25:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"4354-5edee6c44c980-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=07ovSgUs4YQPulFggKtCuVl%2FwTKBHwpuKiELa1LVOKHfT3Q%2B8Im1Hwh%2BpTtcpjXfi5mwD8uH6tnO84LC6F2BOB16ARzU7osa1vwAilBw6pezhbNCK1inmrfAOBeS4t7RpjtQjRFdMhJPgFriUqRpekxX%2FkMi"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349d968082c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 core_token.js Show response
commerzbank.701627.com/op/core/token/ 14 KB
2 KB 620ms
618ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/core/token/core_token.js
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8756521c53c70dd0b2d4274913097259831d7f93d55d371847e2d95ed1bafe3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 21 Nov 2022 00:41:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"39d6-5edf04fe69a00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LfaeaBEMC%2BgIjzfzilMP%2B7pUrNFEj59jFkLlt7clTxuMYqD4dpi3dgU0XwKWUWTLGjVCraESKIfLsRgMAm4Bcz3fNp4XKFDtu%2Fi%2B3Wv1ya0aKUIn2F1PAbYVPTpwdqJlJ4qYh6Moibssluvf2BwmNj7gGm%2FX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349d9680a2c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 core_form.css
commerzbank.701627.com/op/core/form/ 3 KB
1 KB 143ms
140ms Stylesheet
text/css 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/core/form/core_form.css
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d41035644c062b68fee8ff52534498bd06407a09efc6c310a9259dd66b481a29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 29 Oct 2022 17:10:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"ac1-5ec2f73cd3680-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4JsiVSq187f2zRZTmMc%2FzgFUUQQMNn1TP5q6ba3WW%2Bt7nv8Cf6fpSSudpYCIobE4t1Pi1TsvcX%2B%2BmTkB7f8UgEZd2%2FGqFD66p01mVzBpbFfz6G8pCKnMpb6ed9DoIwXkqgFDOL8Dq7MEv4Z8xFtvSf%2FpHQOS"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7ec349d9680c2c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 css.css
commerzbank.701627.com/op/login/form/ 563 B
641 B 972ms
969ms Stylesheet
text/css 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/login/form/css.css
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d335a372bae61d5d3e3aa43d81db8e7bb75d2a430f4c5c163048bca93d5bb7d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 26 Sep 2022 09:21:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"233-5e9910c184480-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0h3fRoK%2FI5V%2FRO7Lv3WzDdPVIaZgX3kavVJhev5FDIbRs7AJH5qKHLP3ICT2BfEhRhMcFmiSP3yCPBDwtYV0wq5XgwHsAhvlNiVk0nQ%2FoEsAH0Oq%2FKY0XJweazJeoI08N4mYKC1dWRr2S9a%2BIaqguYbQ8CJX"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7ec349d9680d2c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 form.js Show response
commerzbank.701627.com/op/login/form/ 3 KB
1 KB 55ms
54ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/login/form/form.js?v=64bf92469e94a
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01c12b5cd06120dfb1f8f9ee454d423b3c6648580d55926d5394c0ee6cdc2b47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 22 Sep 2019 12:13:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"a49-593233a038180-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fHGv8LHunYJYK1jhN4cFdi2oU%2Bmc6EggI3QkspIdT3lkEzbwFt4%2BMhEpyt%2F6il1fAPfawB3w1gxI3jwAMLxNCIa0dYn1IrqoSEVmDvzfvfazMVLFaze%2BUcfrbM07bMCt4qnYwhGmXaLvRqTRdZnGbk9RtUSi"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349da59472c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 token.js Show response
commerzbank.701627.com/op/login/token/ 1 KB
982 B 991ms
990ms Script
application/javascript 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/login/token/token.js?v=64bf92469e94f
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0bbbbdcb1b367c9212e278853f052c45436e7d7fcaae2d1250611912374285a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 26 Sep 2022 09:20:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"4ee-5e9910aaa0e80-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vBFGOU7Ye9H4LEjfORophkG2XX65HFwt417nFufjM4Oc6sp%2FQHqQEGEh48xNDCQN2boLPfBJI3OPi7gor0MXlMibwJDgjNvu1tbFq91j7UEim1IZ%2FCS%2Fd9K5ty5uaEV9wTw1wVm89ZZvTfdRHRZmVWPeGuj0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7ec349da59492c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 289 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8ad35536a64e3ff9fd9f2a1bd9c118e9994c2780a11f17cdda7b1147a62c93a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 490 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3c84267eb0db11d299830979146dbc8714a28def15748375319e6848f378a32

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 54 KB
54 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d7e18175b01a2d29a7f6d74b3cf2c84e5e7370cf0e551e6b68a77a41f0e6aef

Request headers

Referer
Origin: https://commerzbank.701627.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 51 KB
51 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98d73206b87453ddbe2fbb60e3e943c0babe5fc5660e7ead12628b20a24efe6d

Request headers

Referer
Origin: https://commerzbank.701627.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 54 KB
54 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f335d6a9719f3c6e393df5fa4c2e0e9765d2124819bb694fc6761c81cae02e9c

Request headers

Referer
Origin: https://commerzbank.701627.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 54 KB
54 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0550f5cf4b0bdaaa71cda2eda8cd5a2090e70887a2eeded9fd6f70c49488c68c

Request headers

Referer
Origin: https://commerzbank.701627.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H2 200 1z3TYgD.gif
i.imgur.com/ 196 KB
196 KB 107ms
31ms Image
image/gif 146.75.116.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/1z3TYgD.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

a08d312a7cd00975612ecb6060481bae0b408e915d1d1e3c85a1ec2550a3e650

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://commerzbank.701627.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:43 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 77792
x-cache: Miss from cloudfront, MISS, HIT
x-amz-storage-class: STANDARD_IA
content-length: 200532
x-served-by: cache-iad-kcgs7200160-IAD, cache-fra-eddf8230106-FRA
last-modified: Sat, 29 Oct 2022 17:09:28 GMT
server: cat factory 1.0
x-timer: S1690276424.841943,VS0,VE3
etag: "81c9b0c83fef75acb33ac03b9c1b08f8"
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: lTjjwU0z_Y4rlJaYDLf0oJo9fRKMcx-cAVExECxRVUeNcqhp1QMzlQ==
x-cache-hits: 0, 1

GET
H3 200 home.php Show response
commerzbank.701627.com/op/ 57 B
460 B 596ms
596ms XHR
application/json 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/home.php?pl=token&link=op&bid=db93ef7ce1f80592e3fd4f6d26a6b2f9&callback=jQuery32107816268594392195_1690276422771&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1690276422772
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/bower_components/jquery/dist/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12883e03cb8f6944a0bdf42502f65f6cefe9da47a2bb95515adc05dcf0e21838

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ss8HapSMFvC1YuPw34O4zaxnbW5GXEKtc%2FgW5Vr9Y24SR063b4mGMN8Gs55upbQUYtT0XC7BEE%2BT5flOIGscSBwsdTrDgEEUszMo0CxEOTceyTtJDwQ5Xjb48OoWAN18jOqGeZTQ9wfuMGbY27DQ25oHSPwb"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cf-ray: 7ec349e08a4f2c7d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 home.php Show response
commerzbank.701627.com/op/ 57 B
466 B 580ms
580ms XHR
application/json 2606:4700:3036::6815:3f8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://commerzbank.701627.com/op/home.php?pl=token&link=op&bid=db93ef7ce1f80592e3fd4f6d26a6b2f9&callback=jQuery32107816268594392195_1690276422773&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1690276422774
Requested by: Host: commerzbank.701627.com
URL: https://commerzbank.701627.com/op/bower_components/jquery/dist/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:3f8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f66f5ee81a055dbc648c8535c388e4dbae5e486e36a71bdc258ab7ce276d426

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://commerzbank.701627.com/op/a1b2c3/db93ef7ce1f80592e3fd4f6d26a6b2f9/login/?
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 09:13:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c8l%2Bn7zPxPb0LDUAOAZxC%2B9%2F32aY0fQnAJOVFyXVq9SwKwos8E96tsdkwhQYhTUJaQ1v5B%2BMUIYufn3YoFhcSTEey%2BJnxmfqChGaYr84fclWeYV%2BqiuOGsvP5zItI%2BvMXoGb3lbrpY9iFM3AeJGJ1qJUpdXa"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cf-ray: 7ec349e08a522c7d-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OP Financial Group (Banking)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			commerzbank.701627.com/op	1969-12-31 23:59:59	Name: real Value: OK
			commerzbank.701627.com/	1970-01-20 14:14:28	Name: bid Value: db93ef7ce1f80592e3fd4f6d26a6b2f9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

commerzbank.701627.com
i.imgur.com
146.75.116.193
2606:4700:3035::ac43:9211
2606:4700:3036::6815:3f8b
01c12b5cd06120dfb1f8f9ee454d423b3c6648580d55926d5394c0ee6cdc2b47
0550f5cf4b0bdaaa71cda2eda8cd5a2090e70887a2eeded9fd6f70c49488c68c
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
12883e03cb8f6944a0bdf42502f65f6cefe9da47a2bb95515adc05dcf0e21838
438bc6292e635fd8dad402df697165c30775ef0874a9037e448f2d6ad8267750
4f66f5ee81a055dbc648c8535c388e4dbae5e486e36a71bdc258ab7ce276d426
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
98d73206b87453ddbe2fbb60e3e943c0babe5fc5660e7ead12628b20a24efe6d
9d7e18175b01a2d29a7f6d74b3cf2c84e5e7370cf0e551e6b68a77a41f0e6aef
a08d312a7cd00975612ecb6060481bae0b408e915d1d1e3c85a1ec2550a3e650
c0bbbbdcb1b367c9212e278853f052c45436e7d7fcaae2d1250611912374285a
c8ad35536a64e3ff9fd9f2a1bd9c118e9994c2780a11f17cdda7b1147a62c93a
c990b121326bdfa8688a1da5eba97e25a9c1672129214b6049d9109bbaf6c3b4
d335a372bae61d5d3e3aa43d81db8e7bb75d2a430f4c5c163048bca93d5bb7d0
d41035644c062b68fee8ff52534498bd06407a09efc6c310a9259dd66b481a29
d450009484b02feb813e2edf47f2d74af8a0f1a4b3124bdd95022b68fef8af96
e3c84267eb0db11d299830979146dbc8714a28def15748375319e6848f378a32
e8756521c53c70dd0b2d4274913097259831d7f93d55d371847e2d95ed1bafe3
f335d6a9719f3c6e393df5fa4c2e0e9765d2124819bb694fc6761c81cae02e9c

commerzbank.701627.com Open in urlscan Pro 2606:4700:3036::6815:3f8b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

914 kBTransfer

1632 kBSize

2 Cookies

2 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

39 JavaScript Global Variables

2 Cookies

Indicators

commerzbank.701627.com Open in urlscan Pro
2606:4700:3036::6815:3f8b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

914 kB
Transfer

1632 kB
Size

2
Cookies

14 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!