comdirect-sicherheitscenter.grnx.info
Open in
urlscan Pro
2606:4700:3036::6815:57ca
Malicious Activity!
Public Scan
Effective URL: https://comdirect-sicherheitscenter.grnx.info/Vorgang
Submission: On August 30 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by WE1 on August 20th 2024. Valid for: 3 months.
This is the only time comdirect-sicherheitscenter.grnx.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commerzbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 92.205.9.14 92.205.9.14 | 21499 (GODADDY-SXB) (GODADDY-SXB) | |
1 11 | 2606:4700:303... 2606:4700:3036::6815:57ca | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 2 |
ASN21499 (GODADDY-SXB, DE)
PTR: 14.9.205.92.host.secureserver.net
suite.social |
ASN13335 (CLOUDFLARENET, US)
comdirect-sicherheitscenter.grnx.info |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
grnx.info
1 redirects
comdirect-sicherheitscenter.grnx.info |
235 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
28 KB |
1 |
suite.social
1 redirects
suite.social |
354 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
11 | comdirect-sicherheitscenter.grnx.info |
1 redirects
comdirect-sicherheitscenter.grnx.info
|
1 | cdnjs.cloudflare.com |
comdirect-sicherheitscenter.grnx.info
|
1 | suite.social | 1 redirects |
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
grnx.info WE1 |
2024-08-20 - 2024-11-18 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://comdirect-sicherheitscenter.grnx.info/Vorgang
Frame ID: 4C685E14CDF8C0A72B220ACA82AB62B1
Requests: 9 HTTP requests in this frame
Frame:
https://comdirect-sicherheitscenter.grnx.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js
Frame ID: 9E320DE3468377475C121C2E265EB8C2
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://suite.social/s/Scpgy
HTTP 301
https://comdirect-sicherheitscenter.grnx.info/Vorgang Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://suite.social/s/Scpgy
HTTP 301
https://comdirect-sicherheitscenter.grnx.info/Vorgang Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://comdirect-sicherheitscenter.grnx.info/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://comdirect-sicherheitscenter.grnx.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
Vorgang
comdirect-sicherheitscenter.grnx.info/ Redirect Chain
|
42 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MarkWeb-latin-regular.woff2
comdirect-sicherheitscenter.grnx.info/assets/fonts/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MarkWeb-latin-medium.woff2
comdirect-sicherheitscenter.grnx.info/assets/fonts/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MarkWeb-latin-bold.woff2
comdirect-sicherheitscenter.grnx.info/assets/fonts/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styleguide-comdirect.css
comdirect-sicherheitscenter.grnx.info/assets/css/ |
1 MB 117 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
forms.css
comdirect-sicherheitscenter.grnx.info/assets/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.3/ |
88 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
svg-symbol.svg
comdirect-sicherheitscenter.grnx.info/assets/fonts/ |
220 KB 52 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
comdirect-sicherheitscenter.grnx.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/ Frame 9E32 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8bb361ff5a39903c
comdirect-sicherheitscenter.grnx.info/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 9E32 |
0 973 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
comdirect-sicherheitscenter.grnx.info/ |
299 B 687 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commerzbank (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery number| timeLeft number| setTimer function| c number| dots function| type function| formatCardNumber number| timer4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
suite.social/ | Name: PHPSESSID Value: d0uoj1fm8iokka9aid0bnfl10b |
|
suite.social/ | Name: short_21 Value: 1 |
|
comdirect-sicherheitscenter.grnx.info/ | Name: PHPSESSID Value: ohjpebjkhv2ledf3c61d1nnloa |
|
.grnx.info/ | Name: cf_clearance Value: 048RG9NFm6LWRYJioXp.cAonnlsUsIvoxNVvW_EOy6I-1725006250-1.2.1.1-v0VvTY7GboiAQ9DY5X.Q8_8sOhZneKFSDSQVPdcM8Q7AI.2aisPqYO8ksxfge3e5sbR0MIcjMO7OgWqoCLwnEdzP2MhkI.c5d5judEf8PXMVj25juex1ztFSht99U9o_cW8P4_isaD6tyjIHbmOIxqUGGBLVJFZeNA7ImkS0iLvJP4UNsPU7Q06eGuMRFry9ggUnfQiyAiX2NsJHQoEsboF0qkou82dMWpbQsZ9znnZDUVhBitmrAN.4qhROwKK3UHGWtN9acYr91Oz6hgobY6Ecdrtr3XHc_GWehK_Q4GGYXirDYoaL0nUt353EulBjUyygeRiByCNdGDgs62NhrNUO8TI9ZHw06UGMdlrAN9IcWu_8LPqG2OYf3OIS0TROsGPpi3fgIPZG42EFQAFyCw |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
comdirect-sicherheitscenter.grnx.info
suite.social
2606:4700:3036::6815:57ca
2606:4700::6811:180e
92.205.9.14
0d1cc2a6019d6b03ea239211cfb469986995a2de4be0d7d44f912faaddece17f
1c34bf68801b2b0dfa3edd58f4d1726c48cca05825ee65fc7a1a2c820c76cb9c
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
3a68ac341c0429d1021a01c05e413a59c57b2fa629aa32215d20c51d9340433c
66fe2532d864324a34a2a0d3f6bc8a662b788fc24a205caa05e2b9445187269b
88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3
92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7d7d47140cbe5632390dde0ea2f5352369f1fa31f066b986aef83f8cd44727c