comerica.nm-i.com Open in urlscan Pro
2606:4700:3032::6815:1457 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://comerica.nm-i.com/
Effective URL:
https://comerica.nm-i.com/login
Submission: On July 11 via api (July 11th 2024, 11:37:42 am UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::6815:1457, located in United States and belongs to CLOUDFLARENET, US. The main domain is comerica.nm-i.com.
TLS certificate: Issued by WE1 on July 4th 2024. Valid for: 3 months.

This is the only time comerica.nm-i.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Comerica (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 11	2606:4700:303... 2606:4700:3032::6815:1457	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.20.156.202 23.20.156.202	14618 (AMAZON-AES) (AMAZON-AES)
13	3

11 2606:4700:3032::6815:1457 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

comerica.nm-i.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.20.156.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-156-202.compute-1.amazonaws.com

images.e-platform.biz.wf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	nm-i.com 1 redirects comerica.nm-i.com	1 MB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 331	12 KB
1	biz.wf images.e-platform.biz.wf	83 KB
13	3

	Domain	Requested by
11	comerica.nm-i.com	1 redirects comerica.nm-i.com
2	cdnjs.cloudflare.com	comerica.nm-i.com
1	images.e-platform.biz.wf	comerica.nm-i.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
nm-i.com WE1	`2024-07-04` - `2024-10-02`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
www.tel.api.goquick.biz.wf R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://comerica.nm-i.com/login
Frame ID: 35A650F84A62328CBDCE28AFA53A1C68
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

http://comerica.nm-i.com/ HTTP 307
https://comerica.nm-i.com/ HTTP 303
https://comerica.nm-i.com/login Page URL

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

1578 kB
Transfer

4387 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://comerica.nm-i.com/ HTTP 307
https://comerica.nm-i.com/ HTTP 303
https://comerica.nm-i.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
comerica.nm-i.com/
Redirect Chain

http://comerica.nm-i.com/
https://comerica.nm-i.com/
https://comerica.nm-i.com/login

9 KB
2 KB

216ms
216ms

Document
text/html

2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3033bb0405cef117c08b5bae80d08ba92509b5d30cdb3aa9d0b4348f01182b2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a1880a1f9878c4e-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 11 Jul 2024 11:37:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jvun7x1p07DHSbxKBYgG42ukFCj436N189PKuQgSeYmpBTzZQws3cx1fCsl%2FCWB1aqjaD7E3YDDxdE07DuyJGpyU3xLtQRhQtXTP7f00clBqhbbDZwLWQ0ZD9lznrJtzW%2BfDrLTWYDYddxv3QzmZyw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 8a1880a0480d8c4e-EWR
content-type: text/html; charset=utf-8
date: Thu, 11 Jul 2024 11:37:36 GMT
expires: Wed, 17 Aug 2005 00:00:00 GMT
last-modified: Thu, 11 Jul 2024 11:37:36 GMT
location: https://comerica.nm-i.com/login
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VfAi69a1X1mLTvHoQrFqcR0Stje85%2FJsC%2FXnIKxDyG1lDcyZVnPQFA5Qn74Urg9VVyymEuliPl5DeGRpFZPLFPaXDemXI0tfyI7V5E496XZu2yG8giqspu%2BsvyLOW6v0siV3W35Cl5xOi9pS%2BtTiew%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 dashlite.css
comerica.nm-i.com/theme/dash/assets/css/ 756 KB
120 KB 154ms
153ms Stylesheet
text/css 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f16d85cd4f3bf9e3cf9f64e3114076c9e3ac8ba108473c819ace6a445ba3652

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:28:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f7c7XnokBDgWjb7Zl5nUPDRe3wJah06%2BKAovQVuOIW2UbQB7oqGFXUTA28uSbxvklFU9lQV%2FnSIvpXeoivbhN24DlnyqMBP2bMjd9gPUVHHRpalRrtP87EGEUPryDe27CkK1YV0Kts7tGV3N8DrtOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a1880a37e5342f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 custom.css
comerica.nm-i.com/theme/dash/ 2 KB
1 KB 121ms
119ms Stylesheet
text/css 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/custom.css
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4c0fbe0a00aaaa052b5fae4a62ad09368758c96df6a6dbd35469cbe1453c80d

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 29 Jun 2021 12:15:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WK6qqjvegRBWgEF0TbCwFltDJEU0pEDZSxLyNrytHusWEdpUD1eE8iZgZHmb0CARoCtXyAzQYrrQMRJ%2Fn5eGyihr01UIn1qINT4BU62FgI4ZlB44L677hBrIjv1d3TyCoh3Tb9nihhEQ1LZlVtatTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a1880a38e5a42f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 intlTelInput.css
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/ 25 KB
3 KB 275ms
80ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 60412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1970
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f902e0e-62a6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6NMLcAjH5XONFBIoQVDMLByj7dRcZxGet2Q0zIMc3QOfiomcnzwN7yvOh9RogoTtyU%2Bq8gDcT0LskmyU9CQfnQ8B4IStpuA%2Bi2%2FMmXBqSlGTu9puGonum5tRrGkhGHP3vxzKE%2FqlFHrUtLFKmokFfBrK"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a1880a4b9981a1f-EWR
expires: Tue, 01 Jul 2025 11:37:36 GMT

GET
H3 200 theme.css
comerica.nm-i.com/theme/dash/assets/css/ 175 B
618 B 118ms
116ms Stylesheet
text/css 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/css/theme.css?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d0f050edd4accdb98ca99f3d93c108591db894d8baacaede986882ce973019

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWOVrZa49060zhyyycwelkdyr8Kd1UdbxlQzDDUclh8fJXymSnaoaGzIITeuDnsbdn1OdJ9FLTqUahbn9Fo5EgnSb6j3eSEV1B1Wpz6LAR4mPpMSyN%2FryTvcQslTPYrj8HtsgA0F4kQJfkpMWnc%2F1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8a1880a38e5c42f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 intlTelInput.min.js Show response
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/ 29 KB
9 KB 273ms
79ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/intlTelInput.min.js

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64cb11eb2a5237cbe1e05ccf25acefeed578f32d1a6923d58de35c8a0145e8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1958421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8889
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f902e0e-72d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MSJPqT%2FWut5%2FrQzWMua8pH70AV0rIlyzEPOXkzcdH7LU399ZneV%2FkHag5NFubJwYkPrY7E19%2FpxdevM6PnwgreTLgLLabF2GfKSzfpNRvuxbJY2QDygtvgXEG49dsOpdIodiolfeuWymRcBbZMHdaew2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a1880a4b9961a1f-EWR
expires: Tue, 01 Jul 2025 11:37:36 GMT

GET
H/1.1 200
OK 20157627836e725ca8-f621-42e9-a92b-654609847e3d.png
images.e-platform.biz.wf/ 82 KB
83 KB 925ms
80ms Image
image/png 23.20.156.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.e-platform.biz.wf/20157627836e725ca8-f621-42e9-a92b-654609847e3d.png

Requested by

Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

23.20.156.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-20-156-202.compute-1.amazonaws.com

Software

Apache /

Resource Hash

048a8c6dc345ca8890aea344989d89ad8841efa7846a3a3d572b6a2a33824aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://comerica.nm-i.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 11 Jul 2024 11:37:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 20 Sep 2021 06:25:09 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 84337

GET
H3 200 custom.js Show response
comerica.nm-i.com/theme/dash/ 1 B
468 B 355ms
355ms Script
text/javascript 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/custom.js?870007076
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:36 GMT
cf-cache-status: MISS
last-modified: Sat, 12 Jun 2021 05:03:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KPAhvbD%2FivRH3wlBDG9N3Yhh5UVb4P4NaYdxrCJ3%2BBxOUSitSFNYBX16nG%2BZcDIK2lIlcTCBXWbX0E1SSui05LqcpsrwWOa7jmTlzoWPx8xWy%2BT08Iu%2FpKLiTlPCjbncUDdBo6lzRXHI%2FNdb7PHYLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a1880a3be9b42f7-EWR
alt-svc: h3=":443"; ma=86400
content-length: 1

GET
H3 200 bundle.js Show response
comerica.nm-i.com/theme/dash/assets/js/ 3 MB
1 MB 166ms
166ms Script
text/javascript 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/js/bundle.js?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60e48bd04fb48c634809043ec70cc74417f5ceeebb681f9be7b85be1ae01dd1d

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O3Wtsa%2B441MVyEUKS%2FvXTqdG2AJoVAJ553BQLxo7QHZbX5Y8Xu1xU1aVydG5txD2g6ACM76NRvUnPC%2B5OGIq2J%2BtG107hVSM7EmwAWOrSCDOrLFgigYYAjFWAvn%2FXywnTdYpv1z4jTdWPn%2FztJJIGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 8a1880a6388a42f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.js Show response
comerica.nm-i.com/theme/dash/assets/js/ 28 KB
8 KB 125ms
125ms Script
text/javascript 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/js/scripts.js?ver=2.5.0
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 983c10ac7366f5247a353fae0d94b8c39dda428f561022e458cc54db946b03ae

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jV0gCwMAQA9wbnU%2BJLwmUfCmd%2B%2FOye8iJcqz2bMDyin0jGJgkfN%2FHt9V95R2uq3Ewkc0XlqmP54gyG6IOPAMKYoVNH%2FnCAimqowYymycbBVfFS3gq%2BB1rR6vLl6ENueP6Waw2BTAVfarpk7ongsuMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 8a1880a6388e42f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 Nunito-Bold.woff2
comerica.nm-i.com/theme/dash/assets/fonts/ 43 KB
43 KB 181ms
180ms Font
font/woff2 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/fonts/Nunito-Bold.woff2
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbac27a12c4dbc1f1605db29f666da787ba3d0a16b6668526906d94a53307a0c

Request headers

Referer: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Origin: https://comerica.nm-i.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:37 GMT
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lgHoCJ3tfFcaDhsckMEt0R8yt9O9C6XdOg0FHbNVulhwGSM2zj3zljEiC0J69UPZ67ao%2Be86%2FYJ7%2BRWwAKCLXxYYXO6hV28gXmWCPyuM3k01Vp5AtxUYb%2FYZcwd8rpxmCoRndU4Uzk3qNXPIkw%2FPkw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a1880a678b942f7-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43608

GET
H3 200 Nioicon.ttf
comerica.nm-i.com/theme/dash/assets/fonts/ 300 KB
135 KB 235ms
235ms Font
font/ttf 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/assets/fonts/Nioicon.ttf
Requested by: Host: comerica.nm-i.com
URL: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea4876d8402170e85b78be6f5860cb57d69f3cdac226919db880c752d6fccf1e

Request headers

Referer: https://comerica.nm-i.com/theme/dash/assets/css/dashlite.css?ver=2.5.0
Origin: https://comerica.nm-i.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s0mooCsT%2Bwn45BkHVr8PsLG%2Bo%2FqjTFSFpXdzQn4AeRaE9YMu9tPgbB1toHvAhz0eNkj%2BnHA91ks88ZTaky%2F4moQYtxpiJCIySB5tPEG8mkiBL2qxRMg7AzYTWOkqHIJDNMFTAY16RtlvH7gRNjEU8g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/ttf
cache-control: max-age=14400
cf-ray: 8a1880a678bc42f7-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.png
comerica.nm-i.com/theme/dash/images/ 5 KB
5 KB 131ms
130ms Other
image/png 2606:4700:3032::6815:1457
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://comerica.nm-i.com/theme/dash/images/favicon.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1457 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f304b4addd87825b76107a296fb2e23748f9c8d0bea0b95747b442b538b819b0

Request headers

Referer: https://comerica.nm-i.com/login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jul 2024 11:37:37 GMT
cf-cache-status: MISS
last-modified: Thu, 29 Apr 2021 14:22:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sIM97%2Bt6%2Bz4RbdYWbiirP%2BcDuFNqT8%2FEebcG7IzVg8fjTPcjUemEqjCH68waVGBCIQSiIfr0NT36kZ024u4Ax%2BuHSPfvB80JYEUBEEiKnNKWeCHt0I3CRIKTKlPaRY26TjmkKQaKljDOgLzTBxD1Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a1880ac2e7742f7-EWR
alt-svc: h3=":443"; ma=86400
content-length: 5000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Comerica (Banking)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			comerica.nm-i.com/	1969-12-31 23:59:59	Name: 951816eb59fc5847a7c93a3c68acb6ac Value: a92e90f6a89bf9cb999ac8b3b51b71c3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://comerica.nm-i.com/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
comerica.nm-i.com
images.e-platform.biz.wf
23.20.156.202
2606:4700:3032::6815:1457
2606:4700::6811:190e
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
048a8c6dc345ca8890aea344989d89ad8841efa7846a3a3d572b6a2a33824aea
10d0f050edd4accdb98ca99f3d93c108591db894d8baacaede986882ce973019
60e48bd04fb48c634809043ec70cc74417f5ceeebb681f9be7b85be1ae01dd1d
64cb11eb2a5237cbe1e05ccf25acefeed578f32d1a6923d58de35c8a0145e8cd
983c10ac7366f5247a353fae0d94b8c39dda428f561022e458cc54db946b03ae
9f16d85cd4f3bf9e3cf9f64e3114076c9e3ac8ba108473c819ace6a445ba3652
a4c0fbe0a00aaaa052b5fae4a62ad09368758c96df6a6dbd35469cbe1453c80d
ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491
bbac27a12c4dbc1f1605db29f666da787ba3d0a16b6668526906d94a53307a0c
ea4876d8402170e85b78be6f5860cb57d69f3cdac226919db880c752d6fccf1e
f3033bb0405cef117c08b5bae80d08ba92509b5d30cdb3aa9d0b4348f01182b2
f304b4addd87825b76107a296fb2e23748f9c8d0bea0b95747b442b538b819b0

comerica.nm-i.com Open in urlscan Pro 2606:4700:3032::6815:1457 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

1578 kBTransfer

4387 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

comerica.nm-i.com Open in urlscan Pro
2606:4700:3032::6815:1457 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

1578 kB
Transfer

4387 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!