www.ecolejagraulhet.com Open in urlscan Pro
109.234.164.133 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://indica7.gr/lv/
Effective URL:
https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification
Submission: On November 29 via manual (November 29th 2023, 1:37:15 pm UTC) from IN — Scanned from DE

Summary HTTP 3 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 109.234.164.133, located in Créteil, France and belongs to O2SWITCH, FR. The main domain is www.ecolejagraulhet.com.
TLS certificate: Issued by R3 on October 26th 2023. Valid for: 3 months.

This is the only time www.ecolejagraulhet.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	194.36.140.144 194.36.140.144	50939 (SPACE-AS) (SPACE-AS)
1 3	109.234.164.133 109.234.164.133	50474 (O2SWITCH) (O2SWITCH)
3	3

1 194.36.140.144 (Romania)

ASN50939 (SPACE-AS, RO)
PTR: indica7.gr

indica7.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 109.234.164.133 (Créteil, France) 1 redirects

ASN50474 (O2SWITCH, FR)
PTR: 109-234-164-133.reverse.odns.fr

www.ecolejagraulhet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ecolejagraulhet.com 1 redirects www.ecolejagraulhet.com	240 KB
1	indica7.gr indica7.gr	337 B
3	2

	Domain	Requested by
3	www.ecolejagraulhet.com	1 redirects www.ecolejagraulhet.com
1	indica7.gr
3	2

This site contains links to these domains. Also see Links.

Domain
www.comdirect.de
kunde.comdirect.de
magazin.comdirect.de
jobs.commerzbank.com
community.comdirect.de
www.facebook.com
twitter.com
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
*.indica7.gr R3	`2023-11-25` - `2024-02-23`	3 months	crt.sh
ecolejagraulhet.com R3	`2023-10-26` - `2024-01-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification
Frame ID: EA08718D4E5107496143BE3D39474949
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage | comdirect.de

Page URL History Show full URLs

https://indica7.gr/lv/ Page URL
https://www.ecolejagraulhet.com/Comdirect/index.php Page URL
https://www.ecolejagraulhet.com/Comdirect/portal/index.php?pwd=UEh0cFFyRkA HTTP 302
https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

270 kB
Transfer

1402 kB
Size

1
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://www.comdirect.de/

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/inf/musterdepot/index.html
Title: Musterdepot

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/business-partners/leistungsangebot.html
Title: B2B

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/lp/wt/login
Title: Login

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/lp/wt/login
Title: Login

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/inf/index.html
Title: Informer

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/konto/girokonto.html
Title: Girokonto

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/geldanlage/geldanlage.html
Title: Geldanlage

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/depot/depot.html
Title: Depot

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/wertpapierhandel/wertpapierhandel.html
Title: Wertpapierhandel

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/kredit/kredit.html
Title: Kredite

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-kontakt.html
Title: Hilfe & Service

Search URL Search Domain Scan URL

URL: http://www.comdirect.de/pbl/https/member/ssomanager/personalization/forgottenlogindata/OverviewVP.do
Title: Zugangsdaten vergessen? Zugang gesperrt?

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/konto/girokonto.html
Title: Konto eröffnen

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/ngtx/depot/sparplan/auswahl?wref=4675
Title: Depot eröffnen

Search URL Search Domain Scan URL

URL: http://www.comdirect.de/pbl/https/member/ssomanager/personalization/registration/StartRegistrationRH.do
Title: Kostenfreie Registrierung für "Meine comdirect" und "comdirect community"

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/pbl/a.do?rd=%2Fcms%2Fhistocks.html%3Fsc_cid%3D6708%26cid%3Dcomdirect_web%3Ateaser%3Ahistocks%3Arefresh%3Apts_sigmalang_04_up-to-date%3Abrokerage&ad=000067089900jo1TS0019900004020
Title: An der Börse gilt: Überblick bewahren Das geht am besten mithilfe der hi!stocks-Community.

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/ueberuns/de/unternehmen/index.html
Title: Über uns

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/ueberuns/de/presse/presse.html
Title: Presse

Search URL Search Domain Scan URL

URL: https://magazin.comdirect.de/
Title: Magazin

Search URL Search Domain Scan URL

URL: https://jobs.commerzbank.com/index.php?ac=search_result&search_criterion_physical_location%5B%5D=551&search_criterion_physical_location%5B%5D=3
Title: Karriere

Search URL Search Domain Scan URL

URL: https://community.comdirect.de/
Title: Community

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/apps.html
Title: Apps

Search URL Search Domain Scan URL

URL: https://kunde.comdirect.de/cms/kundenwerbung.html
Title: Kunden werben Kunden

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-sicherheit-datenschutz.html
Title: Datenschutz

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-sicherheit.html
Title: Sicherheit

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/cms/hilfe-service-nutzungsbedingungen.html
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://www.comdirect.de/pbl/ePdfTracker.do?ePageId=cori6762
Title: AGB

Search URL Search Domain Scan URL

URL: https://www.facebook.com/comdirect

Search URL Search Domain Scan URL

URL: https://twitter.com/comdirect

Search URL Search Domain Scan URL

URL: https://www.youtube.com/comdirect

Search URL Search Domain Scan URL

URL: https://www.instagram.com/comdirect/?hl=de

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://indica7.gr/lv/ Page URL
https://www.ecolejagraulhet.com/Comdirect/index.php Page URL
https://www.ecolejagraulhet.com/Comdirect/portal/index.php?pwd=UEh0cFFyRkA HTTP 302
https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response indica7.gr/lv/	95 B 337 B	1894ms 1413ms	Document text/html	194.36.140.144 SPACE-AS
General Check archive.org Show headers Download Go to Full URL https://indica7.gr/lv/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 194.36.140.144 , Romania, ASN50939 (SPACE-AS, RO), Reverse DNS indica7.gr Software LiteSpeed / PHP/8.1.25 Resource Hash `839fbe054c2f4726cb01bed69c297207c503a17982f024a206f22ba84c5acc7b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 74 content-type text/html; charset=UTF-8 date Wed, 29 Nov 2023 13:37:10 GMT server LiteSpeed vary Accept-Encoding x-powered-by PHP/8.1.25
GET H2	200	index.php www.ecolejagraulhet.com/Comdirect/	76 B 312 B	956ms 584ms	Document text/html	109.234.164.133 O2SWITCH
General Check archive.org Show headers Download Go to Full URL https://www.ecolejagraulhet.com/Comdirect/index.php Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 109.234.164.133 Créteil, France, ASN50474 (O2SWITCH, FR), Reverse DNS 109-234-164-133.reverse.odns.fr Software o2switch-PowerBoost-v3 / Resource Hash Request headers Referer https://indica7.gr/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Wed, 29 Nov 2023 13:37:11 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server o2switch-PowerBoost-v3 vary Accept-Encoding
GET H2	200	Primary Request login.php Show response www.ecolejagraulhet.com/Comdirect/portal/clients/ Redirect Chain https://www.ecolejagraulhet.com/Comdirect/portal/index.php?pwd=UEh0cFFyRkA https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification	1 MB 240 KB	924ms 924ms	Document text/html	109.234.164.133 O2SWITCH
General Check archive.org Show headers Download Go to Full URL https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification Requested by Host: www.ecolejagraulhet.com URL: https://www.ecolejagraulhet.com/Comdirect/index.php Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 109.234.164.133 Créteil, France, ASN50474 (O2SWITCH, FR), Reverse DNS 109-234-164-133.reverse.odns.fr Software o2switch-PowerBoost-v3 / Resource Hash `868a8f521a0c0d7e20c64154ee6335dcf903bd275c464441aefddd5161fb0bc9` Request headers Referer https://www.ecolejagraulhet.com/Comdirect/index.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Wed, 29 Nov 2023 13:37:13 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server o2switch-PowerBoost-v3 vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Wed, 29 Nov 2023 13:37:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location clients/login.php?verification#_ pragma no-cache server o2switch-PowerBoost-v3
GET DATA	200 OK	truncated /	864 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b3ca2a82e4b90c20c2ce0bf8eed46d6e96a065c62667879c9315aeb8b0860778` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347` Request headers Referer Origin https://www.ecolejagraulhet.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	235 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Content-Type image/svg+xml;charset=UTF-8
GET DATA	200 OK	truncated /	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773` Request headers Referer Origin https://www.ecolejagraulhet.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	84 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e0a001ba531d714ad3dd9ba9a654416412d3d1da8347002bb6980e0ae8bd7bfe` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Content-Type image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| savepage_ShadowLoader

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.ecolejagraulhet.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: f0698d0fa9c3191efef5c04c8884e13c

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification#_(Line 22) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification#_(Line 23) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://www.ecolejagraulhet.com/Comdirect/portal/clients/login.php?verification#_(Line 24) Message: <link rel=preload> has an invalid `href` value
security	warning	URL: about:srcdoc Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

indica7.gr
www.ecolejagraulhet.com
109.234.164.133
194.36.140.144
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
839fbe054c2f4726cb01bed69c297207c503a17982f024a206f22ba84c5acc7b
868a8f521a0c0d7e20c64154ee6335dcf903bd275c464441aefddd5161fb0bc9
b3ca2a82e4b90c20c2ce0bf8eed46d6e96a065c62667879c9315aeb8b0860778
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
e0a001ba531d714ad3dd9ba9a654416412d3d1da8347002bb6980e0ae8bd7bfe

www.ecolejagraulhet.com Open in urlscan Pro 109.234.164.133 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

270 kBTransfer

1402 kBSize

1 Cookies

34 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

www.ecolejagraulhet.com Open in urlscan Pro
109.234.164.133 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

270 kB
Transfer

1402 kB
Size

1
Cookies

3 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!