kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de Open in urlscan Pro
185.193.89.7  Malicious Activity! Public Scan

URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Submission: On July 21 via manual from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.193.89.7, located in Russian Federation and belongs to ERISHENNYA-ASN, UA. The main domain is kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de.
TLS certificate: Issued by R3 on May 9th 2023. Valid for: 3 months.
This is the only time kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

IP Address AS Autonomous System
10 185.193.89.7 210950 (ERISHENNY...)
10 2
Domain Requested by
10 kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
10 1

This site contains no links.

Subject Issuer Validity Valid
h5panel.org
R3
2023-05-09 -
2023-08-07
3 months crt.sh

This page contains 1 frames:

Primary Page: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Frame ID: 19B6908CB169BFB705B92427E6517084
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

comdirect Login - Ihr Online Banking & Brokerage | comdirect.de

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

461 kB
Transfer

1556 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
89 KB
18 KB
Document
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
b2d089ee251d150d36495fd02e865613e30907215948f52b6854eaabe72465e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17383
Content-Type
text/html; charset=UTF-8
Date
Fri, 21 Jul 2023 06:50:13 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx/1.14.2
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
MarkWeb-latin-regular.woff2
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/
15 KB
15 KB
Font
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/MarkWeb-latin-regular.woff2
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Origin
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 30 Mar 2023 09:44:38 GMT
Server
nginx/1.14.2
ETag
"3b64-5f81af0e60d80"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15204
MarkWeb-latin-medium.woff2
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/
15 KB
15 KB
Font
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/MarkWeb-latin-medium.woff2
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Origin
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 30 Mar 2023 09:44:42 GMT
Server
nginx/1.14.2
ETag
"3a60-5f81af1231680"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14944
MarkWeb-latin-bold.woff2
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/
15 KB
15 KB
Font
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/MarkWeb-latin-bold.woff2
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Origin
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 30 Mar 2023 09:44:42 GMT
Server
nginx/1.14.2
ETag
"3c5c-5f81af1231680"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15452
styleguide-comdirect.css
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/style/
1 MB
116 KB
Stylesheet
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/style/styleguide-comdirect.css
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
441c9d9a45a0b0f65b4a4c11859e72414b4441bf03d7e03e42690b315effd3ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Thu, 30 Mar 2023 10:58:50 GMT
Server
nginx/1.14.2
ETag
"108d76-5f81bfa422e80-gzip"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
jquery-3.6.1.min.js
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/js/
114 KB
34 KB
Script
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/js/jquery-3.6.1.min.js
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 14 Feb 2023 19:25:18 GMT
Server
nginx/1.14.2
ETag
"1c995-5f4adec81c380-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
34232
main.js
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/js/
1 KB
803 B
Script
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/js/main.js
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
94bc68d20ce20d3053a3cd9a689f42c3c3b08ec927f462e907cdee096542c7a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:13 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Thu, 11 May 2023 08:57:24 GMT
Server
nginx/1.14.2
ETag
"4c8-5fb672d506500-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
431
8.php
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/antibot8/
0
441 B
XHR
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/antibot8/8.php
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Fri, 21 Jul 2023 06:50:14 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Server
nginx/1.14.2
Access-Control-Allow-Methods
POST
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
X-Robots-Tag
noindex
Access-Control-Allow-Headers
*
Content-Length
0
Expires
Thu, 18 Aug 1994 05:00:00 GMT
svg-symbol.svg
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/
220 KB
220 KB
Other
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/fonts/svg-symbol.svg
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:14 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 30 Mar 2023 05:40:34 GMT
Server
nginx/1.14.2
ETag
"37064-5f817880c5880"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
225380
truncated
/
797 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5405b0009161e617ee06548d437c8e9fa3a8ce3dafaca161024458ba907c1fc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
235 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=UTF-8
Newsletter_512x560-1x.jpg
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/images/
26 KB
26 KB
Image
General
Full URL
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/images/Newsletter_512x560-1x.jpg
Requested by
Host: kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de
URL: https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
e294648a46772c4ff71c3a2f5ecf0ac264389eb1195d7bf75acacc9a4e456d00
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Date
Fri, 21 Jul 2023 06:50:14 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 30 Mar 2023 09:50:04 GMT
Server
nginx/1.14.2
ETag
"6721-5f81b04546b00"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
26401

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| abc number| microtime string| abcbody function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
.kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/ Name: antibot_dafc8b322e41346c6ff2b05904b57c1d
Value: cf9ea9a035b36427f3db5796b00cc20c-1689922213
kunde-comdirect.de-id8174bafu1b809fanb1kjhoiab178fn17azhf1bufa.com.de/ Name: PHPSESSID
Value: e2couacgr2ufdr79afkavouhu5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains