urlscan.io logo urlscan.io
SecurityTrails logo

m.commbank-faq.net Open in urlscan Pro
104.21.87.100  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bit.ly/3shbo1P
Effective URL: https://m.commbank-faq.net/
Submission: On November 12 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 104.21.87.100, located in and belongs to CLOUDFLARENET, US. The main domain is m.commbank-faq.net.
TLS certificate: Issued by GTS CA 1P5 on November 7th 2023. Valid for: 3 months.
This is the only time m.commbank-faq.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commonwealth Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.10 396982 (GOOGLE-CL...)
9 104.21.87.100 13335 (CLOUDFLAR...)
9 2
Apex Domain
Subdomains		 Transfer
9 commbank-faq.net
m.commbank-faq.net
331 KB
1 bit.ly
bit.ly — Cisco Umbrella Rank: 6111
286 B
9 2
Domain Requested by
9 m.commbank-faq.net m.commbank-faq.net
1 bit.ly 1 redirects
9 2

This site contains no links.

Subject Issuer Validity Valid
commbank-faq.net
GTS CA 1P5		 2023-11-07 -
2024-02-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://m.commbank-faq.net/
Frame ID: 17509DD6CAC5B86A170DE956593C177D
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

comm

Page URL History Show full URLs

  1. https://bit.ly/3shbo1P HTTP 301
    https://m.commbank-faq.net/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div [^>]*id="__nuxt"
Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

331 kB
Transfer

1232 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3shbo1P HTTP 301
    https://m.commbank-faq.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
m.commbank-faq.net/
Redirect Chain
  • https://bit.ly/3shbo1P
  • https://m.commbank-faq.net/
656 B
759 B 		Document
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1ca51f398be1526a214125bf6e378003715be82a7e80dd8634e1b0c96040f00

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82528b5428ebdfbd-SYD
content-encoding
br
content-type
text/html
date
Sun, 12 Nov 2023 23:27:12 GMT
last-modified
Tue, 07 Nov 2023 15:41:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dBXAsjf0rnvN8O2%2FfzNhN9sWXqDNEY4HWzJ1QUy8ZbOKe3BlP1jdKdYmJCCYRDe93jvZx3WxbQnalI3aYwX3qUoD93jevWd9PUyUV7SaeTbM5Ex21U7GhhvcKdQ1ZAGY15HYZe8%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=90
content-length
117
content-security-policy
referrer always;
content-type
text/html; charset=utf-8
date
Sun, 12 Nov 2023 23:27:11 GMT
location
https://m.commbank-faq.net/#/m
referrer-policy
unsafe-url
server
nginx
via
1.1 google
chunk-vendors.6bd942ea.js
m.commbank-faq.net/js/ 		970 KB
262 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/js/chunk-vendors.6bd942ea.js
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17aec1d79a40be3dce35f66f593a80a1f5dc74d861f53101ca338746eb2fb4a8

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://m.commbank-faq.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 07 Nov 2023 15:41:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
31453
etag
W/"654a5abd-f26d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SuEXyKSX%2B54kAEA3kLMfyFfE3Qbq5Lu0lVR3%2BH%2BBh%2BrRLOFyn6BWVHBI4Wu1jQ%2B1mOzM7eHPTS1cL7L60QPnNoPA7orlY5%2B0UXe6i3IzfLtiPcZ11b4FEmsOrxx9iTtnniZZVJ0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
82528b546939dfbd-SYD
alt-svc
h3=":443"; ma=86400
expires
Mon, 13 Nov 2023 02:42:59 GMT
app.dfe4ad8b.js
m.commbank-faq.net/js/ 		24 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/js/app.dfe4ad8b.js
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c9b15b03779b9cf5a3bb85fa04c24740184ad55c354b484c1568baa90bd802b

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://m.commbank-faq.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 07 Nov 2023 15:41:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
31453
etag
W/"654a5ab6-6027"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BhL5QNU1G%2FTz%2FaA0ltCR0p5Zy8Ryror2VYLtaL%2BF8MXQC9VMZCRgYtsuwDM4lFpaVO4ogwbKmh3nfFTU2tp9UG7pRy9Rr6byMunYvtiWFDdMKonqtjsZy04BZoAZMjLRQR3nprU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
82528b54693adfbd-SYD
alt-svc
h3=":443"; ma=86400
expires
Mon, 13 Nov 2023 02:42:59 GMT
chunk-vendors.10dd4e95.css
m.commbank-faq.net/css/ 		206 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/css/chunk-vendors.10dd4e95.css
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa6f1d96e529b170226115b7eb039ed98b1c74687495207ff4bf95a8a2ced3bc

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://m.commbank-faq.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 07 Nov 2023 15:41:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
31453
etag
W/"654a5ac2-338cd"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ti8F9Jqt0RiY7M6Kt8b6EfVb7MulScwtRKPtKlPIwfEVKGvG3GXgnzo6iwBm93pkIoAoLPMk7lnMOONlyv4bPKfk4KXk0wZeRodgxpKGQ%2FXEMcXySc3L%2BTziUROIt%2BZgjXjf3LI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=43200
cf-ray
82528b546936dfbd-SYD
alt-svc
h3=":443"; ma=86400
expires
Mon, 13 Nov 2023 02:42:59 GMT
app.1c4b802b.css
m.commbank-faq.net/css/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/css/app.1c4b802b.css
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3468a37943155c215a61aac1cfaabca313e9d4ac7e48276c6a2bec085d84fb80

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://m.commbank-faq.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 07 Nov 2023 15:41:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
31453
etag
W/"654a5ac2-267a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ERObpuFu2PcPJtl4BDGfv5KXUqEQlB8wa3nJ0k%2Byd4aLLfMW%2B6EiXwGeD5ld5Ekop5tizM%2Bv%2BymIkUFWvteKdMvDY1pllyvyamL7p5l0R0DiQ9SvxVdjrWYsDxqCJSe4WANo9Xg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=43200
cf-ray
82528b546938dfbd-SYD
alt-svc
h3=":443"; ma=86400
expires
Mon, 13 Nov 2023 02:42:59 GMT
checkIp
m.commbank-faq.net/api/card/fish/ 		41 B
446 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/api/card/fish/checkIp?key=125
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/js/chunk-vendors.6bd942ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb

Request headers

Accept
application/json, text/plain, */*
Referer
https://m.commbank-faq.net/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ufCfHV4OoBauJCYlCCL2%2FwUSui0h3K%2BI%2FRoUhOGUIhA6iMbMB5NALdVq5PP797lJjAyPsDt3tM%2BW8v0ZWNrJGAN%2B87qsP1gnMGqD%2BKYhyV367oa7GNBFE4ZGOmwQ6WEzJ5g%2Fqoo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
82528b552a88dfbd-SYD
alt-svc
h3=":443"; ma=86400
visits
m.commbank-faq.net/api/num/record/ 		41 B
380 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/api/num/record/visits
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/js/chunk-vendors.6bd942ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb

Request headers

Accept
application/json, text/plain, */*
Referer
https://m.commbank-faq.net/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7hBslN7jZEv9nv%2BFO7UoeR9XJ2b91nofMPUlamEoNI5NeyX7CFxgvvKf2mZbsVVQrtKsSQA6qtvgDGZVV3ad%2BxeGAHUMVbM7c%2BagAVkW0MQ%2BQoCYv483MSc6%2FVYowYUjSpDdrB4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
82528b553a95dfbd-SYD
alt-svc
h3=":443"; ma=86400
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Content-Type
image/gif
tuchu.458967d3.2fe75ea7.jpg
m.commbank-faq.net/img/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.commbank-faq.net/img/tuchu.458967d3.2fe75ea7.jpg
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
458967d3ac2e85cd5c2f4c53201fa95c49819e705dd9f04966fa38804569ae86

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://m.commbank-faq.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
21066
alt-svc
h3=":443"; ma=86400
content-length
17315
last-modified
Tue, 07 Nov 2023 15:41:41 GMT
server
cloudflare
etag
"654a5ab5-43a3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ebcwumyJHkslFeRMwdHpl3Yhcg3Utg20QCMWUMNi8qKn6JBxWOV53oTYQoT8Y2KfYE2hZ%2BShpFzhChWvJPwycc6QiSRwlYux98tKwo16R1N60iJdXjxEJujfyo%2BEBBut2Vk6vs%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
82528b553a97dfbd-SYD
expires
Tue, 12 Dec 2023 17:36:06 GMT
user
m.commbank-faq.net/api/card/websocket-domain/ 		114 B
506 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.commbank-faq.net/api/card/websocket-domain/user
Requested by
Host: m.commbank-faq.net
URL: https://m.commbank-faq.net/js/chunk-vendors.6bd942ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.87.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1266ab5027e68005bf33635672314bd8349ae481a2a12ee01241e8a15fb35fb

Request headers

Accept
application/json, text/plain, */*
Referer
https://m.commbank-faq.net/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 12 Nov 2023 23:27:12 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X8uOJ%2BPgG%2B%2FLJKv928vGBZkpPooAAVKzqLQH8HUXuPFTigAV1SjARzJNJaAl7wzsmBLnL9RWQjKS2rDLSUE%2BRGZ7Zu9ri228KpvSag2sFuXXiVBzBEx2NorCdtPgjZ%2Blmghinxs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
82528b555ac3dfbd-SYD
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commonwealth Bank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackChunkcomm function| clearImmediate function| setImmediate function| _ object| $cookies

5 Cookies

Domain/Path Name / Value
m.commbank-faq.net/api Name: JSESSIONID
Value: 11194218F1BEB86687F8D9D58D23A966
.bit.ly/ Name: _bit
Value: nacnrb-38677a7d0365b11ce3-007
m.commbank-faq.net/ Name: token
Value: null
m.commbank-faq.net/ Name: domainName
Value: wss%3A%2F%2Fss.blt-ly.site%2Fapi%2Fapprove%2F
m.commbank-faq.net/ Name: userIp
Value: 66.203.112.162