login-service.info Open in urlscan Pro
68.65.122.198 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login-service.info/web/ing/homepagina.php
Submission: On February 04 via api (February 4th 2020, 4:06:47 pm UTC) from BE

Summary HTTP 23 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 23 HTTP transactions. The main IP is 68.65.122.198, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is login-service.info.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 30th 2020. Valid for: a year.

This is the only time login-service.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address		AS Autonomous System
22	68.65.122.198 68.65.122.198		22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	213.177.34.188 213.177.34.188		11303 (DATARETURN) (DATARETURN)
23	2

22 68.65.122.198 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium23-4.web-hosting.com

login-service.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.177.34.188 (United Kingdom)

ASN11303 (DATARETURN, US)

media.ing.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	login-service.info login-service.info	214 KB
1	ing.be media.ing.be	74 KB
23	2

	Domain	Requested by
22	login-service.info	login-service.info
1	media.ing.be
23	2

This site contains links to these domains. Also see Links.

Domain
verificatie-homelng.info
www.facebook.com
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
login-service.info Sectigo RSA Domain Validation Secure Server CA	`2020-01-30` - `2021-01-29`	a year	crt.sh
media.ing.be Entrust Certification Authority - L1M	`2018-05-31` - `2020-05-31`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://login-service.info/web/ing/homepagina.php
Frame ID: 833CEB38402A2356474BB89E653E10D0
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Node.js (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /socket\.io.*\.js/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /socket\.io.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

23
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

288 kB
Transfer

887 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://verificatie-homelng.info/nl/retail/day-to-day-banking/self-banking/pages/homebank.aspx?WT.oldlink_redir=showdoc_docid_323068
Title: Nog geen Home'Bank-abonnement?

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ingbankbelgie
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/ingBelgie
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ingbelgium
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request homepagina.php Show response login-service.info/web/ing/	109 KB 12 KB	667ms 311ms	Document text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `0a4a39cf41a4ad776a261b048e8bfbffe914964f1c1ad732b6567281500ca170` Request headers :method GET :authority login-service.info :scheme https :path /web/ing/homepagina.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 date Tue, 04 Feb 2020 16:06:30 GMT server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-encoding gzip content-length 11779 content-type text/html; charset=UTF-8
GET H2	200	bootstrap.min.css login-service.info/web/ing/homepage_files/	152 KB 23 KB	647ms 646ms	Stylesheet text/css	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/bootstrap.min.css Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:48 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges none content-length 23238
GET H2	200	style1.css login-service.info/web/ing/homepage_files/	71 KB 12 KB	197ms 196ms	Stylesheet text/css	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/style1.css Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `4c459809148580e2d0d043116166306c43bc3f95ea888e0018b49201c952a87c` Request headers Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:51 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 12429
GET H2	200	style2.css login-service.info/web/ing/homepage_files/	49 KB 30 KB	492ms 492ms	Stylesheet text/css	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/style2.css Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `be5f277a1bba4de541790745b0f12ba69e9aa84fc3b3c392f6becd0ca46333f7` Request headers Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:52 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges none content-length 30549
GET H2	200	jquery-3.4.1.min.js.download Show response login-service.info/web/ing/homepage_files/	86 KB 30 KB	497ms 497ms	Script application/javascript	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/jquery-3.4.1.min.js.download Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:50 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes content-length 30677
GET H2	200	socket.io.js.download Show response login-service.info/web/ing/homepage_files/	61 KB 19 KB	346ms 346ms	Script application/javascript	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/socket.io.js.download Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `8e2d3db4408e44abebf3107d88297c0c9f2234c2eb8837210b5fa9fb2b75852b` Request headers Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:51 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges none content-length 19127
GET H2	200	ing-logo.svg login-service.info/web/ing/homepage_files/	11 KB 5 KB	766ms 766ms	Image image/svg+xml	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://login-service.info/web/ing/homepage_files/ing-logo.svg Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `da4638536ea61163947d415fce63a19e4c7be592fe76908e9dac19eb35e5ea8f` Request headers Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:48 GMT server Apache vary Accept-Encoding content-type image/svg+xml status 200 accept-ranges bytes content-length 4550
GET H2	200	jquery-3.4.1.js.download Show response login-service.info/web/ing/homepage_files/	274 KB 82 KB	767ms 766ms	Script application/javascript	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/web/ing/homepage_files/jquery-3.4.1.js.download Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / Resource Hash `5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:30 GMT content-encoding gzip last-modified Thu, 30 Jan 2020 13:45:50 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges none
GET H2	200	/ Show response login-service.info/socket.io/	36 B 206 B	183ms 182ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz016 Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
GET H2	200	CardReaderWithCard.png login-service.info/web/ing/homepage_files/	36 B 36 B	204ms 204ms	Image text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://login-service.info/web/ing/homepage_files/CardReaderWithCard.png Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://login-service.info/web/ing/homepage_files/style1.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
GET H2	200	INGMeWeb-Bold.woff2 login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Bold/	36 B 206 B	181ms 181ms	Font text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Bold/INGMeWeb-Bold.woff2 Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
GET H2	200	INGMeWeb-Regular.woff2 login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Regular/	36 B 206 B	188ms 188ms	Font text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Regular/INGMeWeb-Regular.woff2 Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
GET H2	200	c-icon-sprite.png login-service.info/img/	36 B 36 B	180ms 179ms	Image text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://login-service.info/img/c-icon-sprite.png Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://login-service.info/web/ing/homepage_files/style1.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
POST H2	200	/ Show response login-service.info/socket.io/	36 B 206 B	180ms 180ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz03_ Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Content-type text/plain;charset=UTF-8 Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
GET H2	200	INGMeWeb-Bold.woff login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Bold/	36 B 206 B	179ms 179ms	Font text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Bold/INGMeWeb-Bold.woff Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
GET H2	200	INGMeWeb-Regular.woff login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Regular/	36 B 212 B	180ms 180ms	Font text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/static/ing-app-be-daily-banking-shell/5.10.0/bower_components/ing-uif-styles/assets/INGMe/Regular/INGMeWeb-Regular.woff Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepagina.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info Response headers date Tue, 04 Feb 2020 16:06:31 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
GET H/1.1	200 OK	INGMeWeb-Regular.ttf media.ing.be/styleguide/salesflow/2.1.1/fonts/Regular/	74 KB 74 KB	96ms 23ms	Font application/octet-stream	213.177.34.188 DATARETURN
General Check archive.org Show headers Download Go to Full URL https://media.ing.be/styleguide/salesflow/2.1.1/fonts/Regular/INGMeWeb-Regular.ttf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 213.177.34.188 , United Kingdom, ASN11303 (DATARETURN, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `2d0bd238bea24334b756db3ceed592b175cad6ce035c0592e8dbeb45206eea23` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://login-service.info/web/ing/homepage_files/style2.css Origin https://login-service.info Response headers Date Tue, 04 Feb 2020 16:06:19 GMT Last-Modified Fri, 02 Jun 2017 07:45:12 GMT Server Microsoft-IIS/8.5 ETag "e81e12a74dbd21:0" Content-Type application/octet-stream Access-Control-Allow-Origin * Accept-Ranges bytes Content-Length 75496
GET H2	200	/ Show response login-service.info/socket.io/	36 B 206 B	188ms 187ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz0Kv Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:32 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 content-length 48
POST H2	200	/ Show response login-service.info/socket.io/	36 B 212 B	179ms 179ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz0Ns Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Content-type text/plain;charset=UTF-8 Response headers date Tue, 04 Feb 2020 16:06:32 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
GET H2	200	/ Show response login-service.info/socket.io/	36 B 212 B	241ms 240ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz15O Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:35 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
POST H2	200	/ Show response login-service.info/socket.io/	36 B 212 B	180ms 180ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz19B Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Content-type text/plain;charset=UTF-8 Response headers date Tue, 04 Feb 2020 16:06:35 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
GET H2	200	/ Show response login-service.info/socket.io/	36 B 212 B	180ms 180ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz20b Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers date Tue, 04 Feb 2020 16:06:39 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48
POST H2	200	/ Show response login-service.info/socket.io/	36 B 212 B	183ms 183ms	XHR text/html	68.65.122.198 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://login-service.info/socket.io/?EIO=3&transport=polling&t=N0Gz23Q Requested by Host: login-service.info URL: https://login-service.info/web/ing/homepage_files/socket.io.js.download Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.198 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium23-4.web-hosting.com Software Apache / PHP/7.2.27 Resource Hash `84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5` Request headers Accept / Referer https://login-service.info/web/ing/homepagina.php Origin https://login-service.info User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Content-type text/plain;charset=UTF-8 Response headers date Tue, 04 Feb 2020 16:06:39 GMT content-encoding gzip server Apache x-powered-by PHP/7.2.27 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 accept-ranges none content-length 48

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| io object| socket

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login-service.info
media.ing.be
213.177.34.188
68.65.122.198
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0a4a39cf41a4ad776a261b048e8bfbffe914964f1c1ad732b6567281500ca170
2d0bd238bea24334b756db3ceed592b175cad6ce035c0592e8dbeb45206eea23
4c459809148580e2d0d043116166306c43bc3f95ea888e0018b49201c952a87c
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
84f7ab260a589465dc1a1cd521a2aa92fb980f76edff7b071089627611977dd5
8e2d3db4408e44abebf3107d88297c0c9f2234c2eb8837210b5fa9fb2b75852b
be5f277a1bba4de541790745b0f12ba69e9aa84fc3b3c392f6becd0ca46333f7
da4638536ea61163947d415fce63a19e4c7be592fe76908e9dac19eb35e5ea8f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855