zatanka.com
Open in
urlscan Pro
45.32.197.61
Malicious Activity!
Public Scan
Effective URL: https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=8UT9aqUzEaajae7OdXwo5TCgxdaiuAzoLDvwr7WgGveFiajCYnlJr7P7...
Submission: On June 14 via automatic, source phishtank
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 28th 2020. Valid for: 3 months.
This is the only time zatanka.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.219.248.25 104.219.248.25 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 9 | 45.32.197.61 45.32.197.61 | 20473 (AS-CHOOPA) (AS-CHOOPA) | |
1 6 | 193.41.234.21 193.41.234.21 | 16289 (ING-DIREC...) (ING-DIRECT-SPAIN) | |
1 | 108.128.20.85 108.128.20.85 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server134-2.web-hosting.com
ing.areaclientes.us |
ASN20473 (AS-CHOOPA, US)
PTR: 45.32.197.61.vultr.com
zatanka.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-20-85.eu-west-1.compute.amazonaws.com
ingdirectspain.demdex.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
zatanka.com
1 redirects
zatanka.com |
1 MB |
6 |
ingdirect.es
1 redirects
ing.ingdirect.es |
113 KB |
1 |
demdex.net
ingdirectspain.demdex.net |
|
1 |
areaclientes.us
1 redirects
ing.areaclientes.us |
132 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
9 | zatanka.com |
1 redirects
zatanka.com
|
6 | ing.ingdirect.es |
1 redirects
zatanka.com
|
1 | ingdirectspain.demdex.net |
zatanka.com
|
1 | ing.areaclientes.us | 1 redirects |
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
zatanka.com Let's Encrypt Authority X3 |
2020-05-28 - 2020-08-26 |
3 months | crt.sh |
ing.ingdirect.es DigiCert Global CA G2 |
2020-03-28 - 2022-03-29 |
2 years | crt.sh |
*.demdex.net DigiCert SHA2 High Assurance Server CA |
2018-01-09 - 2021-02-12 |
3 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=8UT9aqUzEaajae7OdXwo5TCgxdaiuAzoLDvwr7WgGveFiajCYnlJr7P7R03trJcxXiM453GQqkpZulTi
Frame ID: 4384159D24AA1F3680B11C45CC330DB3
Requests: 13 HTTP requests in this frame
Frame:
https://ingdirectspain.demdex.net/dest5.html?d_nsid=0
Frame ID: 52E2047E5736DC3A5864BFE4EE2CE120
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://ing.areaclientes.us/
HTTP 302
https://zatanka.com/pfm HTTP 301
https://zatanka.com/pfm/ Page URL
- https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=8UT9aqUzEaajae7OdXwo5TCgxdaiuAzoLDvw... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ing.areaclientes.us/
HTTP 302
https://zatanka.com/pfm HTTP 301
https://zatanka.com/pfm/ Page URL
- https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=8UT9aqUzEaajae7OdXwo5TCgxdaiuAzoLDvwr7WgGveFiajCYnlJr7P7R03trJcxXiM453GQqkpZulTi Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://ing.areaclientes.us/ HTTP 302
- https://zatanka.com/pfm HTTP 301
- https://zatanka.com/pfm/
- https://ing.ingdirect.es/genoma_transactional/cms_files/posglobal/images/login/banner-login_1164x300.jpg HTTP 302
- https://ing.ingdirect.es/genoma_cms_files/posglobal/images/login/banner-login_1164x300.jpg
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
zatanka.com/pfm/ Redirect Chain
|
204 B 552 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
zatanka.com/pfm/ |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transactional.css
zatanka.com/pfm/ |
3 MB 419 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoING.svg
ing.ingdirect.es/pfm/assets/images/svg/ |
33 KB 13 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LogoDNIE-trazado.svg
ing.ingdirect.es/pfm/assets/images/ |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.min.js
ing.ingdirect.es/pfm/cdn/ing.libs.require/1.0.0/ |
16 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-preconditions.js
zatanka.com/pfm/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner-login_1164x300.jpg
ing.ingdirect.es/genoma_cms_files/posglobal/images/login/ Redirect Chain
|
87 KB 87 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transactional.css
zatanka.com/pfm/ |
3 MB 419 KB |
Font
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icono_twyp.svg
ing.ingdirect.es/pfm/assets/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ing-direct-icons.woff
zatanka.com/pfm/ |
206 KB 206 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-preconditions.js
zatanka.com/pfm/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
ingdirectspain.demdex.net/ Frame 52E2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
INGMeWeb-Regular.ttf
zatanka.com/pfm/ |
74 KB 74 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| locationHref object| loginReleaseVersion undefined| parentURL undefined| urlsAllowed function| requirejs function| require function| define1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
zatanka.com/ | Name: PHPSESSID Value: 4943d010e1693cbba54777914872f8f8 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ing.areaclientes.us
ing.ingdirect.es
ingdirectspain.demdex.net
zatanka.com
104.219.248.25
108.128.20.85
193.41.234.21
45.32.197.61
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
2d0bd238bea24334b756db3ceed592b175cad6ce035c0592e8dbeb45206eea23
4d758029586ebb67b7074830ab076460734a4ce175cc598f0580cbdc2b609e0e
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
54c17d0ed3bb11026280e35e61f337431dc74e1f66eb78f445cf65154c0282ae
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
6bec0ba6c0541fe28653fe190e20a9d09a508e530d551e433216a0c317b84a32
a5c74ae990d5d2b575b740de198718c44c9126a1b06358cc2833dce69c655b4b
c3e32425f9f950c7f4ec3919c6bcd78c82306a6973e30e1ecc59af204605796d
c67bb459bc0e802438070a144fd190d3d029566a259375bd8f5de8d34cc85407