ing-zahlung.com
Open in
urlscan Pro
38.68.46.177
Malicious Activity!
Public Scan
URL:
https://ing-zahlung.com/banken/de/n26/login
Submission: On April 28 via manual from DE
Submission: On April 28 via manual from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 38.68.46.177, located in
United States and
belongs to MAJESTIC-HOSTING-01, US.
The main domain is ing-zahlung.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 24th 2020. Valid for: 3 months.
This is the only time ing-zahlung.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on April 24th 2020. Valid for: 3 months.
This is the only time ing-zahlung.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: N26 (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 38.68.46.177 38.68.46.177 | 396073 (MAJESTIC-...) (MAJESTIC-HOSTING-01) | |
| 11 | 128.65.211.162 128.65.211.162 | 34309 (LINK11 Li...) (LINK11 Link11 GmbH) | |
| 14 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
n26.com
app.n26.com Failed |
|
| 1 |
ing-zahlung.com
ing-zahlung.com |
180 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | app.n26.com |
ing-zahlung.com
|
| 1 | ing-zahlung.com | |
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| get.n26.com |
| docs.n26.com |
| n26.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.ing-zahlung.com Let's Encrypt Authority X3 |
2020-04-24 - 2020-07-23 |
3 months | crt.sh |
| n26.com DigiCert ECC Extended Validation Server CA |
2019-08-08 - 2021-08-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://ing-zahlung.com/banken/de/n26/login
Frame ID: 3CF65E800A848F83E75B42C5071389FE
Requests: 17 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
URL: https://get.n26.com/
Title: Ein Konto anlegen
Title: Ein Konto anlegen
Search URL Search Domain Scan URL
URL: https://docs.n26.com/legal/01+DE/03+Privacy%20Policy/de/01privacy-policy-de.pdf
Title: Datenschutzbestimmungen(neuen Tab)
Title: Datenschutzbestimmungen(neuen Tab)
Search URL Search Domain Scan URL
URL: https://n26.com/de-de/impressum
Title: Impressum(neuen Tab)
Title: Impressum(neuen Tab)
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
login
ing-zahlung.com/banken/de/n26/ |
179 KB 180 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
GT-America-Standard-Regular.latin.woff2
app.n26.com/build/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
GT-America-Extended-Medium.latin.woff2
app.n26.com/build/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
client.f127e013.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendors~PreAppAuth~StripeTopup~components-AccountPurposePage~components-ActionsPage~components-Activ~e25c8d21.62102f7f.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendors~PreAppAuth~StripeTopup~components-AccountPurposePage~components-ActionsPage~components-Activ~782a9b24.1c6bb646.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendors~PreAppAuth~StripeTopup~components-ActivateCardForm~components-CardSettingsPage~components-Ex~46560b67.cdd9d7b3.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PreAppAuth~components-ActivateCardForm~components-ExternalAccountsAddFundsFlow~components-ProductSel~1341d55f.16f6a363.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PreAppAuth.c4c21d69.js
app.n26.com/build/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
components-AccountRouter~components-BankAccountInfo~components-ReferralDashboard.571bbb6e.js
app.n26.com/build/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
components-AccountRouter.380a80ac.js
app.n26.com/build/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendors~components-SpacesRouter.2d7256f2.js
app.n26.com/build/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
components-SpacesRouter.ce656a92.js
app.n26.com/build/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
components-PremiumRouter.45f349e1.js
app.n26.com/build/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- app.n26.com
- URL
- https://app.n26.com/build/fonts/GT-America-Standard-Regular.latin.woff2
- Domain
- app.n26.com
- URL
- https://app.n26.com/build/fonts/GT-America-Extended-Medium.latin.woff2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: N26 (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| savepage_ShadowLoader2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| ing-zahlung.com/ | Name: laravel_session Value: eyJpdiI6InJMZjBFS1FXTjdjRndMQzlFTlRZOGc9PSIsInZhbHVlIjoiRjRKdmFUcit1WUVuUndzaDE1dWw3ZXRFZjVDbFVKaWFMbGEzMUFCKzd2SnIvTURZRW9rQURHRTd6anBaaStIWCIsIm1hYyI6Ijg4ZmNlNDQwYjUzM2RiY2IxNjdiMDg2OTFiZjY0YzhjNTdjZjAxMmNjNDY3MWYxNjcyYzBlNmFlZTg1ZDM2ZjMifQ%3D%3D |
|
| ing-zahlung.com/ | Name: XSRF-TOKEN Value: eyJpdiI6IlpGcnBDOVlPS05Id3ZiR3dMVW9NaHc9PSIsInZhbHVlIjoiblk2TjlsL0FiaTBQZTdrK0hEb2tCWi8yVUdHcHVoREl4SEFZVExUQTZ2Nk5vQnBXSE5lYkM1a2hINlpMRlo3RCIsIm1hYyI6IjE4NzE4OGVlYTRjMjljYzJhNWYwNDUxZTRiNGIwNTA3YzcxZDVkOTUzNGFlZTU3OWU2ODQxZWM3ZWNkYjUyYWIifQ%3D%3D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.n26.com
ing-zahlung.com
app.n26.com
128.65.211.162
38.68.46.177
57b016225d321a77e0a129515f4436a9bcd53cd6ba8dcd32a96b95ec55d7a785
6e4e3e7105f681e2331927f53b697c7c5f7a98fecf3058a489d92677f6f8db01
c6a5e2cf7945573c6e7c595d5875a6bb3696cfb5b5783209cd3ed5c1c8ed9b9f
e1c2d323b6b5d86a647a34092f9c18b935f807b46f924578865a738f7b518f10